From c53702cee1d6f9f1b72f0cae0b412e21bcda8724 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Thu, 10 Oct 2013 15:48:55 +0100 Subject: libxl: fix vif rate parsing strtok can return NULL here. We don't need to use strtok anyway, so just use a simple strchr method. Coverity-ID: 1055642 This is CVE-2013-4369 / XSA-68 Signed-off-by: Matthew Daley Fix type. Add test case Signed-off-by: Ian Campbell --- tools/libxl/libxlu_vif.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) (limited to 'tools/libxl/libxlu_vif.c') diff --git a/tools/libxl/libxlu_vif.c b/tools/libxl/libxlu_vif.c index 3b3de0f811..0665e624dc 100644 --- a/tools/libxl/libxlu_vif.c +++ b/tools/libxl/libxlu_vif.c @@ -95,23 +95,30 @@ int xlu_vif_parse_rate(XLU_Config *cfg, const char *rate, libxl_device_nic *nic) uint64_t bytes_per_sec = 0; uint64_t bytes_per_interval = 0; uint32_t interval_usecs = 50000UL; /* Default to 50ms */ - char *ratetok, *tmprate; + char *p, *tmprate; int rc = 0; tmprate = strdup(rate); + if (tmprate == NULL) { + rc = ENOMEM; + goto out; + } + + p = strchr(tmprate, '@'); + if (p != NULL) + *p++ = 0; + if (!strcmp(tmprate,"")) { xlu__vif_err(cfg, "no rate specified", rate); rc = EINVAL; goto out; } - ratetok = strtok(tmprate, "@"); - rc = vif_parse_rate_bytes_per_sec(cfg, ratetok, &bytes_per_sec); + rc = vif_parse_rate_bytes_per_sec(cfg, tmprate, &bytes_per_sec); if (rc) goto out; - ratetok = strtok(NULL, "@"); - if (ratetok != NULL) { - rc = vif_parse_rate_interval_usecs(cfg, ratetok, &interval_usecs); + if (p != NULL) { + rc = vif_parse_rate_interval_usecs(cfg, p, &interval_usecs); if (rc) goto out; } -- cgit v1.2.3