Skip to content

Commit 03d7712

Browse files
Prasad J Panditmdroth
Prasad J Pandit
authored andcommitted
qemu-bridge-helper: restrict interface name to IFNAMSIZ
The network interface name in Linux is defined to be of size IFNAMSIZ(=16), including the terminating null('\0') byte. The same is applied to interface names read from 'bridge.conf' file to form ACL rules. If user supplied '--br=bridge' name is not restricted to the same length, it could lead to ACL bypass issue. Restrict interface name to IFNAMSIZ, including null byte. Reported-by: Riccardo Schirone <rschiron@redhat.com> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Signed-off-by: Jason Wang <jasowang@redhat.com> (cherry picked from commit 6f5d867) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
1 parent 4482258 commit 03d7712

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

Diff for: qemu-bridge-helper.c

+11
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list)
109109
}
110110
*argend = 0;
111111

112+
if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) {
113+
fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg));
114+
fclose(f);
115+
errno = EINVAL;
116+
return -1;
117+
}
118+
112119
if (strcmp(cmd, "deny") == 0) {
113120
acl_rule = g_malloc(sizeof(*acl_rule));
114121
if (strcmp(arg, "all") == 0) {
@@ -259,6 +266,10 @@ int main(int argc, char **argv)
259266
usage();
260267
return EXIT_FAILURE;
261268
}
269+
if (strlen(bridge) >= IFNAMSIZ) {
270+
fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge));
271+
return EXIT_FAILURE;
272+
}
262273

263274
/* parse default acl file */
264275
QSIMPLEQ_INIT(&acl_list);

0 commit comments

Comments
 (0)