From patchwork Mon Nov 19 15:47:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Qiang X-Patchwork-Id: 10688829 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BCB9614BD for ; Mon, 19 Nov 2018 15:51:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id ADEF02A066 for ; Mon, 19 Nov 2018 15:51:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A07212A047; Mon, 19 Nov 2018 15:51:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 361C52A0C3 for ; Mon, 19 Nov 2018 15:51:27 +0000 (UTC) Received: from localhost ([::1]:57334 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gOlpe-0005a8-Fc for patchwork-qemu-devel@patchwork.kernel.org; Mon, 19 Nov 2018 10:51:26 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41474) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gOlmW-0003YU-Ox for qemu-devel@nongnu.org; Mon, 19 Nov 2018 10:48:13 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gOlmW-00017b-19 for qemu-devel@nongnu.org; Mon, 19 Nov 2018 10:48:12 -0500 Received: from m12-16.163.com ([220.181.12.16]:52301) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gOlmV-00016a-F9 for qemu-devel@nongnu.org; Mon, 19 Nov 2018 10:48:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id; bh=rleRuQnIapmBPveMbb QzIT3vfeOH5ubJ7yg7FJmauFQ=; b=gRlb1BERh72vRzuFaq7jRI5l7t9jv8hevZ l8GgFVxPSNBX2h3AWtHZhuIH0kcCWTvWuYN96ic/s67vKyfAyJKEbMZAjB1sCqhF 0FgW11YrBrzpiXxYdqqE3Nr0kLJUR1l3x+lTcoyKKJoE7CTbhn9nnp4vg5mZ2UTe Kc4sQTVtk= Received: from ubuntu.localdomain (unknown [36.22.237.106]) by smtp12 (Coremail) with SMTP id EMCowADHTWIx2_JbFk1cAw--.51875S4; Mon, 19 Nov 2018 23:48:09 +0800 (CST) From: Li Qiang To: pbonzini@redhat.com, kraxel@redhat.com, lersek@redhat.com, philmd@redhat.com, armbru@redhat.com Date: Mon, 19 Nov 2018 07:47:36 -0800 Message-Id: <20181119154737.9840-3-liq3ea@163.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20181119154737.9840-1-liq3ea@163.com> References: <20181119154737.9840-1-liq3ea@163.com> X-CM-TRANSID: EMCowADHTWIx2_JbFk1cAw--.51875S4 X-Coremail-Antispam: 1Uf129KBjvJXoW7Kr47ZFy8AF4DCrW8Kry8Krg_yoW8tF1fpF Zxta1DJrWkXrW3Jr4akw1DWr1UXwn7Xr4DZF4DA3yIvr13Ar1kA3yxGas3Kay7ZF93tF4a gF4Fgw1UJanrGaDanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07UPkuxUUUUU= X-Originating-IP: [36.22.237.106] X-CM-SenderInfo: 5oltjvrd6rljoofrz/xtbBaxkEbVets57wNgAAsK X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 220.181.12.16 Subject: [Qemu-devel] [PATCH 2/3] fw_cfg: fix -boot reboot-timeout error checking X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Li Qiang , qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP fw_cfg_reboot() gets option parameter "reboot-timeout" with qemu_opt_get(), then converts it to an integer by hand. It neglects to check that conversion for errors, and fails to reject negative values. Positive values above the limit get reported and replaced by the limit. This patch checks for conversion errors properly, and reject all valus outside 0...0xffff. Signed-off-by: Li Qiang Reviewed-by: Markus Armbruster --- hw/nvram/fw_cfg.c | 27 +++++++++++++-------------- vl.c | 2 +- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/hw/nvram/fw_cfg.c b/hw/nvram/fw_cfg.c index 78f43dad93..0489d63a1b 100644 --- a/hw/nvram/fw_cfg.c +++ b/hw/nvram/fw_cfg.c @@ -178,26 +178,25 @@ static void fw_cfg_bootsplash(FWCfgState *s) static void fw_cfg_reboot(FWCfgState *s) { - int reboot_timeout = -1; - char *p; - const char *temp; + const char *reboot_timeout = NULL; + int64_t rt_val = -1; /* get user configuration */ QemuOptsList *plist = qemu_find_opts("boot-opts"); QemuOpts *opts = QTAILQ_FIRST(&plist->head); - if (opts != NULL) { - temp = qemu_opt_get(opts, "reboot-timeout"); - if (temp != NULL) { - p = (char *)temp; - reboot_timeout = strtol(p, &p, 10); + reboot_timeout = qemu_opt_get(opts, "reboot-timeout"); + + if (reboot_timeout) { + rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1); + /* validate the input */ + if (rt_val < 0 || rt_val > 0xffff) { + error_report("reboot timeout is invalid," + "it should be a value between 0 and 65535"); + exit(1); } } - /* validate the input */ - if (reboot_timeout > 0xffff) { - error_report("reboot timeout is larger than 65535, force it to 65535."); - reboot_timeout = 0xffff; - } - fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4); + + fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_val, 4), 4); } static void fw_cfg_write(FWCfgState *s, uint8_t value) diff --git a/vl.c b/vl.c index 96ac0ddcf6..38a1759461 100644 --- a/vl.c +++ b/vl.c @@ -339,7 +339,7 @@ static QemuOptsList qemu_boot_opts = { .type = QEMU_OPT_NUMBER, }, { .name = "reboot-timeout", - .type = QEMU_OPT_STRING, + .type = QEMU_OPT_NUMBER, }, { .name = "strict", .type = QEMU_OPT_BOOL,