Commit d3222975 authored by William Bowling's avatar William Bowling Committed by Samuel Thibault
Browse files

slirp: check sscanf result when emulating ident 



When emulating ident in tcp_emu, if the strchr checks passed but the
sscanf check failed, two uninitialized variables would be copied and
sent in the reply, so move this code inside the if(sscanf()) clause.

Signed-off-by: default avatarWilliam Bowling <will@wbowling.info>
Cc: qemu-stable@nongnu.org
Cc: secalert@redhat.com
Message-Id: <1551476756-25749-1-git-send-email-will@wbowling.info>
Signed-off-by: default avatarSamuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
parent 6c419a1e

slirp/tcp_subr.c

+5 −5
Original line number Diff line number Diff line
@@ -664,13 +664,13 @@ tcp_emu(struct socket *so, struct mbuf *m) 
							break;

						}

					}

				}

					so_rcv->sb_cc = snprintf(so_rcv->sb_data,

								 so_rcv->sb_datalen,

								 "%d,%d\r\n", n1, n2);

					so_rcv->sb_rptr = so_rcv->sb_data;

					so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;

				}

			}

			m_free(m);

			return 0;

		}