daemon: write-file: Check range of size parameter (RHBZ#597135).

This also adds a regression test.

For stable-1.2 branch:
 - cherry picked from commit 9733d4746988b3a072d8bb1daac4b9795b8f4134
 - modify the regression test to apply against the generator

diff --git a/daemon/file.c b/daemon/file.c
index 2399828..a274c92 100644 (file)
--- a/daemon/file.c
+++ b/daemon/file.c
@@ -288,8 +288,29 @@ do_write_file (const char *path, const char *content, int size)
 {
   int fd;
 
+  /* This call is deprecated, and it has a broken interface.  New code
+   * should use the 'guestfs_write' call instead.  Because we used an
+   * XDR string type, 'content' cannot contain ASCII NUL and 'size'
+   * must never be longer than the string.  We must check this to
+   * ensure random stuff from XDR or daemon memory isn't written to
+   * the file (RHBZ#597135).
+   */
+  if (size < 0) {
+    reply_with_error ("size cannot be negative");
+    return -1;
+  }
+
+  /* Note content_len must be small because of the limits on protocol
+   * message size.
+   */
+  int content_len = (int) strlen (content);
+
   if (size == 0)
-    size = strlen (content);
+    size = content_len;
+  else if (size > content_len) {
+    reply_with_error ("size parameter is larger than string content");
+    return -1;
+  }
 
   CHROOT_IN;
   fd = open (path, O_WRONLY | O_TRUNC | O_CREAT | O_NOCTTY, 0666);

diff --git a/src/generator.ml b/src/generator.ml
index 8a6177c..977fe8e 100755 (executable)
--- a/src/generator.ml
+++ b/src/generator.ml
@@ -1552,7 +1552,10 @@ C<guestfs_part_init>");
        ["cat"; "/new"]], "\n\n\n");
     InitBasicFS, Always, TestOutput (
       [["write_file"; "/new"; "\n"; "0"];
-       ["cat"; "/new"]], "\n")],
+       ["cat"; "/new"]], "\n");
+    (* Regression test for RHBZ#597135. *)
+    InitBasicFS, Always, TestLastFail
+      [["write_file"; "/new"; "abc"; "10000"]]],
    "create a file",
    "\
 This call creates a file called C<path>.  The contents of the