[libvirt] [PATCH v2] Fix dbus message reading code on big endian hosts
From: "Daniel P. Berrange" <berrange@redhat.com> The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered. In v2: - Added missing change to virdbus.c Signed-off-by: Daniel P. Berrange <berrange@redhat.com> --- src/util/virdbus.c | 6 +++--- tests/virdbustest.c | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/util/virdbus.c b/src/util/virdbus.c index 4ce6c46..33f3379 100644 --- a/src/util/virdbus.c +++ b/src/util/virdbus.c @@ -738,7 +738,7 @@ virDBusMessageIterDecode(DBusMessageIter *rootiter, switch (*t) { case DBUS_TYPE_BYTE: - GET_NEXT_VAL(unsigned char, int, "%d"); + GET_NEXT_VAL(unsigned char, unsigned char, "%d"); break; case DBUS_TYPE_BOOLEAN: @@ -746,11 +746,11 @@ virDBusMessageIterDecode(DBusMessageIter *rootiter, break; case DBUS_TYPE_INT16: - GET_NEXT_VAL(dbus_int16_t, int, "%d"); + GET_NEXT_VAL(dbus_int16_t, short, "%d"); break; case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d"); break; case DBUS_TYPE_INT32: diff --git a/tests/virdbustest.c b/tests/virdbustest.c index fb241ee..61de937 100644 --- a/tests/virdbustest.c +++ b/tests/virdbustest.c @@ -54,8 +54,8 @@ static int testMessageSimple(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 0xfefe, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; @@ -232,8 +232,8 @@ static int testMessageStruct(const void *args ATTRIBUTE_UNUSED) int ret = -1; unsigned char in_byte = 200, out_byte = 0; int in_bool = true, out_bool = false; - int in_int16 = 12000, out_int16 = 0; - unsigned int in_uint16 = 32000, out_uint16 = 0; + short in_int16 = 12000, out_int16 = 0; + unsigned short in_uint16 = 32000, out_uint16 = 0; int in_int32 = 100000000, out_int32 = 0; unsigned int in_uint32 = 200000000, out_uint32 = 0; long long in_int64 = 1000000000000, out_int64 = 0; -- 1.8.1.4
On 07/29/2013 10:40 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered.
In v2:
- Added missing change to virdbus.c
The v2 designation can be trimmed before you push; it helps review, but doesn't need to live in libvirt.git.
case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d");
Works, but 'unsigned short' is a bit more typical. ACK. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On Mon, Jul 29, 2013 at 10:46:25AM -0600, Eric Blake wrote:
On 07/29/2013 10:40 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered.
In v2:
- Added missing change to virdbus.c
The v2 designation can be trimmed before you push; it helps review, but doesn't need to live in libvirt.git.
Yep, this was only added when composing the email.
case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d");
Works, but 'unsigned short' is a bit more typical.
Ok, will change it.
ACK.
Waiting for Jiri to confirm that it builds on all other architectures before pushing. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
On 07/29/2013 10:57 AM, Daniel P. Berrange wrote:
case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d");
Works, but 'unsigned short' is a bit more typical.
Ok, will change it.
ACK.
Waiting for Jiri to confirm that it builds on all other architectures before pushing.
The fix makes sense - on the put side, you pass 'short' to a var-args function, which gets promoted to 'int', so the va_arg must grab the value from the promoted type. But on the get side, you pass 'short*' to a var-args function, which is used as-is, and if you tell dbus to deref an 'int*', that would explain the stack-smashing. But yeah, waiting for a build confirmation never hurts. -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org
On Mon, Jul 29, 2013 at 17:57:55 +0100, Daniel Berrange wrote:
On Mon, Jul 29, 2013 at 10:46:25AM -0600, Eric Blake wrote:
On 07/29/2013 10:40 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange" <berrange@redhat.com>
The way we were casting small (<32bit) integers was broken on big endian hosts, causing stack smashing. This was detected in the test suite either by test failures due to incorrect results, or by libc/gcc abort'ing with its stack canary triggered.
In v2:
- Added missing change to virdbus.c
The v2 designation can be trimmed before you push; it helps review, but doesn't need to live in libvirt.git.
Yep, this was only added when composing the email.
case DBUS_TYPE_UINT16: - GET_NEXT_VAL(dbus_uint16_t, unsigned int, "%d"); + GET_NEXT_VAL(dbus_uint16_t, short unsigned, "%d");
Works, but 'unsigned short' is a bit more typical.
Ok, will change it.
ACK.
Waiting for Jiri to confirm that it builds on all other architectures before pushing.
Current git + this patch builds on ppc, s390, x86_64, ppc64, i686, and s390x. ACK Jirka
participants (3)
-
Daniel P. Berrange -
Eric Blake -
Jiri Denemark