From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:52450) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gzuL3-0000BK-As for qemu-devel@nongnu.org; Fri, 01 Mar 2019 21:25:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gzuHD-0005mt-Eo for qemu-devel@nongnu.org; Fri, 01 Mar 2019 21:21:24 -0500 Received: from hera.aquilenet.fr ([2a0c:e300::1]:47144) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gzuHC-0005ag-C8 for qemu-devel@nongnu.org; Fri, 01 Mar 2019 21:21:23 -0500 Date: Fri, 1 Mar 2019 18:21:08 -0800 From: Samuel Thibault Message-ID: <20190302022108.tfhnu4kdgnujjpwq@function> References: <1551476756-25749-1-git-send-email-will@wbowling.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1551476756-25749-1-git-send-email-will@wbowling.info> Subject: Re: [Qemu-devel] [PATCH] slirp: check sscanf result when emulating ident List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: William Bowling Cc: qemu-devel@nongnu.org, secalert@redhat.com William Bowling, le ven. 01 mars 2019 21:45:56 +0000, a ecrit: > When emulating ident in tcp_emu, if the strchr checks passed but the > sscanf check failed, two uninitialized variables would be copied and > sent in the reply. > > Signed-off-by: William Bowling Applied to my tree, thanks! > --- > slirp/tcp_subr.c | 12 ++++++------ > 1 file changed, 6 insertions(+), 6 deletions(-) > > diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c > index 262a42d6c8..73a160ba16 100644 > --- a/slirp/tcp_subr.c > +++ b/slirp/tcp_subr.c > @@ -664,12 +664,12 @@ tcp_emu(struct socket *so, struct mbuf *m) > break; > } > } > - } > - so_rcv->sb_cc = snprintf(so_rcv->sb_data, > - so_rcv->sb_datalen, > - "%d,%d\r\n", n1, n2); > - so_rcv->sb_rptr = so_rcv->sb_data; > - so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc; > + so_rcv->sb_cc = snprintf(so_rcv->sb_data, > + so_rcv->sb_datalen, > + "%d,%d\r\n", n1, n2); > + so_rcv->sb_rptr = so_rcv->sb_data; > + so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc; > + } > } > m_free(m); > return 0; > -- > 2.15.1 > > -- Samuel What's this script do? unzip ; touch ; finger ; mount ; gasp ; yes ; umount ; sleep Hint for the answer: not everything is computer-oriented. Sometimes you're in a sleeping bag, camping out. (Contributed by Frans van der Zande.)