Hello Prasad,
P J P <ppan...@redhat.com> 于2019年6月28日周五 下午5:52写道：
> From: Prasad J Pandit <p...@fedoraproject.org>
>
> The interface names in qemu-bridge-helper are defined to be
> of size IFNAMSIZ(=16), including the terminating null('\0') byte.
> The same is applied to interface names read from 'bridge.conf'
> file to form ACLs rules. If user supplied '--br=bridge' name
> is not restricted to the same length, it could lead to ACL bypass
> issue. Restrict bridge name to IFNAMSIZ, including null byte.
>
> Reported-by: Riccardo Schirone <rschi...@redhat.com>
> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
> ---
> qemu-bridge-helper.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c
> index f9940deefd..2eca8c5cc4 100644
> --- a/qemu-bridge-helper.c
> +++ b/qemu-bridge-helper.c
> @@ -246,7 +246,7 @@ int main(int argc, char **argv)
> if (strcmp(argv[index], "--use-vnet") == 0) {
> use_vnet = 1;
> } else if (strncmp(argv[index], "--br=", 5) == 0) {
> - bridge = &argv[index][5];
> + bridge = strndup(&argv[index][5], IFNAMSIZ - 1);
>
I thinke we should cleanup the bridge in the final.
Thanks,
Li Qiang
> } else if (strncmp(argv[index], "--fd=", 5) == 0) {
> unixfd = atoi(&argv[index][5]);
> } else {
> --
> 2.21.0
>
>
>
