shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-27 07:22:07 +03:00
Code Releases Activity

virDomainSendKey: validate codeset argument

Browse Source 
This argument wasn't validated anywhere, neither in the generic
implementation nor in the individual drivers. As a result a call to this
function with a large enough codeset value prior to this change causes
libvirtd to crash.

This happens because all drivers call virKeycodeValueTranslate which
uses codeset as an index to the virKeymapValues array, causing an
out-of-bounds error.

Signed-off-by: Ilias Stamatis <stamatis.iliass@gmail.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
This commit is contained in:
Ilias Stamatis 2019-06-01 14:40:12 +02:00 committed by Erik Skultety
parent cd3aebe9f2
commit eee8427a1c
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/libvirt-domain.c
View File

@ -6837,6 +6837,13 @@ virDomainSendKey(virDomainPtr domain,
virCheckNonNullArgGoto(keycodes, error);
virCheckPositiveArgGoto(nkeycodes, error);
if (codeset >= VIR_KEYCODE_SET_LAST) {
virReportInvalidArg(codeset,
_("Unsupported codeset '%d'"),
codeset);
goto error;
}
if (nkeycodes > VIR_DOMAIN_SEND_KEY_MAX_KEYS) {
virReportInvalidArg(nkeycodes,
_("nkeycodes must be <= %d"),