[PATCH 0/2] esxConnectListInterfaces: Fix array bounds checking and refactor counting
Peter Krempa (2): esxConnectListInterfaces: Actually check bounds of 'names' array esxConnectListInterfaces: Reuse also in 'esxConnectNumOfInterfaces' src/esx/esx_interface_driver.c | 42 ++++++++++++---------------------- 1 file changed, 15 insertions(+), 27 deletions(-) -- 2.55.0
From: Peter Krempa <pkrempa@redhat.com> The 'names' has (guaranteed) size of 'maxnames' but when it's being filled the number of items is not checked against the size. Reported by: Aisle Research Fixes: b9dfbf5723d23f953e0a611a39e83ab2b5ae378b Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- src/esx/esx_interface_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/esx/esx_interface_driver.c b/src/esx/esx_interface_driver.c index 125155da99..bbb8baaeb8 100644 --- a/src/esx/esx_interface_driver.c +++ b/src/esx/esx_interface_driver.c @@ -75,6 +75,8 @@ esxConnectListInterfaces(virConnectPtr conn, char **const names, int maxnames) for (physicalNic = physicalNicList; physicalNic; physicalNic = physicalNic->_next) { + if (count >= maxnames) + break; names[count] = g_strdup(physicalNic->device); ++count; -- 2.55.0
From: Peter Krempa <pkrempa@redhat.com> Adjust the code so that it can count the number of interfaces for 'esxConnectNumOfInterfaces' so that the loop over the interfaces doesn't need to be duplicated. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- src/esx/esx_interface_driver.c | 44 ++++++++++++---------------------- 1 file changed, 15 insertions(+), 29 deletions(-) diff --git a/src/esx/esx_interface_driver.c b/src/esx/esx_interface_driver.c index bbb8baaeb8..3f610d95ef 100644 --- a/src/esx/esx_interface_driver.c +++ b/src/esx/esx_interface_driver.c @@ -33,32 +33,9 @@ static int -esxConnectNumOfInterfaces(virConnectPtr conn) -{ - esxPrivate *priv = conn->privateData; - esxVI_PhysicalNic *physicalNicList = NULL; - esxVI_PhysicalNic *physicalNic = NULL; - int count = 0; - - if (esxVI_EnsureSession(priv->primary) < 0 || - esxVI_LookupPhysicalNicList(priv->primary, &physicalNicList) < 0) { - return -1; - } - - for (physicalNic = physicalNicList; physicalNic; - physicalNic = physicalNic->_next) { - ++count; - } - - esxVI_PhysicalNic_Free(&physicalNicList); - - return count; -} - - - -static int -esxConnectListInterfaces(virConnectPtr conn, char **const names, int maxnames) +esxConnectListInterfaces(virConnectPtr conn, + char **const names, + int maxnames) { esxPrivate *priv = conn->privateData; esxVI_PhysicalNic *physicalNicList = NULL; @@ -75,9 +52,12 @@ esxConnectListInterfaces(virConnectPtr conn, char **const names, int maxnames) for (physicalNic = physicalNicList; physicalNic; physicalNic = physicalNic->_next) { - if (count >= maxnames) - break; - names[count] = g_strdup(physicalNic->device); + if (names) { + if (count >= maxnames) + break; + + names[count] = g_strdup(physicalNic->device); + } ++count; } @@ -88,6 +68,12 @@ esxConnectListInterfaces(virConnectPtr conn, char **const names, int maxnames) } +static int +esxConnectNumOfInterfaces(virConnectPtr conn) +{ + return esxConnectListInterfaces(conn, NULL, -1); +} + static int esxConnectNumOfDefinedInterfaces(virConnectPtr conn G_GNUC_UNUSED) -- 2.55.0
On a Tuesday in 2026, Peter Krempa via Devel wrote:
Peter Krempa (2): esxConnectListInterfaces: Actually check bounds of 'names' array esxConnectListInterfaces: Reuse also in 'esxConnectNumOfInterfaces'
src/esx/esx_interface_driver.c | 42 ++++++++++++---------------------- 1 file changed, 15 insertions(+), 27 deletions(-)
Reviewed-by: Ján Tomko <jtomko@redhat.com> Jano
participants (2)
-
Ján Tomko -
Peter Krempa