[libvirt] [PATCH V1 4/5] uuid: fix possible non-terminated string

[Eric Blake]

On 05/04/2012 05:54 AM, Stefan Berger wrote:
> Error: STRING_NULL:
> /libvirt/src/util/uuid.c:273:
> string_null_argument: Function "getDMISystemUUID" does not terminate string "*dmiuuid".
> /libvirt/src/util/uuid.c:241:

Maybe not, but...

> string_null_argument: Function "saferead" fills array "*uuid" with a non-terminated string.
> /libvirt/src/util/util.c:101:
> string_null_argument: Function "read" fills array "*buf" with a non-terminated string.
> /libvirt/src/util/uuid.c:274:
> string_null: Passing unterminated string "dmiuuid" to a function expecting a null-terminated string.
> /libvirt/src/util/uuid.c:138:
> var_assign_parm: Assigning: "cur" = "uuidstr". They now point to the same thing.
> /libvirt/src/util/uuid.c:164:
> string_null_sink_loop: Searching for null termination in an unterminated array "cur".
> 
> ---
>  src/util/uuid.c |    5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> Index: libvirt-acl/src/util/uuid.c
> ===================================================================
> --- libvirt-acl.orig/src/util/uuid.c
> +++ libvirt-acl/src/util/uuid.c
> @@ -269,8 +269,9 @@ virSetHostUUIDStr(const char *uuid)
>          return EEXIST;
>  
>      if (!uuid) {
> -        memset(dmiuuid, 0, sizeof(dmiuuid));

This pre-populates the entire array with NUL bytes,

> -        if (!getDMISystemUUID(dmiuuid, sizeof(dmiuuid) - 1)) {

and this guarantees that getDMISystemUUID will not touch the last byte,
therefore we are guaranteed to have a NUL-terminated string.

Coverity has a false positive.

I'm not sure I like this patch; I'm debating if there is a better way to
shut Coverity up.

> +        rc = getDMISystemUUID(dmiuuid, sizeof(dmiuuid) - 1);

This is working around the issue in the caller; wouldn't a better fix be
to actually alter getDMISystemUUID to guarantee NUL termination in the
first place, so that we don't have to audit all callers?

> +        dmiuuid[VIR_UUID_STRING_BUFLEN - 1] = '\0';
> +        if (!rc) {
>              if (!virUUIDParse(dmiuuid, host_uuid))
>                  return 0;
>          }
> 
> 
> 

-- 
Eric Blake   eblake at redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 620 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20120504/16e92463/attachment-0001.sig>