From: Laine Stump <laine@laine.org>
Date: Thu, 21 Sep 2017 17:57:30 +0000 (-0400)
Subject: util: Fix stack smashing in virNetDevGetFamilyId
X-Git-Tag: v3.8.0-rc1~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=17825e8ae783b12cea6b2f72ecc03e5b0c203d2a;p=thirdparty%2Flibvirt.git

util: Fix stack smashing in virNetDevGetFamilyId

After commit 8708ca01c0d libvirtd consistently aborts with "stack
 smashing detected" when nodedev driver is initialized.

This is caused by nlmsg_parse() being told that its array of nlattr*
has CTRL_CMD_MAX (10) entries, when in fact it is declared to have
CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to
NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*))
bytes outside the array.

Signed-off-by: Laine Stump <laine@laine.org>
Reviewed-by: John Ferlan <jferlan@redhat.com>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
---

diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index 41a659732b..5060d051dc 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -3183,7 +3183,7 @@ virNetDevGetFamilyId(const char *family_name)
     if (virNetlinkCommand(nl_msg, &resp, &recvbuflen, 0, 0, NETLINK_GENERIC, 0) < 0)
         goto cleanup;
 
-    if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_CMD_MAX, NULL) < 0) {
+    if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_ATTR_MAX, NULL) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                        _("malformed netlink response message"));
         goto cleanup;