From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35996) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aHArk-0007B1-CV for qemu-devel@nongnu.org; Thu, 07 Jan 2016 08:44:37 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aHArj-00030i-Fh for qemu-devel@nongnu.org; Thu, 07 Jan 2016 08:44:36 -0500 From: Paolo Bonzini Date: Thu, 7 Jan 2016 14:44:25 +0100 Message-Id: <1452174266-11594-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1452174266-11594-1-git-send-email-pbonzini@redhat.com> References: <1452174266-11594-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 1/2] nbd: do not check request length except for reads and writes List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, sitsofe@yahoo.com, qemu-block@nongnu.org, mreitz@redhat.com Only reads and writes need to allocate memory correspondent to the request length. Other requests can be sent to the storage without allocating any memory, and thus any request length is acceptable. Reported-by: Sitsofe Wheeler Cc: qemu-block@nongnu.org Signed-off-by: Paolo Bonzini --- nbd.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/nbd.c b/nbd.c index b3d9654..e395a16 100644 --- a/nbd.c +++ b/nbd.c @@ -1227,13 +1227,6 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *reque goto out; } - if (request->len > NBD_MAX_BUFFER_SIZE) { - LOG("len (%u) is larger than max len (%u)", - request->len, NBD_MAX_BUFFER_SIZE); - rc = -EINVAL; - goto out; - } - if ((request->from + request->len) < request->from) { LOG("integer overflow detected! " "you're probably being attacked"); @@ -1245,6 +1238,13 @@ static ssize_t nbd_co_receive_request(NBDRequest *req, struct nbd_request *reque command = request->type & NBD_CMD_MASK_COMMAND; if (command == NBD_CMD_READ || command == NBD_CMD_WRITE) { + if (request->len > NBD_MAX_BUFFER_SIZE) { + LOG("len (%u) is larger than max len (%u)", + request->len, NBD_MAX_BUFFER_SIZE); + rc = -EINVAL; + goto out; + } + req->data = blk_blockalign(client->exp->blk, request->len); } if (command == NBD_CMD_WRITE) { -- 2.5.0