mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 18:05:37 +00:00
950c4e6c94
The existing QemuOpts parsing code uses a fixed size 1024 byte buffer for storing the option values. If a value exceeded this size it was silently truncated and no error reported to the user. Long option values is not a common scenario, but it is conceivable that they will happen. eg if the user has a very deeply nested filesystem it would be possible to come up with a disk path that was > 1024 bytes. Most of the time if such data was silently truncated, the user would get an error about opening a non-existant disk. If they're unlucky though, QEMU might use a completely different disk image from another VM, which could be considered a security issue. Another example program was in using the -smbios command line arg with very large data blobs. In this case the silent truncation will be providing semantically incorrect data to the guest OS for SMBIOS tables. If the operating system didn't limit the user's argv when spawning QEMU, the code should honour whatever length arguments were given without imposing its own length restrictions. This patch thus changes the code to use a heap allocated buffer for storing the values during parsing, lifting the arbitrary length restriction. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20180416111743.8473-4-berrange@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> |
||
|---|---|---|
| .. | ||
| acl.c | ||
| aio-posix.c | ||
| aio-wait.c | ||
| aio-win32.c | ||
| aiocb.c | ||
| async.c | ||
| base64.c | ||
| bitmap.c | ||
| bitops.c | ||
| buffer.c | ||
| bufferiszero.c | ||
| cacheinfo.c | ||
| compatfd.c | ||
| coroutine-sigaltstack.c | ||
| coroutine-ucontext.c | ||
| coroutine-win32.c | ||
| crc32c.c | ||
| cutils.c | ||
| envlist.c | ||
| error.c | ||
| event_notifier-posix.c | ||
| event_notifier-win32.c | ||
| fifo8.c | ||
| getauxval.c | ||
| hbitmap.c | ||
| hexdump.c | ||
| host-utils.c | ||
| id.c | ||
| iohandler.c | ||
| iov.c | ||
| keyval.c | ||
| lockcnt.c | ||
| log.c | ||
| main-loop.c | ||
| Makefile.objs | ||
| memfd.c | ||
| mmap-alloc.c | ||
| module.c | ||
| notify.c | ||
| osdep.c | ||
| oslib-posix.c | ||
| oslib-win32.c | ||
| pagesize.c | ||
| path.c | ||
| qdist.c | ||
| qemu-config.c | ||
| qemu-coroutine-io.c | ||
| qemu-coroutine-lock.c | ||
| qemu-coroutine-sleep.c | ||
| qemu-coroutine.c | ||
| qemu-error.c | ||
| qemu-openpty.c | ||
| qemu-option.c | ||
| qemu-progress.c | ||
| qemu-sockets.c | ||
| qemu-thread-posix.c | ||
| qemu-thread-win32.c | ||
| qemu-timer-common.c | ||
| qemu-timer.c | ||
| qht.c | ||
| range.c | ||
| rcu.c | ||
| readline.c | ||
| stats64.c | ||
| sys_membarrier.c | ||
| systemd.c | ||
| thread-pool.c | ||
| throttle.c | ||
| timed-average.c | ||
| trace-events | ||
| unicode.c | ||
| uri.c | ||
| uuid.c | ||
| vfio-helpers.c | ||