From: Ilias Stamatis <stamatis.iliass@gmail.com>
Date: Sat, 1 Jun 2019 12:40:12 +0000 (+0200)
Subject: virDomainSendKey: validate codeset argument
X-Git-Tag: v5.5.0-rc1~344
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=eee8427a1c7a7e8015559a97ea76bac776cc3966;p=thirdparty%2Flibvirt.git

virDomainSendKey: validate codeset argument

This argument wasn't validated anywhere, neither in the generic
implementation nor in the individual drivers. As a result a call to this
function with a large enough codeset value prior to this change causes
libvirtd to crash.

This happens because all drivers call virKeycodeValueTranslate which
uses codeset as an index to the virKeymapValues array, causing an
out-of-bounds error.

Signed-off-by: Ilias Stamatis <stamatis.iliass@gmail.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
---

diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
index df7e405b3e..509ce5ac8b 100644
--- a/src/libvirt-domain.c
+++ b/src/libvirt-domain.c
@@ -6837,6 +6837,13 @@ virDomainSendKey(virDomainPtr domain,
     virCheckNonNullArgGoto(keycodes, error);
     virCheckPositiveArgGoto(nkeycodes, error);
 
+    if (codeset >= VIR_KEYCODE_SET_LAST) {
+        virReportInvalidArg(codeset,
+                            _("Unsupported codeset '%d'"),
+                            codeset);
+        goto error;
+    }
+
     if (nkeycodes > VIR_DOMAIN_SEND_KEY_MAX_KEYS) {
         virReportInvalidArg(nkeycodes,
                             _("nkeycodes must be <= %d"),