On Mon, Jul 19, 2021 at 5:49 PM Daniel P. Berrangé <berra...@redhat.com>
wrote:
> On Mon, Jul 19, 2021 at 05:01:12PM +0400, marcandre.lur...@redhat.com
> wrote:
> > From: Marc-André Lureau <marcandre.lur...@redhat.com>
> >
> > Commit 776b97d360 "qemu-sockets: add abstract UNIX domain socket
> > support" neglected to update socket_sockaddr_to_address_unix() and
> > copied the whole sun_path without taking "salen" into account.
> >
> > Later, commit 3b14b4ec49 "sockets: Fix socket_sockaddr_to_address_unix()
> > for abstract sockets" handled the abstract UNIX path, by stripping the
> > leading \0 character and fixing address details, but didn't use salen
> > either.
> >
> > Not taking "salen" into account may result in incorrect "path" being
> > returned in monitors commands, as we read past the address which is not
> > necessarily \0-terminated.
>
> So IIUC, this is only affecting what is printed in the monitor
> when querying chardevs, not the actual functional behaviour
> between clients/servers connecting/listening ?
>
>
I think so, both hmp & qmp, and the info_report() in server_accept_sync().
But I didn't carefully review all the potential users (who else could they
be?).
> >
> > Fixes: 776b97d3605ed0fc94443048fdf988c7725e38a9
> > Fixes: 3b14b4ec49a801067da19d6b8469eb1c1911c020
> > Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
> > ---
> > util/qemu-sockets.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> > index 080a240b74..f2f3676d1f 100644
> > --- a/util/qemu-sockets.c
> > +++ b/util/qemu-sockets.c
> > @@ -1345,13 +1345,16 @@ socket_sockaddr_to_address_unix(struct
> sockaddr_storage *sa,
> > SocketAddress *addr;
> > struct sockaddr_un *su = (struct sockaddr_un *)sa;
> >
> > + assert(salen >= sizeof(su->sun_family) + 1 &&
> > + salen <= sizeof(struct sockaddr_un));
> > +
> > addr = g_new0(SocketAddress, 1);
> > addr->type = SOCKET_ADDRESS_TYPE_UNIX;
> > #ifdef CONFIG_LINUX
> > if (!su->sun_path[0]) {
> > /* Linux abstract socket */
> > addr->u.q_unix.path = g_strndup(su->sun_path + 1,
> > - sizeof(su->sun_path) - 1);
> > + salen - sizeof(su->sun_family)
> - 1);
> > addr->u.q_unix.has_abstract = true;
> > addr->u.q_unix.abstract = true;
> > addr->u.q_unix.has_tight = true;
>
> Reviewed-by: Daniel P. Berrangé <berra...@redhat.com>
>
>
> Regards,
> Daniel
> --
> |: https://berrange.com -o-
> https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o-
> https://fstop138.berrange.com :|
> |: https://entangle-photo.org -o-
> https://www.instagram.com/dberrange :|
>
>
