Integer overflow and remote code are never a nice mix. This has existed since commit 56cd414. * src/libvirt.c (virDomainGetVcpus): Reject overflow up front. * src/remote/remote_driver.c (remoteDomainGetVcpus): Avoid overflow on sending rpc. * daemon/remote.c (remoteDispatchDomainGetVcpus): Avoid overflow on receiving rpc. --- Gnulib makes checking for multiply overflow easy. daemon/remote.c | 4 +++- src/libvirt.c | 5 +++-- src/remote/remote_driver.c | 4 +++- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/daemon/remote.c b/daemon/remote.c index 48624d6..8d04fc7 100644 --- a/daemon/remote.c +++ b/daemon/remote.c @@ -61,6 +61,7 @@ #include "network.h" #include "libvirt/libvirt-qemu.h" #include "command.h" +#include "intprops.h" #define VIR_FROM_THIS VIR_FROM_REMOTE @@ -1074,7 +1075,8 @@ remoteDispatchDomainGetVcpus(struct qemud_server *server ATTRIBUTE_UNUSED, goto cleanup; } - if (args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) { + if (INT_MULTIPLY_OVERFLOW(args->maxinfo, args->maplen) || + args->maxinfo * args->maplen > REMOTE_CPUMAPS_MAX) { virNetError(VIR_ERR_INTERNAL_ERROR, "%s", _("maxinfo * maplen > REMOTE_CPUMAPS_MAX")); goto cleanup; } diff --git a/src/libvirt.c b/src/libvirt.c index 76e16ad..9fe9a69 100644 --- a/src/libvirt.c +++ b/src/libvirt.c @@ -39,6 +39,7 @@ #include "util.h" #include "memory.h" #include "configmake.h" +#include "intprops.h" #ifndef WITH_DRIVER_MODULES # ifdef WITH_TEST @@ -7153,8 +7154,8 @@ virDomainGetVcpus(virDomainPtr domain, virVcpuInfoPtr info, int maxinfo, /* Ensure that domainGetVcpus (aka remoteDomainGetVcpus) does not try to memcpy anything into a NULL pointer. */ - if ((cpumaps == NULL && maplen != 0) - || (cpumaps && maplen <= 0)) { + if (!cpumaps ? maplen != 0 + : (maplen <= 0 || INT_MULTIPLY_OVERFLOW(maxinfo, maplen))) { virLibDomainError(VIR_ERR_INVALID_ARG, __FUNCTION__); goto error; } diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c index a7ac90a..f2edf43 100644 --- a/src/remote/remote_driver.c +++ b/src/remote/remote_driver.c @@ -83,6 +83,7 @@ #include "ignore-value.h" #include "files.h" #include "command.h" +#include "intprops.h" #define VIR_FROM_THIS VIR_FROM_REMOTE @@ -2161,7 +2162,8 @@ remoteDomainGetVcpus (virDomainPtr domain, maxinfo, REMOTE_VCPUINFO_MAX); goto done; } - if (maxinfo * maplen > REMOTE_CPUMAPS_MAX) { + if (INT_MULTIPLY_OVERFLOW(maxinfo, maplen) || + maxinfo * maplen > REMOTE_CPUMAPS_MAX) { remoteError(VIR_ERR_RPC, _("vCPU map buffer length exceeds maximum: %d > %d"), maxinfo * maplen, REMOTE_CPUMAPS_MAX); -- 1.7.4.4

On 06/24/2011 01:48 PM, Matthias Bolte wrote: Thanks; pushed. Here's the gnulib changes: * .gnulib 478c2dc...25e4c2e (3): Also, I squashed this in, based on your comments on 2/2: diff --git a/bootstrap.conf b/bootstrap.conf index 769e57c..7b2cd60 100644 --- a/bootstrap.conf +++ b/bootstrap.conf @@ -46,6 +46,7 @@ gitlog-to-changelog gnumakefile ignore-value inet_pton +intprops ioctl maintainer-makefile manywarnings diff --git a/src/locking/domain_lock.c b/src/locking/domain_lock.c index feb3f98..dd9683c 100644 --- a/src/locking/domain_lock.c +++ b/src/locking/domain_lock.c @@ -21,8 +21,7 @@ #include <config.h> -#include <intprops.h> - +#include "intprops.h" #include "domain_lock.h" #include "memory.h" #include "uuid.h" diff --git a/src/nwfilter/nwfilter_learnipaddr.c b/src/nwfilter/nwfilter_learnipaddr.c index ce845ac..cf818a2 100644 --- a/src/nwfilter/nwfilter_learnipaddr.c +++ b/src/nwfilter/nwfilter_learnipaddr.c @@ -37,10 +37,10 @@ #include <netinet/ip.h> #include <netinet/udp.h> #include <net/if_arp.h> -#include <intprops.h> #include "internal.h" +#include "intprops.h" #include "buf.h" #include "memory.h" #include "logging.h" -- 1.7.4.4 -- Eric Blake eblake(a)redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org