Commit 6f5d8671 authored Jul 23, 2019 by Prasad J Pandit Committed by Jason Wang Jul 29, 2019

qemu-bridge-helper: restrict interface name to IFNAMSIZ



The network interface name in Linux is defined to be of size
IFNAMSIZ(=16), including the terminating null('\0') byte.
The same is applied to interface names read from 'bridge.conf'
file to form ACL rules. If user supplied '--br=bridge' name
is not restricted to the same length, it could lead to ACL bypass
issue. Restrict interface name to IFNAMSIZ, including null byte.

Reported-by: Riccardo Schirone <rschiron@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>

parent f46efa9b

qemu-bridge-helper.c

+11 −0

Original line number	Diff line number	Diff line
		@@ -119,6 +119,13 @@ static int parse_acl_file(const char filename, ACLList acl_list)
		}
		*argend = 0;

		if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {
		fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));
		fclose(f);
		errno = EINVAL;
		return -1;
		}

		if (strcmp(cmd, "deny") == 0) {
		acl_rule = g_malloc(sizeof(*acl_rule));
		if (strcmp(arg, "all") == 0) {
		@@ -269,6 +276,10 @@ int main(int argc, char **argv)
		usage();
		return EXIT_FAILURE;
		}
		if (strlen(bridge) >= IFNAMSIZ) {
		fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));
		return EXIT_FAILURE;
		}

		/* parse default acl file */
		QSIMPLEQ_INIT(&acl_list);