From 17825e8ae783b12cea6b2f72ecc03e5b0c203d2a Mon Sep 17 00:00:00 2001 From: Laine Stump Date: Thu, 21 Sep 2017 13:57:30 -0400 Subject: [PATCH] util: Fix stack smashing in virNetDevGetFamilyId After commit 8708ca01c0d libvirtd consistently aborts with "stack smashing detected" when nodedev driver is initialized. This is caused by nlmsg_parse() being told that its array of nlattr* has CTRL_CMD_MAX (10) entries, when in fact it is declared to have CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*)) bytes outside the array. Signed-off-by: Laine Stump Reviewed-by: John Ferlan Signed-off-by: Jiri Denemark --- src/util/virnetdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c index 41a659732b..5060d051dc 100644 --- a/src/util/virnetdev.c +++ b/src/util/virnetdev.c @@ -3183,7 +3183,7 @@ virNetDevGetFamilyId(const char *family_name) if (virNetlinkCommand(nl_msg, &resp, &recvbuflen, 0, 0, NETLINK_GENERIC, 0) < 0) goto cleanup; - if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_CMD_MAX, NULL) < 0) { + if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_ATTR_MAX, NULL) < 0) { virReportError(VIR_ERR_INTERNAL_ERROR, "%s", _("malformed netlink response message")); goto cleanup; -- 2.39.5