From: Michal Privoznik <mprivozn@redhat.com>
Date: Thu, 2 Feb 2017 13:16:20 +0000 (+0100)
Subject: qemu: Allow empty script path to <interface/>
X-Git-Tag: CVE-2017-2635~97
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1d9ab0f04af310e52f80b4281751655bb3bb7601;p=thirdparty%2Flibvirt.git

qemu: Allow empty script path to <interface/>

Before 9c17d665fdc5f (v1.3.2 - I know, right?) it was possible to
have the following interface configuration:

  <interface type='ethernet'/>
    <script path=''/>
  </interface>

This resulted in -netdev tap,script=,.. Fortunately, qemu helped
us to get away with this as it just ignored the empty script
path. However, after the commit mentioned above it's libvirtd
who is executing the script. Unfortunately without special
case-ing empty script path.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
---

diff --git a/docs/news.xml b/docs/news.xml
index 22f00cc55c..54337f782d 100644
--- a/docs/news.xml
+++ b/docs/news.xml
@@ -145,6 +145,16 @@
           libxl: fix dom0 autoballooning with Xen 4.8
         </summary>
       </change>
+      <change>
+        <summary>
+          qemu: Allow empty script path to &lt;interface/&gt;
+        </summary>
+        <description>
+          Historically, this was always allowed. Unfortunately, due to some
+          rework done for 1.3.2 release a bug was dragged in which suddenly
+          stop allowing domain with such configuration to start.
+        </description>
+      </change>
     </section>
   </release>
   <release version="v3.0.0" date="2017-01-17">
diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index fa695d4a6e..d123248787 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -2615,6 +2615,10 @@ virNetDevRunEthernetScript(const char *ifname, const char *script)
     virCommandPtr cmd;
     int ret;
 
+    /* Not a bug! Previously we did accept script="" as a NO-OP. */
+    if (STREQ(script, ""))
+        return 0;
+
     cmd = virCommandNew(script);
     virCommandAddArgFormat(cmd, "%s", ifname);
     virCommandClearCaps(cmd);