[libvirt] [PATCH] security: plug regression introduced in disk probe logic

Matthias Bolte matthias.bolte at googlemail.com
Wed Jun 1 22:52:07 UTC 2011


2011/6/2 Eric Blake <eblake at redhat.com>:
> On 05/31/2011 05:35 PM, Eric Blake wrote:
>> Regression introduced in commit d6623003 (v0.8.8) - using the
>> wrong sizeof operand meant that security manager private data
>> was overlaying the allowDiskFOrmatProbing member of struct
>> _virSecurityManager.  This reopens disk probing, which was
>> supposed to be prevented by the solution to CVE-2010-2238.
>>
>> * src/security/security_manager.c
>> (virSecurityManagerGetPrivateData): Use correct offset.
>> ---
>>  src/security/security_manager.c |    2 +-
>>  1 files changed, 1 insertions(+), 1 deletions(-)
>>
>> diff --git a/src/security/security_manager.c b/src/security/security_manager.c
>> index 0246dd8..833c1a2 100644
>> --- a/src/security/security_manager.c
>> +++ b/src/security/security_manager.c
>> @@ -107,7 +107,7 @@ virSecurityManagerPtr virSecurityManagerNew(const char *name,
>>
>>  void *virSecurityManagerGetPrivateData(virSecurityManagerPtr mgr)
>>  {
>> -    return ((char*)mgr) + sizeof(mgr);
>> +    return ((char*)mgr) + sizeof(*mgr);
>
> I suppose I could have used:
>
> return mgr + 1;
>
> instead, since that gives the same address with less typing.  Any
> preferences on which form to commit?
>

I'd say go with the more readable mgr + 1.

Matthias




More information about the libvir-list mailing list