This also fixes a bug in xenXMDomainConfigParse where uninitialized
memory would be used as MAC address if sscanf fails.
---
src/xen/xend_internal.c | 18 ++----------------
src/xen/xm_internal.c | 19 +++++--------------
2 files changed, 7 insertions(+), 30 deletions(-)
diff --git a/src/xen/xend_internal.c b/src/xen/xend_internal.c
index 46e19cd..0649d23 100644
--- a/src/xen/xend_internal.c
+++ b/src/xen/xend_internal.c
@@ -1819,25 +1819,11 @@ xenDaemonParseSxprNets(virConnectPtr conn,
tmp = sexpr_node(node, "device/vif/mac");
if (tmp) {
- unsigned int mac[6];
- if (sscanf(tmp, "%02x:%02x:%02x:%02x:%02x:%02x",
- (unsigned int*)&mac[0],
- (unsigned int*)&mac[1],
- (unsigned int*)&mac[2],
- (unsigned int*)&mac[3],
- (unsigned int*)&mac[4],
- (unsigned int*)&mac[5]) != 6) {
+ if (virParseMacAddr(tmp, net->mac) < 0) {
virXendError(conn, VIR_ERR_INTERNAL_ERROR,
- _("malformed mac address '%s'"),
- tmp);
+ _("malformed mac address '%s'"),
tmp);
goto cleanup;
}
- net->mac[0] = mac[0];
- net->mac[1] = mac[1];
- net->mac[2] = mac[2];
- net->mac[3] = mac[3];
- net->mac[4] = mac[4];
- net->mac[5] = mac[5];
}
if (model &&
diff --git a/src/xen/xm_internal.c b/src/xen/xm_internal.c
index ddbd2fe..0d42b01 100644
--- a/src/xen/xm_internal.c
+++ b/src/xen/xm_internal.c
@@ -1115,20 +1115,11 @@ xenXMDomainConfigParse(virConnectPtr conn, virConfPtr conf) {
goto no_memory;
if (mac[0]) {
- unsigned int rawmac[6];
- sscanf(mac, "%02x:%02x:%02x:%02x:%02x:%02x",
- (unsigned int*)&rawmac[0],
- (unsigned int*)&rawmac[1],
- (unsigned int*)&rawmac[2],
- (unsigned int*)&rawmac[3],
- (unsigned int*)&rawmac[4],
- (unsigned int*)&rawmac[5]);
- net->mac[0] = rawmac[0];
- net->mac[1] = rawmac[1];
- net->mac[2] = rawmac[2];
- net->mac[3] = rawmac[3];
- net->mac[4] = rawmac[4];
- net->mac[5] = rawmac[5];
+ if (virParseMacAddr(mac, net->mac) < 0) {
+ xenXMError(conn, VIR_ERR_INTERNAL_ERROR,
+ _("malformed mac address '%s'"), mac);
+ goto cleanup;
+ }
}
if (bridge[0] || STREQ(script, "vif-bridge") ||
--
1.6.3.3