* Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
2019-02-05 17:42 [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route() Peter Maydell
@ 2019-02-05 20:26 ` Philippe Mathieu-Daudé
2019-02-06 9:33 ` Stefano Garzarella
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2019-02-05 20:26 UTC (permalink / raw)
To: Peter Maydell, qemu-devel; +Cc: Riku Voipio, Laurent Vivier, patches
On 2/5/19 6:42 PM, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
>
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> linux-user/syscall.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
> char iface[16];
> uint32_t dest, gw, mask;
> unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> - sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> - iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> - &mask, &mtu, &window, &irtt);
> + int fields;
> +
> + fields = sscanf(line,
> + "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> + iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> + &mask, &mtu, &window, &irtt);
> + if (fields != 11) {
> + continue;
> + }
> dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
> metric, tswap32(mask), mtu, window, irtt);
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
2019-02-05 17:42 [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route() Peter Maydell
2019-02-05 20:26 ` Philippe Mathieu-Daudé
@ 2019-02-06 9:33 ` Stefano Garzarella
2019-02-06 9:56 ` Laurent Vivier
2019-02-06 10:07 ` Laurent Vivier
3 siblings, 0 replies; 5+ messages in thread
From: Stefano Garzarella @ 2019-02-06 9:33 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-devel, Riku Voipio, Laurent Vivier, patches
On Tue, Feb 05, 2019 at 05:42:07PM +0000, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
>
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> linux-user/syscall.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Thanks,
Stefano
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
2019-02-05 17:42 [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route() Peter Maydell
2019-02-05 20:26 ` Philippe Mathieu-Daudé
2019-02-06 9:33 ` Stefano Garzarella
@ 2019-02-06 9:56 ` Laurent Vivier
2019-02-06 10:07 ` Laurent Vivier
3 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2019-02-06 9:56 UTC (permalink / raw)
To: Peter Maydell, qemu-devel; +Cc: patches, Riku Voipio
On 05/02/2019 18:42, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
>
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> linux-user/syscall.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
> char iface[16];
> uint32_t dest, gw, mask;
> unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> - sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> - iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> - &mask, &mtu, &window, &irtt);
> + int fields;
> +
> + fields = sscanf(line,
> + "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> + iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> + &mask, &mtu, &window, &irtt);
> + if (fields != 11) {
> + continue;
> + }
> dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
> metric, tswap32(mask), mtu, window, irtt);
>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route()
2019-02-05 17:42 [Qemu-devel] [PATCH] linux-user: Check sscanf return value in open_net_route() Peter Maydell
` (2 preceding siblings ...)
2019-02-06 9:56 ` Laurent Vivier
@ 2019-02-06 10:07 ` Laurent Vivier
3 siblings, 0 replies; 5+ messages in thread
From: Laurent Vivier @ 2019-02-06 10:07 UTC (permalink / raw)
To: Peter Maydell, qemu-devel; +Cc: Riku Voipio, patches
On 05/02/2019 18:42, Peter Maydell wrote:
> Coverity warns (CID 1390634) that open_net_route() is not
> checking the return value from sscanf(), which means that
> it might then use values that aren't initialized.
>
> Errors here should in general not happen since we're passing
> an assumed-good /proc/net/route from the host kernel, but
> if we do fail to parse a line then just skip it in the output
> we pass to the guest.
>
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> linux-user/syscall.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index b5786d4fc1f..894678aa8b4 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -6762,9 +6762,15 @@ static int open_net_route(void *cpu_env, int fd)
> char iface[16];
> uint32_t dest, gw, mask;
> unsigned int flags, refcnt, use, metric, mtu, window, irtt;
> - sscanf(line, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> - iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> - &mask, &mtu, &window, &irtt);
> + int fields;
> +
> + fields = sscanf(line,
> + "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> + iface, &dest, &gw, &flags, &refcnt, &use, &metric,
> + &mask, &mtu, &window, &irtt);
> + if (fields != 11) {
> + continue;
> + }
> dprintf(fd, "%s\t%08x\t%08x\t%04x\t%d\t%d\t%d\t%08x\t%d\t%u\t%u\n",
> iface, tswap32(dest), tswap32(gw), flags, refcnt, use,
> metric, tswap32(mask), mtu, window, irtt);
>
Applied to my linux-user branch.
Thanks,
Laurent
^ permalink raw reply [flat|nested] 5+ messages in thread