[Qemu-devel] [PATCH] 9pfs: fix integer overflow issue in xattr read/write

[Li Qiang <liq3ea@gmail.com>]

From: Li Qiang <liqiang6-s@360.cn>

In 9pfs xattr read/write function, it mix to use unsigned/signed
,32/64 bits integers. This will causes oob read/write issues. This
patch fix this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
 hw/9pfs/9p.c | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index e4040dc..8b50bfb 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1642,21 +1642,21 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp,
 {
     ssize_t err;
     size_t offset = 7;
-    int read_count;
-    int64_t xattr_len;
+    uint64_t read_count;
+    uint64_t xattr_len;
     V9fsVirtioState *v = container_of(s, V9fsVirtioState, state);
     VirtQueueElement *elem = v->elems[pdu->idx];
 
     xattr_len = fidp->fs.xattr.len;
+    if (xattr_len < off) {
+        read_count = 0;
+        goto over_read_count;
+    }
     read_count = xattr_len - off;
     if (read_count > max_count) {
         read_count = max_count;
-    } else if (read_count < 0) {
-        /*
-         * read beyond XATTR value
-         */
-        read_count = 0;
     }
+over_read_count:
     err = pdu_marshal(pdu, offset, "d", read_count);
     if (err < 0) {
         return err;
@@ -1982,22 +1982,19 @@ static int v9fs_xattr_write(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp,
 {
     int i, to_copy;
     ssize_t err = 0;
-    int write_count;
-    int64_t xattr_len;
+    uint64_t write_count;
+    uint64_t xattr_len;
     size_t offset = 7;
 
 
     xattr_len = fidp->fs.xattr.len;
+    if (xattr_len < off) {
+        err = -ENOSPC;
+        goto out;
+    }
     write_count = xattr_len - off;
     if (write_count > count) {
         write_count = count;
-    } else if (write_count < 0) {
-        /*
-         * write beyond XATTR value len specified in
-         * xattrcreate
-         */
-        err = -ENOSPC;
-        goto out;
     }
     err = pdu_marshal(pdu, offset, "d", write_count);
     if (err < 0) {
-- 
1.8.3.1