2:16 p.m.
If calling guestfs_list_filesystems with a disk image containing a
corrupt btrfs volume, the library would segfault. There was a missing
check for a NULL return from guestfs_btrfs_subvolume_list.
This adds a check, returning the real error up through the stack and
out of guestfs_list_filesystems.
This is potentially a denial of service if processing disk images from
untrusted sources, but is not exploitable.
Thanks: Jeff Bastian for reporting the bug.
---
src/listfs.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/src/listfs.c b/src/listfs.c
index 9102c55..bbdb0a2 100644
--- a/src/listfs.c
+++ b/src/listfs.c
@@ -39,7 +39,7 @@
*/
static void remove_from_list (char **list, const char *item);
-static void check_with_vfs_type (guestfs_h *g, const char *dev, struct stringsbuf *sb);
+static int check_with_vfs_type (guestfs_h *g, const char *dev, struct stringsbuf *sb);
static int is_mbr_partition_type_42 (guestfs_h *g, const char *partition);
char **
@@ -78,17 +78,21 @@ guestfs__list_filesystems (guestfs_h *g)
/* Use vfs-type to check for filesystems on devices. */
for (i = 0; devices[i] != NULL; ++i)
- check_with_vfs_type (g, devices[i], &ret);
+ if (check_with_vfs_type (g, devices[i], &ret) == -1)
+ goto error;
/* Use vfs-type to check for filesystems on partitions. */
for (i = 0; partitions[i] != NULL; ++i) {
- if (! is_mbr_partition_type_42 (g, partitions[i]))
- check_with_vfs_type (g, partitions[i], &ret);
+ if (! is_mbr_partition_type_42 (g, partitions[i])) {
+ if (check_with_vfs_type (g, partitions[i], &ret) == -1)
+ goto error;
+ }
}
/* Use vfs-type to check for filesystems on md devices. */
for (i = 0; mds[i] != NULL; ++i)
- check_with_vfs_type (g, mds[i], &ret);
+ if (check_with_vfs_type (g, mds[i], &ret) == -1)
+ goto error;
if (guestfs_feature_available (g, (char **) lvm2)) {
/* Use vfs-type to check for filesystems on LVs. */
@@ -96,7 +100,8 @@ guestfs__list_filesystems (guestfs_h *g)
if (lvs == NULL) goto error;
for (i = 0; lvs[i] != NULL; ++i)
- check_with_vfs_type (g, lvs[i], &ret);
+ if (check_with_vfs_type (g, lvs[i], &ret) == -1)
+ goto error;
}
if (guestfs_feature_available (g, (char **) ldm)) {
@@ -105,13 +110,15 @@ guestfs__list_filesystems (guestfs_h *g)
if (ldmvols == NULL) goto error;
for (i = 0; ldmvols[i] != NULL; ++i)
- check_with_vfs_type (g, ldmvols[i], &ret);
+ if (check_with_vfs_type (g, ldmvols[i], &ret) == -1)
+ goto error;
ldmparts = guestfs_list_ldm_partitions (g);
if (ldmparts == NULL) goto error;
for (i = 0; ldmparts[i] != NULL; ++i)
- check_with_vfs_type (g, ldmparts[i], &ret);
+ if (check_with_vfs_type (g, ldmparts[i], &ret) == -1)
+ goto error;
}
/* Finish off the list and return it. */
@@ -143,7 +150,7 @@ remove_from_list (char **list, const char *item)
* Apart from some types which we ignore, add the result to the
* 'ret' string list.
*/
-static void
+static int
check_with_vfs_type (guestfs_h *g, const char *device, struct stringsbuf *sb)
{
const char *v;
@@ -161,6 +168,9 @@ check_with_vfs_type (guestfs_h *g, const char *device, struct
stringsbuf *sb)
CLEANUP_FREE_BTRFSSUBVOLUME_LIST struct guestfs_btrfssubvolume_list *vols =
guestfs_btrfs_subvolume_list (g, device);
+ if (vols == NULL)
+ return -1;
+
for (size_t i = 0; i < vols->len; i++) {
struct guestfs_btrfssubvolume *this = &vols->val[i];
guestfs___add_sprintf (g, sb,
@@ -178,17 +188,19 @@ check_with_vfs_type (guestfs_h *g, const char *device, struct
stringsbuf *sb)
*/
size_t n = strlen (vfs_type);
if (n >= 7 && STREQ (&vfs_type[n-7], "_member"))
- return;
+ return 0;
/* Ignore LUKS-encrypted partitions. These are also containers. */
if (STREQ (vfs_type, "crypto_LUKS"))
- return;
+ return 0;
v = vfs_type;
}
guestfs___add_string (g, sb, device);
guestfs___add_string (g, sb, v);
+
+ return 0;
}
/* We should ignore partitions that have MBR type byte 0x42, because
--
1.8.4.2