* [PATCH] passt-repair: Correct off-by-one error verifying name
@ 2025-04-02 4:43 David Gibson
2025-04-02 7:00 ` Stefano Brivio
0 siblings, 1 reply; 2+ messages in thread
From: David Gibson @ 2025-04-02 4:43 UTC (permalink / raw)
To: Stefano Brivio, passt-dev; +Cc: David Gibson
passt-repair will generate an error if the name it gets from the kernel is
too long or not NUL terminated. Downstream testing has reported
occasionally seeing this error in practice.
In turns out there is a trivial off-by-one error in the check: ev->len is
the length of the name, including terminating \0 characters, so to check
for a \0 at the end of the buffer we need to check ev->name[len - 1] not
ev->name[len].
Fixes: 42a854a52 ("pasta, passt-repair: Support multiple events per...")
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
---
passt-repair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/passt-repair.c b/passt-repair.c
index 86f02934..440c77ae 100644
--- a/passt-repair.c
+++ b/passt-repair.c
@@ -157,7 +157,7 @@ int main(int argc, char **argv)
}
} while (!found);
- if (ev->len > NAME_MAX + 1 || ev->name[ev->len] != '\0') {
+ if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') {
fprintf(stderr, "Invalid filename from inotify\n");
_exit(1);
}
--
@@ -157,7 +157,7 @@ int main(int argc, char **argv)
}
} while (!found);
- if (ev->len > NAME_MAX + 1 || ev->name[ev->len] != '\0') {
+ if (ev->len > NAME_MAX + 1 || ev->name[ev->len - 1] != '\0') {
fprintf(stderr, "Invalid filename from inotify\n");
_exit(1);
}
--
2.49.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] passt-repair: Correct off-by-one error verifying name
2025-04-02 4:43 [PATCH] passt-repair: Correct off-by-one error verifying name David Gibson
@ 2025-04-02 7:00 ` Stefano Brivio
0 siblings, 0 replies; 2+ messages in thread
From: Stefano Brivio @ 2025-04-02 7:00 UTC (permalink / raw)
To: David Gibson; +Cc: passt-dev
On Wed, 2 Apr 2025 15:43:40 +1100
David Gibson <david@gibson.dropbear.id.au> wrote:
> passt-repair will generate an error if the name it gets from the kernel is
> too long or not NUL terminated. Downstream testing has reported
> occasionally seeing this error in practice.
>
> In turns out there is a trivial off-by-one error in the check: ev->len is
> the length of the name, including terminating \0 characters, so to check
> for a \0 at the end of the buffer we need to check ev->name[len - 1] not
> ev->name[len].
Ouch, "of course"... :(
> Fixes: 42a854a52 ("pasta, passt-repair: Support multiple events per...")
>
> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Applied.
--
Stefano
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-04-02 7:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-04-02 4:43 [PATCH] passt-repair: Correct off-by-one error verifying name David Gibson
2025-04-02 7:00 ` Stefano Brivio
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).