From 6e157a0339793bb081705f52318fc77afd10addf Mon Sep 17 00:00:00 2001 From: Fam Zheng Date: Fri, 14 Sep 2018 15:26:15 +0800 Subject: slirp: Add sanity check for str option length When user provides a long domainname or hostname that doesn't fit in the DHCP packet, we mustn't overflow the response packet buffer. Instead, report errors, following the g_warning() in the slirp->vdnssearch branch. Also check the strlen against 256 when initializing slirp, which limit is also from the protocol where one byte represents the string length. This gives an early error before the warning which is harder to notice or diagnose. Reported-by: Thomas Huth Reviewed-by: Thomas Huth Cc: qemu-stable@nongnu.org Signed-off-by: Fam Zheng Tested-by: Gerd Hoffmann Signed-off-by: Samuel Thibault --- net/slirp.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'net') diff --git a/net/slirp.c b/net/slirp.c index 99884de204..da6c0a1a5c 100644 --- a/net/slirp.c +++ b/net/slirp.c @@ -350,6 +350,15 @@ static int net_slirp_init(NetClientState *peer, const char *model, return -1; } + if (vdomainname && strlen(vdomainname) > 255) { + error_setg(errp, "'domainname' parameter cannot exceed 255 bytes"); + return -1; + } + + if (vhostname && strlen(vhostname) > 255) { + error_setg(errp, "'vhostname' parameter cannot exceed 255 bytes"); + return -1; + } nc = qemu_new_net_client(&net_slirp_info, peer, model, name); -- cgit v1.2.3