]> Git Repo - qemu.git/commit - linux-user/fd-trans.c
Fix unsigned integer underflow in fd-trans.c
authorShu-Chun Weng <[email protected]>
Fri, 18 Oct 2019 00:19:20 +0000 (17:19 -0700)
committerLaurent Vivier <[email protected]>
Mon, 21 Oct 2019 09:34:18 +0000 (11:34 +0200)
commit1645fb5a1e537f85eda744bfa6e9d3dda047ba28
tree688a4ab68f99f102371dac1a53df1ade304fa9da
parent53bdbfdf5326ad453b307c5b4bb9e71aeab29cf3
Fix unsigned integer underflow in fd-trans.c

In any of these `*_for_each_*` functions, the last entry in the buffer (so the
"remaining length in the buffer" `len` is equal to the length of the
entry `nlmsg_len`/`nla_len`/etc) has size that is not a multiple of the
alignment, the aligned lengths `*_ALIGN(*_len)` will be greater than `len`.
Since `len` is unsigned (`size_t`), it underflows and the loop will read
pass the buffer.

This may manifest as random EINVAL or EOPNOTSUPP error on IO or network
system calls.

Signed-off-by: Shu-Chun Weng <[email protected]>
Reviewed-by: Laurent Vivier <[email protected]>
Message-Id: <20191018001920[email protected]>
Signed-off-by: Laurent Vivier <[email protected]>
linux-user/fd-trans.c
This page took 0.028485 seconds and 4 git commands to generate.