From: Laine Stump <laine@laine.org>
Date: Wed, 28 Nov 2012 04:59:17 +0000 (-0500)
Subject: network: fix crash when portgroup has no name
X-Git-Tag: CVE-2012-3411~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=012d69dff1e031f8079a9952e886a31795e589b2;p=thirdparty%2Flibvirt.git

network: fix crash when portgroup has no name

This resolves: https://bugzilla.redhat.com/show_bug.cgi?id=879473

The name attribute is required for portgroup elements (yes, the RNG
specifies that), and there is code in libvirt that assumes it is
non-null.  Unfortunately, the portgroup parsing function wasn't
checking for lack of portgroup. One adverse result of this was that
attempts to update a network by adding a portgroup with no name would
cause libvirtd to segfault. For example:

   virsh net-update default add portgroup "<portgroup default='yes'/>"

This patch causes virNetworkPortGroupParseXML to fail if no name is
specified, thus avoiding any later problems.
---

diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
index 228951d4f2..6ce2e638bb 100644
--- a/src/conf/network_conf.c
+++ b/src/conf/network_conf.c
@@ -1175,6 +1175,12 @@ virNetworkPortGroupParseXML(virPortGroupDefPtr def,
 
     /* grab raw data from XML */
     def->name = virXPathString("string(./@name)", ctxt);
+    if (!def->name) {
+        virReportError(VIR_ERR_XML_ERROR, "%s",
+                       _("Missing required name attribute in portgroup"));
+        goto error;
+    }
+
     isDefault = virXPathString("string(./@default)", ctxt);
     def->isDefault = isDefault && STRCASEEQ(isDefault, "yes");