summary refs log tree commit diff stats
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2021-09-07 10:15:48 +0100
committerPeter Maydell <peter.maydell@linaro.org>2021-09-07 10:15:48 +0100
commita61c30b8c8c3c8619847cfaa289233cc696f5689 (patch)
treed8f50851ec9a29c535e38abccd2f0f75eb48b37c
parent935efca6c246c108253b0e4e51cc87648fc7ca10 (diff)
parent118d527f2e4baec5fe8060b22a6212468b8e4d3f (diff)
downloadfocaccia-qemu-a61c30b8c8c3c8619847cfaa289233cc696f5689.tar.gz
focaccia-qemu-a61c30b8c8c3c8619847cfaa289233cc696f5689.zip
Merge remote-tracking branch 'remotes/mjt/tags/patch-fetch' into staging
qemu-socket unix socket bugfix 2021-09-06

# gpg: Signature made Mon 06 Sep 2021 16:19:32 BST
# gpg:                using RSA key 7B73BAD68BE7A2C289314B22701B4F6B1A693E59
# gpg:                issuer "mjt@tls.msk.ru"
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>" [full]
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>" [full]
# gpg:                 aka "Michael Tokarev <mjt@debian.org>" [full]
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931  4B22 701B 4F6B 1A69 3E59

* remotes/mjt/tags/patch-fetch:
  qemu-sockets: fix unix socket path copy (again)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--util/qemu-sockets.c13
1 files changed, 5 insertions, 8 deletions
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index f2f3676d1f..c5043999e9 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -1345,25 +1345,22 @@ socket_sockaddr_to_address_unix(struct sockaddr_storage *sa,
     SocketAddress *addr;
     struct sockaddr_un *su = (struct sockaddr_un *)sa;
 
-    assert(salen >= sizeof(su->sun_family) + 1 &&
-           salen <= sizeof(struct sockaddr_un));
-
     addr = g_new0(SocketAddress, 1);
     addr->type = SOCKET_ADDRESS_TYPE_UNIX;
+    salen -= offsetof(struct sockaddr_un, sun_path);
 #ifdef CONFIG_LINUX
-    if (!su->sun_path[0]) {
+    if (salen > 0 && !su->sun_path[0]) {
         /* Linux abstract socket */
-        addr->u.q_unix.path = g_strndup(su->sun_path + 1,
-                                        salen - sizeof(su->sun_family) - 1);
+        addr->u.q_unix.path = g_strndup(su->sun_path + 1, salen - 1);
         addr->u.q_unix.has_abstract = true;
         addr->u.q_unix.abstract = true;
         addr->u.q_unix.has_tight = true;
-        addr->u.q_unix.tight = salen < sizeof(*su);
+        addr->u.q_unix.tight = salen < sizeof(su->sun_path);
         return addr;
     }
 #endif
 
-    addr->u.q_unix.path = g_strndup(su->sun_path, sizeof(su->sun_path));
+    addr->u.q_unix.path = g_strndup(su->sun_path, salen);
     return addr;
 }
 #endif /* WIN32 */