From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39253) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WGtGf-0000P0-Qo for qemu-devel@nongnu.org; Fri, 21 Feb 2014 11:48:10 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WGtGa-0004w0-Hs for qemu-devel@nongnu.org; Fri, 21 Feb 2014 11:48:05 -0500 Received: from mail-la0-f45.google.com ([209.85.215.45]:41032) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WGtGa-0004vs-8H for qemu-devel@nongnu.org; Fri, 21 Feb 2014 11:48:00 -0500 Received: by mail-la0-f45.google.com with SMTP id b8so2521335lan.18 for ; Fri, 21 Feb 2014 08:47:59 -0800 (PST) MIME-Version: 1.0 In-Reply-To: <1393000925-8446-2-git-send-email-armbru@redhat.com> References: <1393000925-8446-1-git-send-email-armbru@redhat.com> <1393000925-8446-2-git-send-email-armbru@redhat.com> From: Peter Maydell Date: Fri, 21 Feb 2014 16:47:38 +0000 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: Re: [Qemu-devel] [PATCH 1/2] vfio: Fix overrun after readlink() fills buffer completely List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Markus Armbruster Cc: Alex Williamson , QEMU Developers On 21 February 2014 16:42, Markus Armbruster wrote: > readlink() returns the number of bytes written to the buffer, and it > doesn't write a terminating null byte. vfio_init() writes it itself. > Overruns the buffer when readlink() filled it completely. > > Fix by reserving space for the null byte when calling readlink(), like > we do elsewhere. > > Spotted by Coverity. > > Signed-off-by: Markus Armbruster > --- > hw/misc/vfio.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/misc/vfio.c b/hw/misc/vfio.c > index 8db182f..8e56785 100644 > --- a/hw/misc/vfio.c > +++ b/hw/misc/vfio.c > @@ -3681,7 +3681,7 @@ static int vfio_initfn(PCIDevice *pdev) > > strncat(path, "iommu_group", sizeof(path) - strlen(path) - 1); > > - len = readlink(path, iommu_group_path, PATH_MAX); > + len = readlink(path, iommu_group_path, PATH_MAX - 1); > if (len <= 0) { > error_report("vfio: error no iommu_group for device"); > return -errno; "sizeof(iommu_group_path) - 1" would be slightly better, I think, but PATH_MAX - 1 works too. Reviewed-by: Peter Maydell (cc stable?) thanks -- PMM