[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-block] [PULL 17/19] nbd: Don't fail handshake on NBD_OPT_LIST desc
From: |
Kevin Wolf |
Subject: |
[Qemu-block] [PULL 17/19] nbd: Don't fail handshake on NBD_OPT_LIST descriptions |
Date: |
Fri, 15 Apr 2016 19:02:20 +0200 |
From: Eric Blake <address@hidden>
The NBD Protocol states that NBD_REP_SERVER may set
'length > sizeof(namelen) + namelen'; in which case the rest
of the packet is a UTF-8 description of the export. While we
don't know of any NBD servers that send this description yet,
we had better consume the data so we don't choke when we start
to talk to such a server.
Also, a (buggy/malicious) server that replies with length <
sizeof(namelen) would cause us to block waiting for bytes that
the server is not sending, and one that replies with super-huge
lengths could cause us to temporarily allocate up to 4G memory.
Sanity check things before blindly reading incorrectly.
Signed-off-by: Eric Blake <address@hidden>
Message-id: address@hidden
Reviewed-by: Alex Bligh <address@hidden>
Signed-off-by: Max Reitz <address@hidden>
---
nbd/client.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
diff --git a/nbd/client.c b/nbd/client.c
index 6777e58..48f2a21 100644
--- a/nbd/client.c
+++ b/nbd/client.c
@@ -192,13 +192,18 @@ static int nbd_receive_list(QIOChannel *ioc, char **name,
Error **errp)
return -1;
}
} else if (type == NBD_REP_SERVER) {
+ if (len < sizeof(namelen) || len > NBD_MAX_BUFFER_SIZE) {
+ error_setg(errp, "incorrect option length");
+ return -1;
+ }
if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
error_setg(errp, "failed to read option name length");
return -1;
}
namelen = be32_to_cpu(namelen);
- if (len != (namelen + sizeof(namelen))) {
- error_setg(errp, "incorrect option mame length");
+ len -= sizeof(namelen);
+ if (len < namelen) {
+ error_setg(errp, "incorrect option name length");
return -1;
}
if (namelen > 255) {
@@ -214,6 +219,20 @@ static int nbd_receive_list(QIOChannel *ioc, char **name,
Error **errp)
return -1;
}
(*name)[namelen] = '\0';
+ len -= namelen;
+ if (len) {
+ char *buf = g_malloc(len + 1);
+ if (read_sync(ioc, buf, len) != len) {
+ error_setg(errp, "failed to read export description");
+ g_free(*name);
+ g_free(buf);
+ *name = NULL;
+ return -1;
+ }
+ buf[len] = '\0';
+ TRACE("Ignoring export description: %s", buf);
+ g_free(buf);
+ }
} else {
error_setg(errp, "Unexpected reply type %x expected %x",
type, NBD_REP_SERVER);
--
1.8.3.1
- [Qemu-block] [PULL 05/19] block/vpc: use current_size field for XenConverter VHD images, (continued)
- [Qemu-block] [PULL 05/19] block/vpc: use current_size field for XenConverter VHD images, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 03/19] block/vpc: set errp in vpc_create, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 06/19] block/vpc: Use the correct max sector count for VHD images, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 04/19] vpc: use current_size field for XenServer VHD images, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 08/19] block/vpc: set errp in vpc_open, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 10/19] block: Don't ignore flags in blk_{, co, aio}_write_zeroes(), Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 13/19] qemu-iotests: common.rc: drop unused _do(), Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 07/19] block/vpc: make checks on max table size a bit more lax, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 09/19] block/vpc: update comments to be compliant w/coding guidelines, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 11/19] Fix pflash migration, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 17/19] nbd: Don't fail handshake on NBD_OPT_LIST descriptions,
Kevin Wolf <=
- [Qemu-block] [PULL 16/19] qemu-iotests: 041: More robust assertion on quorum node, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 15/19] qemu-iotests: place valgrind log file in scratch dir, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 12/19] qemu-iotests: drop unused _within_tolerance() filter, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 18/19] nbd: fix assert() on qemu-nbd stop, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 19/19] nbd: Don't kill server on client that doesn't request TLS, Kevin Wolf, 2016/04/15
- [Qemu-block] [PULL 14/19] qemu-iotests: tests: do not set unused tmp variable, Kevin Wolf, 2016/04/15
- Re: [Qemu-block] [Qemu-devel] [PULL 00/19] Block layer patches for 2.6.0-rc3, Peter Maydell, 2016/04/18