From: Liang Yan Date: Thu, 25 Jul 2019 13:28:26 -0400 Subject: qemu-bridge-helper: restrict interface name The interface names in qemu-bridge-helper are defined to be of size IFNAMSIZ(=16), including the terminating null('\0') byte. The same is applied to interface names read from 'bridge.conf' file to form ACLs rules. If user supplied '--br=bridge' name is not restricted to the same length, it could lead to ACL bypass issue. Restrict bridge name to IFNAMSIZ, including null byte. Reported-by: Riccardo Schirone Signed-off-by: Prasad J Pandit [LY: BSC#1140402 CVE-2019-13164] Signed-off-by: Liang Yan --- qemu-bridge-helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index cafe2bf27b..8ae6104ec4 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -109,6 +109,13 @@ static int parse_acl_file(const char *filename, ACLList *acl_list) } *argend = 0; + if (!g_str_equal(cmd, "include") && strlen(arg) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", arg, strlen(arg)); + fclose(f); + errno = EINVAL; + return -1; + } + if (strcmp(cmd, "deny") == 0) { acl_rule = calloc(1, sizeof(*acl_rule)); if (!acl_rule) { @@ -264,6 +271,10 @@ int main(int argc, char **argv) return EXIT_FAILURE; } } + if (strlen(bridge) >= IFNAMSIZ) { + fprintf(stderr, "name `%s' too long: %zu\n", bridge, strlen(bridge)); + return EXIT_FAILURE; + } if (bridge == NULL || unixfd == -1) { usage();