* [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value
@ 2013-11-28 17:12 Laszlo Ersek
2013-11-28 18:32 ` Markus Armbruster
2013-12-16 14:56 ` Michael S. Tsirkin
0 siblings, 2 replies; 4+ messages in thread
From: Laszlo Ersek @ 2013-11-28 17:12 UTC (permalink / raw)
To: qemu-devel, qemu-stable
qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in
question would be trivial to satisfy (eg. because it's empty). For
example:
qemu_opts_parse()
opts_parse()
qemu_opts_create()
id_wellformed()
In practice:
$ .../qemu-system-x86_64 -acpitable id=3
qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier
**
ERROR:vl.c:3491:main: assertion failed: (opts != NULL)
Aborted (core dumped)
$ .../qemu-system-x86_64 -smbios id=3
qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier
Segmentation fault (core dumped)
I checked all qemu_opts_parse() invocations (and all drive_def()
invocations too, because it blindly forwards the former's retval). Only
the two above examples look problematic.
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
---
vl.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/vl.c b/vl.c
index 8d5d874..1863fdd 100644
--- a/vl.c
+++ b/vl.c
@@ -3488,11 +3488,16 @@ int main(int argc, char **argv, char **envp)
}
case QEMU_OPTION_acpitable:
opts = qemu_opts_parse(qemu_find_opts("acpi"), optarg, 1);
- g_assert(opts != NULL);
+ if (!opts) {
+ exit(1);
+ }
do_acpitable_option(opts);
break;
case QEMU_OPTION_smbios:
opts = qemu_opts_parse(qemu_find_opts("smbios"), optarg, 0);
+ if (!opts) {
+ exit(1);
+ }
do_smbios_option(opts);
break;
case QEMU_OPTION_enable_kvm:
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value
2013-11-28 17:12 [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value Laszlo Ersek
@ 2013-11-28 18:32 ` Markus Armbruster
2013-12-10 4:58 ` Laszlo Ersek
2013-12-16 14:56 ` Michael S. Tsirkin
1 sibling, 1 reply; 4+ messages in thread
From: Markus Armbruster @ 2013-11-28 18:32 UTC (permalink / raw)
To: Laszlo Ersek; +Cc: qemu-devel, qemu-stable
Laszlo Ersek <lersek@redhat.com> writes:
> qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in
> question would be trivial to satisfy (eg. because it's empty). For
> example:
>
> qemu_opts_parse()
> opts_parse()
> qemu_opts_create()
> id_wellformed()
>
> In practice:
>
> $ .../qemu-system-x86_64 -acpitable id=3
> qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier
> **
> ERROR:vl.c:3491:main: assertion failed: (opts != NULL)
> Aborted (core dumped)
>
> $ .../qemu-system-x86_64 -smbios id=3
> qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier
> Segmentation fault (core dumped)
>
> I checked all qemu_opts_parse() invocations (and all drive_def()
> invocations too, because it blindly forwards the former's retval). Only
> the two above examples look problematic.
>
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Your fix is fine. I didn't redo your search for other unsafe uses.
Reviewed-by: Markus Armbruster <armbru@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value
2013-11-28 18:32 ` Markus Armbruster
@ 2013-12-10 4:58 ` Laszlo Ersek
0 siblings, 0 replies; 4+ messages in thread
From: Laszlo Ersek @ 2013-12-10 4:58 UTC (permalink / raw)
To: qemu-devel, qemu-stable; +Cc: Markus Armbruster
On 11/28/13 19:32, Markus Armbruster wrote:
> Laszlo Ersek <lersek@redhat.com> writes:
>
>> qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in
>> question would be trivial to satisfy (eg. because it's empty). For
>> example:
>>
>> qemu_opts_parse()
>> opts_parse()
>> qemu_opts_create()
>> id_wellformed()
>>
>> In practice:
>>
>> $ .../qemu-system-x86_64 -acpitable id=3
>> qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier
>> **
>> ERROR:vl.c:3491:main: assertion failed: (opts != NULL)
>> Aborted (core dumped)
>>
>> $ .../qemu-system-x86_64 -smbios id=3
>> qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier
>> Segmentation fault (core dumped)
>>
>> I checked all qemu_opts_parse() invocations (and all drive_def()
>> invocations too, because it blindly forwards the former's retval). Only
>> the two above examples look problematic.
>>
>> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
>
> Your fix is fine. I didn't redo your search for other unsafe uses.
>
> Reviewed-by: Markus Armbruster <armbru@redhat.com>
>
Ping -- please commit this.
Thanks
Laszlo
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value
2013-11-28 17:12 [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value Laszlo Ersek
2013-11-28 18:32 ` Markus Armbruster
@ 2013-12-16 14:56 ` Michael S. Tsirkin
1 sibling, 0 replies; 4+ messages in thread
From: Michael S. Tsirkin @ 2013-12-16 14:56 UTC (permalink / raw)
To: Laszlo Ersek; +Cc: qemu-devel, qemu-stable
On Thu, Nov 28, 2013 at 06:12:59PM +0100, Laszlo Ersek wrote:
> qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in
> question would be trivial to satisfy (eg. because it's empty). For
> example:
>
> qemu_opts_parse()
> opts_parse()
> qemu_opts_create()
> id_wellformed()
>
> In practice:
>
> $ .../qemu-system-x86_64 -acpitable id=3
> qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier
> **
> ERROR:vl.c:3491:main: assertion failed: (opts != NULL)
> Aborted (core dumped)
>
> $ .../qemu-system-x86_64 -smbios id=3
> qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier
> Segmentation fault (core dumped)
>
> I checked all qemu_opts_parse() invocations (and all drive_def()
> invocations too, because it blindly forwards the former's retval). Only
> the two above examples look problematic.
>
> Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Applied, thanks.
> ---
> vl.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/vl.c b/vl.c
> index 8d5d874..1863fdd 100644
> --- a/vl.c
> +++ b/vl.c
> @@ -3488,11 +3488,16 @@ int main(int argc, char **argv, char **envp)
> }
> case QEMU_OPTION_acpitable:
> opts = qemu_opts_parse(qemu_find_opts("acpi"), optarg, 1);
> - g_assert(opts != NULL);
> + if (!opts) {
> + exit(1);
> + }
> do_acpitable_option(opts);
> break;
> case QEMU_OPTION_smbios:
> opts = qemu_opts_parse(qemu_find_opts("smbios"), optarg, 0);
> + if (!opts) {
> + exit(1);
> + }
> do_smbios_option(opts);
> break;
> case QEMU_OPTION_enable_kvm:
> --
> 1.8.3.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2013-12-16 14:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-28 17:12 [Qemu-devel] [PATCH] qemu_opts_parse(): always check return value Laszlo Ersek
2013-11-28 18:32 ` Markus Armbruster
2013-12-10 4:58 ` Laszlo Ersek
2013-12-16 14:56 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).