mirror of
https://github.com/xemu-project/xemu.git
synced 2024-11-25 04:30:02 +00:00
e64e27d5cb
`struct dirent' returned from readdir(3) could be shorter (or longer) than `sizeof(struct dirent)', thus memcpy of sizeof length will overread into unallocated page causing SIGSEGV. Example stack trace: #0 0x00005555559ebeed v9fs_co_readdir_many (/usr/bin/qemu-system-x86_64 + 0x497eed) #1 0x00005555559ec2e9 v9fs_readdir (/usr/bin/qemu-system-x86_64 + 0x4982e9) #2 0x0000555555eb7983 coroutine_trampoline (/usr/bin/qemu-system-x86_64 + 0x963983) #3 0x00007ffff73e0be0 n/a (n/a + 0x0) While fixing this, provide a helper for any future `struct dirent' cloning. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/841 Cc: qemu-stable@nongnu.org Co-authored-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Vitaly Chikunov <vt@altlinux.org> Tested-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com> Acked-by: Greg Kurz <groug@kaod.org> Tested-by: Vitaly Chikunov <vt@altlinux.org> Message-Id: <20220216181821.3481527-1-vt@altlinux.org> [C.S. - Fix typo in source comment. ] Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com> |
||
|---|---|---|
| .. | ||
| 9p-local.c | ||
| 9p-local.h | ||
| 9p-posix-acl.c | ||
| 9p-proxy.c | ||
| 9p-proxy.h | ||
| 9p-synth.c | ||
| 9p-synth.h | ||
| 9p-util.c | ||
| 9p-util.h | ||
| 9p-xattr-user.c | ||
| 9p-xattr.c | ||
| 9p-xattr.h | ||
| 9p.c | ||
| 9p.h | ||
| codir.c | ||
| cofile.c | ||
| cofs.c | ||
| coth.c | ||
| coth.h | ||
| coxattr.c | ||
| Kconfig | ||
| meson.build | ||
| trace-events | ||
| trace.h | ||
| virtio-9p-device.c | ||
| virtio-9p.h | ||
| xen-9p-backend.c | ||
| xen-9pfs.h | ||