[prev in list] [next in list] [prev in thread] [next in thread] 

List:       libvir-list
Subject:    [libvirt PATCH 14/19] commandhelper: Make number of fds variable in printInput
From:       Tim Wiederhake <twiederh () redhat ! com>
Date:       2021-01-29 16:16:24
Message-ID: 20210129161629.604823-15-twiederh () redhat ! com
[Download RAW message or body]

Fixes a buffer overflow triggered when more than three "--readfd"
arguments were given on the command line.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
---
 tests/commandhelper.c | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/tests/commandhelper.c b/tests/commandhelper.c
index d501e33e88..72a3e89da1 100644
--- a/tests/commandhelper.c
+++ b/tests/commandhelper.c
@@ -194,13 +194,22 @@ static int printCwd(FILE *log)
 static int printInput(struct Arguments *args)
 {
     char buf[1024];
-    struct pollfd fds[3];
-    char *buffers[3] = {NULL, NULL, NULL};
-    size_t buflen[3] = {0, 0, 0};
+    struct pollfd *fds = NULL;
+    char **buffers = NULL;
+    size_t *buflen = NULL;
     int ret = -1;
     size_t i;
     ssize_t got;
 
+    if (!(fds = calloc(args->numreadfds, sizeof(*fds))))
+        goto cleanup;
+
+    if (!(buffers = calloc(args->numreadfds, sizeof(*buffers))))
+        goto cleanup;
+
+    if (!(buflen = calloc(args->numreadfds, sizeof(*buflen))))
+        goto cleanup;
+
     if (args->close_stdin) {
         if (freopen("/dev/null", "r", stdin) != stdin)
             goto cleanup;
@@ -282,8 +291,14 @@ static int printInput(struct Arguments *args)
     ret = 0;
 
  cleanup:
-    for (i = 0; i < G_N_ELEMENTS(buffers); i++)
-        free(buffers[i]);
+    if (buffers) {
+        for (i = 0; i < args->numreadfds; i++)
+            free(buffers[i]);
+    }
+    free(fds);
+    free(buflen);
+    free(buffers);
+
     return ret;
 }
 
-- 
2.26.2

[prev in list] [next in list] [prev in thread] [next in thread]