]> git.ipfire.org Git - thirdparty/libvirt.git/commit
util: don't overwrite stack when getting ethtool gfeatures
authorLaine Stump <laine@laine.org>
Tue, 11 Aug 2015 17:45:46 +0000 (13:45 -0400)
committerCole Robinson <crobinso@redhat.com>
Tue, 22 Sep 2015 00:17:59 +0000 (20:17 -0400)
commit58211ca54d6bf9eae21640a2dfe3172a8c81b6e3
tree508ac131aaf2053d589accfa564cf4f31f555c12
parent93fb94219806b82485828b5909139ad7f3837776
util: don't overwrite stack when getting ethtool gfeatures

This fixes the crash described here:

 https://www.redhat.com/archives/libvir-list/2015-August/msg00162.html

In short, we were calling ioctl(SIOCETHTOOL) pointing to a too-short
object that was a local on the stack, resulting in the memory past the
end of the object being overwritten. This was because the struct used
by the ETHTOOL_GFEATURES command of SIOCETHTOOL ends with a 0-length
array, but we were telling ethtool that it could use 2 elements on the
array.

The fix is to allocate the necessary memory with VIR_ALLOC_VAR(),
including the extra length needed for a 2 element array at the end.

(cherry picked from commit bfaaa2b681018f3705bae17c001700a03f67d7c4)
src/util/virnetdev.c