[libvirt] [PATCH] Avoid crash in virBufferEscapeString
If virBufferEscapeString is called on a buffer that has 0 bytes of space, a size of -1 will be passed to snprintf, resulting in a segmentation fault. This patch checks for 0 space, and grows the buffer if needed prior to determining size. I discovered this when I accidentally made virBufferEscapeString the first function to add something to a newly minted buffer. --- src/util/buf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/util/buf.c b/src/util/buf.c index c802aa2..9681635 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st } *out = 0; + if ((buf->use >= buf->size) && + virBufferGrow(buf, 100) < 0) { + VIR_FREE(escaped); + return; + } + size = buf->size - buf->use - 1; while (((count = snprintf(&buf->content[buf->use], size, format, (char *)escaped)) < 0) || (count >= size - 1)) { -- 1.6.2.5
Laine Stump wrote:
If virBufferEscapeString is called on a buffer that has 0 bytes of space, a size of -1 will be passed to snprintf, resulting in a segmentation fault. This patch checks for 0 space, and grows the buffer if needed prior to determining size.
I discovered this when I accidentally made virBufferEscapeString the first function to add something to a newly minted buffer. --- src/util/buf.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/util/buf.c b/src/util/buf.c index c802aa2..9681635 100644 --- a/src/util/buf.c +++ b/src/util/buf.c @@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st } *out = 0;
+ if ((buf->use >= buf->size) && + virBufferGrow(buf, 100) < 0) {
Good catch. The hardcode of 100 threw me at first, but I see that we appropriately grow the buffer as needed in the loop below, so I think this works. ACK -- Chris Lalancette
On 10/15/2009 06:03 AM, Chris Lalancette wrote:
Good catch. The hardcode of 100 threw me at first, but I see that we appropriately grow the buffer as needed in the loop below, so I think this works.
I thought of trying to make a better guess, but when I saw that virBufferVSprintf just used 100 to start, I decided that was my free ticket to sloth ;-)
On Wed, Oct 14, 2009 at 11:55:19PM -0400, Laine Stump wrote:
If virBufferEscapeString is called on a buffer that has 0 bytes of space, a size of -1 will be passed to snprintf, resulting in a segmentation fault. This patch checks for 0 space, and grows the buffer if needed prior to determining size.
I discovered this when I accidentally made virBufferEscapeString the first function to add something to a newly minted buffer.
Argh, right, I applied the patch, thanks ! Daniel -- Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/ daniel@veillard.com | Rpmfind RPM search engine http://rpmfind.net/ http://veillard.com/ | virtualization library http://libvirt.org/
participants (3)
-
Chris Lalancette -
Daniel Veillard -
Laine Stump