From bf6667d63ef4c4fbaf91051589a594ec1c235308 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Mon, 30 Mar 2015 14:57:15 +0100 Subject: [PATCH 1/2] virtfs-proxy-helper: add missing long option terminator The getopt_long(3) long options array must have a zeroed terminator. This patch solves a segmentation fault when an unknown command-line option is encountered: $ fsdev/virtfs-proxy-helper --help Segmentation fault (core dumped) Signed-off-by: Stefan Hajnoczi Signed-off-by: Aneesh Kumar K.V --- fsdev/virtfs-proxy-helper.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c index a698e2dbb3..91e8b9b7f1 100644 --- a/fsdev/virtfs-proxy-helper.c +++ b/fsdev/virtfs-proxy-helper.c @@ -49,6 +49,7 @@ static struct option helper_opts[] = { {"socket", required_argument, NULL, 's'}, {"uid", required_argument, NULL, 'u'}, {"gid", required_argument, NULL, 'g'}, + {}, }; static bool is_daemon; From f8d30a4f96d6c3a12e692d2e69b8fe4734b916c6 Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Mon, 30 Mar 2015 14:57:16 +0100 Subject: [PATCH 2/2] virtfs-proxy-helper: fail gracefully if socket path is too long Replace the assertion check with graceful failure when the socket path is too long. Programs should not crash on invalid input. Print an error message and exit properly. Cc: Shannon Zhao Signed-off-by: Stefan Hajnoczi Signed-off-by: Aneesh Kumar K.V --- fsdev/virtfs-proxy-helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c index 91e8b9b7f1..9097d15c98 100644 --- a/fsdev/virtfs-proxy-helper.c +++ b/fsdev/virtfs-proxy-helper.c @@ -739,7 +739,12 @@ static int proxy_socket(const char *path, uid_t uid, gid_t gid) return -1; } - g_assert(strlen(path) < sizeof(proxy.sun_path)); + if (strlen(path) >= sizeof(proxy.sun_path)) { + do_log(LOG_CRIT, "UNIX domain socket path exceeds %zu characters\n", + sizeof(proxy.sun_path)); + return -1; + } + sock = socket(AF_UNIX, SOCK_STREAM, 0); if (sock < 0) { do_perror("socket");