[PATCH] util: Fix stack smashing in virNetDevGetFamilyId

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



After commit 8708ca01c0d libvirtd consistently aborts with
"stack smashing detected" when nodedev driver is initialized.

Apparently this is caused by nlmsg_parse trying to write more than
CTRL_ATTR_MAX bytes in tb because it is told tb can accommodate
CTRL_CMD_MAX bytes.

Signed-off-by: Jiri Denemark <jdenemar@xxxxxxxxxx>
---
 src/util/virnetdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index 41a659732b..be8f4b7938 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -3158,7 +3158,7 @@ virNetDevGetFamilyId(const char *family_name)
     struct nl_msg *nl_msg = NULL;
     struct nlmsghdr *resp = NULL;
     struct genlmsghdr* gmsgh = NULL;
-    struct nlattr *tb[CTRL_ATTR_MAX + 1] = {NULL, };
+    struct nlattr *tb[CTRL_CMD_MAX + 1] = {NULL, };
     unsigned int recvbuflen;
     uint32_t family_id = 0;
 
-- 
2.14.1

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list



[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]
  Powered by Linux