summaryrefslogtreecommitdiffstats
path: root/qom
diff options
context:
space:
mode:
authorAni Sinha2020-09-21 11:33:25 +0200
committerEduardo Habkost2020-12-10 23:32:26 +0100
commit1bf8b88f144bee747e386c88d45d772e066bbb36 (patch)
tree060d35f9e5e4eca60072e0a5c2931c43fd648b8e /qom
parentMerge remote-tracking branch 'remotes/armbru/tags/pull-misc-2020-12-10' into ... (diff)
downloadqemu-1bf8b88f144bee747e386c88d45d772e066bbb36.tar.gz
qemu-1bf8b88f144bee747e386c88d45d772e066bbb36.tar.xz
qemu-1bf8b88f144bee747e386c88d45d772e066bbb36.zip
qom: code hardening - have bound checking while looping with integer value
Object property insertion code iterates over an integer to get an unused index that can be used as an unique name for an object property. This loop increments the integer value indefinitely. Although very unlikely, this can still cause an integer overflow. In this change, we fix the above code by checking against INT16_MAX and making sure that the interger index does not overflow beyond that value. If no available index is found, the code would cause an assertion failure. This assertion failure is necessary because the callers of the function do not check the return value for NULL. Signed-off-by: Ani Sinha <ani@anisinha.ca> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com> Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20200921093325.25617-1-ani@anisinha.ca> Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Diffstat (limited to 'qom')
-rw-r--r--qom/object.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/qom/object.c b/qom/object.c
index 1065355233..e73d70a993 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1196,11 +1196,11 @@ object_property_try_add(Object *obj, const char *name, const char *type,
if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
int i;
- ObjectProperty *ret;
+ ObjectProperty *ret = NULL;
char *name_no_array = g_strdup(name);
name_no_array[name_len - 3] = '\0';
- for (i = 0; ; ++i) {
+ for (i = 0; i < INT16_MAX; ++i) {
char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
ret = object_property_try_add(obj, full_name, type, get, set,
@@ -1211,6 +1211,7 @@ object_property_try_add(Object *obj, const char *name, const char *type,
}
}
g_free(name_no_array);
+ assert(ret);
return ret;
}