commandhelper: Make number of fds variable in parseArguments

Fixes a buffer overflow triggered when more than three "--readfd"
arguments were given on the command line.

Signed-off-by: Tim Wiederhake <twiederh@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>

diff --git a/tests/commandhelper.c b/tests/commandhelper.c
index ac645054614616fcfdd5ab3c6c96947c8887d9d3..9f0b7f25ac756335131c61d88e21b6383190a7eb 100644 (file)
--- a/tests/commandhelper.c
+++ b/tests/commandhelper.c
@@ -36,7 +36,7 @@ extern char **environ;
 # define VIR_FROM_THIS VIR_FROM_NONE
 
 struct Arguments {
-    int readfds[3];
+    int *readfds;
     int numreadfds;
     bool daemonize_check;
     bool close_stdin;
@@ -51,6 +51,9 @@ static struct Arguments *parseArguments(int argc, char** argv)
     if (!(args = calloc(1, sizeof(*args))))
         goto cleanup;
 
+    if (!(args->readfds = calloc(1, sizeof(*args->readfds))))
+        goto cleanup;
+
     args->numreadfds = 1;
     args->readfds[0] = STDIN_FILENO;
 
@@ -58,6 +61,12 @@ static struct Arguments *parseArguments(int argc, char** argv)
         if (STREQ(argv[i - 1], "--readfd")) {
             char c;
 
+            args->readfds = realloc(args->readfds,
+                                    (args->numreadfds + 1) *
+                                    sizeof(*args->readfds));
+            if (!args->readfds)
+                goto cleanup;
+
             if (1 != sscanf(argv[i], "%u%c",
                             &args->readfds[args->numreadfds++], &c)) {
                 printf("Could not parse fd %s\n", argv[i]);
@@ -76,7 +85,12 @@ static struct Arguments *parseArguments(int argc, char** argv)
     if (ret == 0)
         return args;
 
-    free(args);
+    if (args) {
+        if (args->readfds)
+            free(args->readfds);
+        free(args);
+    }
+
     return NULL;
 }
 
@@ -343,8 +357,11 @@ int main(int argc, char **argv) {
     ret = EXIT_SUCCESS;
 
  cleanup:
-    if (args)
+    if (args) {
+        if (args->readfds)
+            free(args->readfds);
         free(args);
+    }
     if (log)
         fclose(log);
     return ret;