P J P <ppan...@redhat.com> 于2019年7月23日周二 下午6:50写道:
> From: Prasad J Pandit <p...@fedoraproject.org> > > The network interface name in Linux is defined to be of size > IFNAMSIZ(=16), including the terminating null('\0') byte. > The same is applied to interface names read from 'bridge.conf' > file to form ACL rules. If user supplied '--br=bridge' name > is not restricted to the same length, it could lead to ACL bypass > issue. Restrict interface name to IFNAMSIZ, including null byte. > > Reported-by: Riccardo Schirone <rschi...@redhat.com> > Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > Reviewed-by: Li Qiang <liq...@gmail.com> > --- > qemu-bridge-helper.c | 11 +++++++++++ > 1 file changed, 11 insertions(+) > > Reviewed v3 > -> > https://lists.nongnu.org/archive/html/qemu-devel/2019-07/msg00245.html > > diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c > index f9940deefd..e90c22f07d 100644 > --- a/qemu-bridge-helper.c > +++ b/qemu-bridge-helper.c > @@ -109,6 +109,13 @@ static int parse_acl_file(const char *filename, > ACLList *acl_list) > } > *argend = 0; > > + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { > + fprintf(stderr, "name `%s' too long: %zu\n", arg, > strlen(arg)); > + fclose(f); > + errno = EINVAL; > + return -1; > + } > + > if (strcmp(cmd, "deny") == 0) { > acl_rule = g_malloc(sizeof(*acl_rule)); > if (strcmp(arg, "all") == 0) { > @@ -259,6 +266,10 @@ int main(int argc, char **argv) > usage(); > return EXIT_FAILURE; > } > + if (strlen(bridge) >= IFNAMSIZ) { > + fprintf(stderr, "name `%s' too long: %zu\n", bridge, > strlen(bridge)); > + return EXIT_FAILURE; > + } > > /* parse default acl file */ > QSIMPLEQ_INIT(&acl_list); > -- > 2.21.0 > >