diff options
| author | Prasad J Pandit | 2017-10-16 14:21:59 +0200 |
|---|---|---|
| committer | Greg Kurz | 2017-10-16 14:21:59 +0200 |
| commit | 7bd92756303f2158a68d5166264dc30139b813b6 (patch) | |
| tree | 8aa940b57f17c97518b7fae6890ba1a4f3624ba9 /hw/9pfs/9p.c | |
| parent | Merge remote-tracking branch 'remotes/elmarco/tags/vu-pull-request' into staging (diff) | |
| download | qemu-7bd92756303f2158a68d5166264dc30139b813b6.tar.gz qemu-7bd92756303f2158a68d5166264dc30139b813b6.tar.xz qemu-7bd92756303f2158a68d5166264dc30139b813b6.zip | |
9pfs: use g_malloc0 to allocate space for xattr
9p back-end first queries the size of an extended attribute,
allocates space for it via g_malloc() and then retrieves its
value into allocated buffer. Race between querying attribute
size and retrieving its could lead to memory bytes disclosure.
Use g_malloc0() to avoid it.
Reported-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
Diffstat (limited to 'hw/9pfs/9p.c')
| -rw-r--r-- | hw/9pfs/9p.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 23ac7bb532..f8bbac251d 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3234,7 +3234,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type = P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid = true; if (size) { - xattr_fidp->fs.xattr.value = g_malloc(size); + xattr_fidp->fs.xattr.value = g_malloc0(size); err = v9fs_co_llistxattr(pdu, &xattr_fidp->path, xattr_fidp->fs.xattr.value, xattr_fidp->fs.xattr.len); @@ -3267,7 +3267,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type = P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid = true; if (size) { - xattr_fidp->fs.xattr.value = g_malloc(size); + xattr_fidp->fs.xattr.value = g_malloc0(size); err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path, &name, xattr_fidp->fs.xattr.value, xattr_fidp->fs.xattr.len); |