[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 90/97] slirp: check sscanf result when emulating id
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 90/97] slirp: check sscanf result when emulating ident |
Date: |
Mon, 1 Apr 2019 16:00:04 -0500 |
From: William Bowling <address@hidden>
When emulating ident in tcp_emu, if the strchr checks passed but the
sscanf check failed, two uninitialized variables would be copied and
sent in the reply, so move this code inside the if(sscanf()) clause.
Signed-off-by: William Bowling <address@hidden>
Cc: address@hidden
Cc: address@hidden
Message-Id: <address@hidden>
Signed-off-by: Samuel Thibault <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
(cherry picked from commit d3222975c7d6cda9e25809dea05241188457b113)
Signed-off-by: Michael Roth <address@hidden>
---
slirp/tcp_subr.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/slirp/tcp_subr.c b/slirp/tcp_subr.c
index 8d0f94b75f..473c8b04e6 100644
--- a/slirp/tcp_subr.c
+++ b/slirp/tcp_subr.c
@@ -662,12 +662,12 @@ tcp_emu(struct socket *so, struct mbuf *m)
break;
}
}
+ so_rcv->sb_cc =
snprintf(so_rcv->sb_data,
+
so_rcv->sb_datalen,
+ "%d,%d\r\n",
n1, n2);
+ so_rcv->sb_rptr = so_rcv->sb_data;
+ so_rcv->sb_wptr = so_rcv->sb_data +
so_rcv->sb_cc;
}
- so_rcv->sb_cc = snprintf(so_rcv->sb_data,
- so_rcv->sb_datalen,
- "%d,%d\r\n", n1, n2);
- so_rcv->sb_rptr = so_rcv->sb_data;
- so_rcv->sb_wptr = so_rcv->sb_data +
so_rcv->sb_cc;
}
m_free(m);
return 0;
--
2.17.1
- [Qemu-stable] [PATCH 97/97] usb-mtp: use O_NOFOLLOW and O_CLOEXEC., (continued)
- [Qemu-stable] [PATCH 97/97] usb-mtp: use O_NOFOLLOW and O_CLOEXEC., Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 39/97] clean up callback when del virtqueue, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 51/97] block-backend: Set werror/rerror defaults in blk_new(), Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 40/97] block/rbd: pull out qemu_rbd_convert_options, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 24/97] vnc: fix memleak of the "vnc-worker-output" name, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 87/97] block: Fix invalidate_cache error path for parent activation, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 06/97] target/arm: Fix sign-extension in sve do_ldr/do_str, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 72/97] mirror: fix dead-lock, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 42/97] block/rbd: add iotest for rbd legacy keyvalue filename parsing, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 15/97] target/arm: Use fp_status_fp16 for do_fmpa_zpzzz_h, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 90/97] slirp: check sscanf result when emulating ident,
Michael Roth <=
- [Qemu-stable] [PATCH 84/97] tpm: use loop iterator to set sts data field, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 83/97] tpm: Zero-init structure to avoid uninitialized variables in valgrind log, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 44/97] target/arm: Fix cpu_get_tb_cpu_state() for non-SVE CPUs, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 47/97] pcnet: fix possible buffer overflow, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 92/97] bitmap: Update count after a merge, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 25/97] i386: Disable TOPOEXT by default on "-cpu host", Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 62/97] fdc: fix segfault in fdctrl_stop_transfer() when DMA is disabled, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 19/97] qemu-img: fix regression copying secrets during convert, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 26/97] block: for jobs, do not clear user_paused until after the resume, Michael Roth, 2019/04/01
- [Qemu-stable] [PATCH 67/97] i2c: Move typedef of bitbang_i2c_interface to i2c.h, Michael Roth, 2019/04/01