File 0396-qom-code-hardening-have-bound-check.patch of Package qemu.20756

Overview Repositories Revisions Requests Users Attributes Meta

File 0396-qom-code-hardening-have-bound-check.patch of Package qemu.20756

From: "Cho, Yu-Chen" <acho@suse.com>
Date: Sat, 3 Jul 2021 00:46:45 +0800
Subject: qom: code hardening - have bound checking while looping with integer
 value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Git-commit: 1bf8b88f144bee747e386c88d45d772e066bbb36
References: bsc#1187529 CVE-2021-3611

Object property insertion code iterates over an integer to get an unused
index that can be used as an unique name for an object property. This loop
increments the integer value indefinitely. Although very unlikely, this can
still cause an integer overflow.
In this change, we fix the above code by checking against INT16_MAX and making
sure that the interger index does not overflow beyond that value. If no
available index is found, the code would cause an assertion failure. This
assertion failure is necessary because the callers of the function do not check
the return value for NULL.

Signed-off-by: Ani Sinha <ani@anisinha.ca>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20200921093325.25617-1-ani@anisinha.ca>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Cho, Yu-Chen <acho@suse.com>
---
 qom/object.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/qom/object.c b/qom/object.c
index 8e6e68dffc5fd7ac424557c40753..40b0bf65789512a40f74ab16a850 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -903,11 +903,11 @@ object_property_add(Object *obj, const char *name, const char *type,
 
     if (name_len >= 3 && !memcmp(name + name_len - 3, "[*]", 4)) {
         int i;
-        ObjectProperty *ret;
+        ObjectProperty *ret = NULL;
         char *name_no_array = g_strdup(name);
 
         name_no_array[name_len - 3] = '\0';
-        for (i = 0; ; ++i) {
+        for (i = 0; i < INT16_MAX; ++i) {
             char *full_name = g_strdup_printf("%s[%d]", name_no_array, i);
 
             ret = object_property_add(obj, full_name, type, get, set,
@@ -918,6 +918,7 @@ object_property_add(Object *obj, const char *name, const char *type,
             }
         }
         g_free(name_no_array);
+        assert(ret);
         return ret;
     }

Places

File 0396-qom-code-hardening-have-bound-check.patch of Package qemu.20756

Places