From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56228) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aoeXn-0001rg-Jl for qemu-devel@nongnu.org; Fri, 08 Apr 2016 18:06:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aoeXm-0007Uh-PP for qemu-devel@nongnu.org; Fri, 08 Apr 2016 18:06:23 -0400 From: Eric Blake Date: Fri, 8 Apr 2016 16:05:46 -0600 Message-Id: <1460153158-21612-7-git-send-email-eblake@redhat.com> In-Reply-To: <1460153158-21612-1-git-send-email-eblake@redhat.com> References: <1460153158-21612-1-git-send-email-eblake@redhat.com> Subject: [Qemu-devel] [PATCH 06/18] nbd: Avoid magic number for NBD max name size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: alex@alex.org.uk, Paolo Bonzini , Kevin Wolf , "open list:Block layer core" Declare a constant and use that when determining if an export name fits within the constraints we are willing to support. Signed-off-by: Eric Blake --- include/block/nbd.h | 2 ++ nbd/client.c | 2 +- nbd/server.c | 4 ++-- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/include/block/nbd.h b/include/block/nbd.h index b86a976..3f047bf 100644 --- a/include/block/nbd.h +++ b/include/block/nbd.h @@ -76,6 +76,8 @@ enum { /* Maximum size of a single READ/WRITE data buffer */ #define NBD_MAX_BUFFER_SIZE (32 * 1024 * 1024) +/* Maximum size of an export name */ +#define NBD_MAX_NAME_SIZE 255 ssize_t nbd_wr_syncv(QIOChannel *ioc, struct iovec *iov, diff --git a/nbd/client.c b/nbd/client.c index c834587..00f9244 100644 --- a/nbd/client.c +++ b/nbd/client.c @@ -210,7 +210,7 @@ static int nbd_receive_list(QIOChannel *ioc, char **name, Error **errp) error_setg(errp, "incorrect option name length"); return -1; } - if (namelen > 255) { + if (namelen > NBD_MAX_NAME_SIZE) { error_setg(errp, "export name length too long %" PRIu32, namelen); return -1; } diff --git a/nbd/server.c b/nbd/server.c index a10294e..5414c49 100644 --- a/nbd/server.c +++ b/nbd/server.c @@ -285,13 +285,13 @@ static int nbd_negotiate_handle_list(NBDClient *client, uint32_t length) static int nbd_negotiate_handle_export_name(NBDClient *client, uint32_t length) { int rc = -EINVAL; - char name[256]; + char name[NBD_MAX_NAME_SIZE + 1]; /* Client sends: [20 .. xx] export name (length bytes) */ TRACE("Checking length"); - if (length > 255) { + if (length >= sizeof(name)) { LOG("Bad length received"); goto fail; } -- 2.5.5