From 5dc50c6bca059a9cda6677b1fd0187df1de78ed7 Mon Sep 17 00:00:00 2001

From: jmaloy <jmaloy@redhat.com>

Date: Thu, 13 Feb 2020 15:50:48 +0000

Subject: [PATCH 2/7] util: add slirp_fmt() helpers

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

RH-Author: jmaloy <jmaloy@redhat.com>

Message-id: <20200213155049.3936-2-jmaloy@redhat.com>

Patchwork-id: 93824

O-Subject: [RHEL-AV-8.2.0 qemu-kvm PATCH 1/2] util: add slirp_fmt() helpers

Bugzilla: 1798994

RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>

RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>

RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

From: Marc-André Lureau <marcandre.lureau@redhat.com>

Various calls to snprintf() in libslirp assume that snprintf() returns

"only" the number of bytes written (excluding terminating NUL).

https://pubs.opengroup.org/onlinepubs/9699919799/functions/snprintf.html#tag_16_159_04

"Upon successful completion, the snprintf() function shall return the

number of bytes that would be written to s had n been sufficiently

large excluding the terminating null byte."

Introduce slirp_fmt() that handles several pathological cases the

way libslirp usually expect:

- treat error as fatal (instead of silently returning -1)

- fmt0() will always \0 end

- return the number of bytes actually written (instead of what would

have been written, which would usually result in OOB later), including

the ending \0 for fmt0()

- warn if truncation happened (instead of ignoring)

Other less common cases can still be handled with strcpy/snprintf() etc.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>

Message-Id: <20200127092414.169796-2-marcandre.lureau@redhat.com>

(cherry picked from libslirp commit 30648c03b27fb8d9611b723184216cd3174b6775)

Signed-off-by: Jon Maloy <jmaloy@redhat.com>

Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>

---

 slirp/src/util.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 slirp/src/util.h |  3 +++

 2 files changed, 65 insertions(+)

diff --git a/slirp/src/util.c b/slirp/src/util.c

index e596087..e3b6257 100644

--- a/slirp/src/util.c

+++ b/slirp/src/util.c

@@ -364,3 +364,65 @@ void slirp_pstrcpy(char *buf, int buf_size, const char *str)

     }

     *q = '\0';

 }

+

+static int slirp_vsnprintf(char *str, size_t size,

+                           const char *format, va_list args)

+{

+    int rv = vsnprintf(str, size, format, args);

+

+    if (rv < 0) {

+        g_error("vsnprintf() failed: %s", g_strerror(errno));

+    }

+

+    return rv;

+}

+

+/*

+ * A snprintf()-like function that:

+ * - returns the number of bytes written (excluding optional \0-ending)

+ * - dies on error

+ * - warn on truncation

+ */

+int slirp_fmt(char *str, size_t size, const char *format, ...)

+{

+    va_list args;

+    int rv;

+

+    va_start(args, format);

+    rv = slirp_vsnprintf(str, size, format, args);

+    va_end(args);

+

+    if (rv > size) {

+        g_critical("vsnprintf() truncation");

+    }

+

+    return MIN(rv, size);

+}

+

+/*

+ * A snprintf()-like function that:

+ * - always \0-end (unless size == 0)

+ * - returns the number of bytes actually written, including \0 ending

+ * - dies on error

+ * - warn on truncation

+ */

+int slirp_fmt0(char *str, size_t size, const char *format, ...)

+{

+    va_list args;

+    int rv;

+

+    va_start(args, format);

+    rv = slirp_vsnprintf(str, size, format, args);

+    va_end(args);

+

+    if (rv >= size) {

+        g_critical("vsnprintf() truncation");

+        if (size > 0)

+            str[size - 1] = '\0';

+        rv = size;

+    } else {

+        rv += 1; /* include \0 */

+    }

+

+    return rv;

+}

diff --git a/slirp/src/util.h b/slirp/src/util.h

index 3c6223c..0558dfc 100644

--- a/slirp/src/util.h

+++ b/slirp/src/util.h

@@ -177,4 +177,7 @@ static inline int slirp_socket_set_fast_reuse(int fd)

 void slirp_pstrcpy(char *buf, int buf_size, const char *str);

+int slirp_fmt(char *str, size_t size, const char *format, ...);

+int slirp_fmt0(char *str, size_t size, const char *format, ...);

+

 #endif

-- 

1.8.3.1