diff mbox

[v2] sockets: avoid formatting buffer that may not be NUL terminated

Message ID 20170626103756.22974-1-berrange@redhat.com
State New
Headers show

Commit Message

Daniel P. Berrangé June 26, 2017, 10:37 a.m. UTC
The 'sun_path' field in the sockaddr_un struct is not required
to be NUL termianted, so when reporting an error, we must use
the separate 'path' variable which is guaranteed terminated.

Fixes a bug spotted by coverity that was introduced in

  commit ad9579aaa16d5b385922d49edac2c96c79bcfb62
  Author: Daniel P. Berrange <berrange@redhat.com>
  Date:   Thu May 25 16:53:00 2017 +0100

    sockets: improve error reporting if UNIX socket path is too long

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 util/qemu-sockets.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Peter Maydell June 26, 2017, 10:42 a.m. UTC | #1
On 26 June 2017 at 11:37, Daniel P. Berrange <berrange@redhat.com> wrote:
> The 'sun_path' field in the sockaddr_un struct is not required
> to be NUL termianted, so when reporting an error, we must use

"terminated", but hopefully whoever applies the patch can fix the typo?

> the separate 'path' variable which is guaranteed terminated.
>
> Fixes a bug spotted by coverity that was introduced in
>
>   commit ad9579aaa16d5b385922d49edac2c96c79bcfb62
>   Author: Daniel P. Berrange <berrange@redhat.com>
>   Date:   Thu May 25 16:53:00 2017 +0100
>
>     sockets: improve error reporting if UNIX socket path is too long
>
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM
Michael Tokarev June 27, 2017, 1:05 p.m. UTC | #2
Applied to -trivial (with commit typo fix), thanks!

/mjt
diff mbox

Patch

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index 51bf279..37d386f 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -930,7 +930,7 @@  static int unix_listen_saddr(UnixSocketAddress *saddr,
     strncpy(un.sun_path, path, sizeof(un.sun_path));
 
     if (bind(sock, (struct sockaddr*) &un, sizeof(un)) < 0) {
-        error_setg_errno(errp, errno, "Failed to bind socket to %s", un.sun_path);
+        error_setg_errno(errp, errno, "Failed to bind socket to %s", path);
         goto err;
     }
     if (listen(sock, 1) < 0) {