[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCHv2 04/22] sheepdog: avoid a few buffer overruns
From: |
Jim Meyering |
Subject: |
[Qemu-devel] [PATCHv2 04/22] sheepdog: avoid a few buffer overruns |
Date: |
Wed, 30 May 2012 09:46:23 +0200 |
From: Jim Meyering <address@hidden>
* parse_vdiname: Use pstrcpy, not strncpy, when the destination
buffer must be NUL-terminated.
* sd_open: Likewise, avoid buffer overrun.
* do_sd_create: Likewise. Leave the preceding memset, since
pstrcpy does not NUL-fill, and filename needs that.
* sd_snapshot_create: Add a comment/question.
* find_vdi_name: Remove a useless memset.
* sd_snapshot_goto: Remove a useless memset.
Use pstrcpy to NUL-terminate, because find_vdi_name requires
that its vdi arg (filename parameter) be NUL-terminated.
It seems ok not to NUL-fill the buffer.
Do the same for snapid: remove useless memset-0 (instead,
zero tag[0]). Use pstrcpy, not strncpy.
* sd_snapshot_list: Use pstrcpy, not strncpy to write
into the ->name member. Each must be NUL-terminated.
Acked-by: Kevin Wolf <address@hidden>
Acked-by: MORITA Kazutaka <address@hidden>
Signed-off-by: Jim Meyering <address@hidden>
---
block/sheepdog.c | 34 ++++++++++++++++++++++------------
1 file changed, 22 insertions(+), 12 deletions(-)
diff --git a/block/sheepdog.c b/block/sheepdog.c
index 6d52277..6f405b5 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -857,14 +857,14 @@ static int parse_vdiname(BDRVSheepdogState *s, const char
*filename,
s->port = 0;
}
- strncpy(vdi, p, SD_MAX_VDI_LEN);
+ pstrcpy(vdi, SD_MAX_VDI_LEN, p);
p = strchr(vdi, ':');
if (p) {
*p++ = '\0';
*snapid = strtoul(p, NULL, 10);
if (*snapid == 0) {
- strncpy(tag, p, SD_MAX_VDI_TAG_LEN);
+ pstrcpy(tag, SD_MAX_VDI_TAG_LEN, p);
}
} else {
*snapid = CURRENT_VDI_ID; /* search current vdi */
@@ -891,7 +891,10 @@ static int find_vdi_name(BDRVSheepdogState *s, char
*filename, uint32_t snapid,
return fd;
}
- memset(buf, 0, sizeof(buf));
+ /* This pair of strncpy calls ensures that the buffer is zero-filled,
+ * which is desirable since we'll soon be sending those bytes, and
+ * don't want the send_req to read uninitialized data.
+ */
strncpy(buf, filename, SD_MAX_VDI_LEN);
strncpy(buf + SD_MAX_VDI_LEN, tag, SD_MAX_VDI_TAG_LEN);
@@ -1141,7 +1144,7 @@ static int sd_open(BlockDriverState *bs, const char
*filename, int flags)
s->max_dirty_data_idx = 0;
bs->total_sectors = s->inode.vdi_size / SECTOR_SIZE;
- strncpy(s->name, vdi, sizeof(s->name));
+ pstrcpy(s->name, sizeof(s->name), vdi);
qemu_co_mutex_init(&s->lock);
g_free(buf);
return 0;
@@ -1169,8 +1172,11 @@ static int do_sd_create(char *filename, int64_t vdi_size,
return fd;
}
+ /* FIXME: would it be better to fail (e.g., return -EIO) when filename
+ * does not fit in buf? For now, just truncate and avoid buffer overrun.
+ */
memset(buf, 0, sizeof(buf));
- strncpy(buf, filename, SD_MAX_VDI_LEN);
+ pstrcpy(buf, sizeof(buf), filename);
memset(&hdr, 0, sizeof(hdr));
hdr.opcode = SD_OP_NEW_VDI;
@@ -1740,6 +1746,9 @@ static int sd_snapshot_create(BlockDriverState *bs,
QEMUSnapshotInfo *sn_info)
s->inode.vm_state_size = sn_info->vm_state_size;
s->inode.vm_clock_nsec = sn_info->vm_clock_nsec;
+ /* It appears that inode.tag does not require a NUL terminator,
+ * which means this use of strncpy is ok.
+ */
strncpy(s->inode.tag, sn_info->name, sizeof(s->inode.tag));
/* we don't need to update entire object */
datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
@@ -1799,13 +1808,13 @@ static int sd_snapshot_goto(BlockDriverState *bs, const
char *snapshot_id)
memcpy(old_s, s, sizeof(BDRVSheepdogState));
- memset(vdi, 0, sizeof(vdi));
- strncpy(vdi, s->name, sizeof(vdi));
+ pstrcpy(vdi, sizeof(vdi), s->name);
- memset(tag, 0, sizeof(tag));
snapid = strtoul(snapshot_id, NULL, 10);
- if (!snapid) {
- strncpy(tag, s->name, sizeof(tag));
+ if (snapid) {
+ tag[0] = 0;
+ } else {
+ pstrcpy(tag, sizeof(tag), s->name);
}
ret = find_vdi_name(s, vdi, snapid, tag, &vid, 1);
@@ -1934,8 +1943,9 @@ static int sd_snapshot_list(BlockDriverState *bs,
QEMUSnapshotInfo **psn_tab)
snprintf(sn_tab[found].id_str, sizeof(sn_tab[found].id_str), "%u",
inode.snap_id);
- strncpy(sn_tab[found].name, inode.tag,
- MIN(sizeof(sn_tab[found].name), sizeof(inode.tag)));
+ pstrcpy(sn_tab[found].name,
+ MIN(sizeof(sn_tab[found].name), sizeof(inode.tag)),
+ inode.tag);
found++;
}
}
--
1.7.10.2.605.gbefc5ed
- [Qemu-devel] [PATCHv2 00/22] strncpy: best avoided, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 03/22] block: avoid buffer overrun by using pstrcpy, not strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 01/22] scsi, pci, qdev, isa-bus, sysbus: don't let *_get_fw_dev_path return NULL, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 07/22] lm32: avoid buffer overrun, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 02/22] sparc: use g_strdup in place of unchecked strdup, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 04/22] sheepdog: avoid a few buffer overruns,
Jim Meyering <=
- [Qemu-devel] [PATCHv2 05/22] vmdk: relative_path: use pstrcpy in place of strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 08/22] os-posix: avoid buffer overrun, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 06/22] hw/9pfs: avoid buffer overrun, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 10/22] linux-user: remove two unchecked uses of strdup, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 16/22] qemu-ga: prefer pstrcpy: consistently NUL-terminate ifreq.ifr_name, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 12/22] bt: replace fragile snprintf use and unwarranted strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 13/22] virtio-9p: avoid unwarranted uses of strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 09/22] ppc: avoid buffer overrun: use pstrcpy, not strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 11/22] ui/vnc: simplify and avoid strncpy, Jim Meyering, 2012/05/30
- [Qemu-devel] [PATCHv2 19/22] qcow2: mark this file's sole strncpy use as justified, Jim Meyering, 2012/05/30