[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: [Libvir] [PATCH] Fix endless loop of VirBufferVSprintf()



Hi

Would you give me a comment on this?
This occurs when virsh create is executed by using the attached file.  

Thanks,
Masayuki Sunou

In message <200708241730 AJI90166 3GE29KN7 aa jp fujitsu com>
   "[Libvir] [PATCH] Fix endless loop of VirBufferVSprintf()"
   "Masayuki Sunou <fj1826dm aa jp fujitsu com>" wrote:

> Hi
> 
> VirBufferVSprintf() loops endless when it receives over 2000 bytes,
> because the return value of vsnprintf() is more than "size - 1".
> It is because the maximum of "size" is 1999 bytes.
>  --> the maximum of "buf->size - buf->use" = 2000
>      (1000(argument of virBufferGrow()) + 1000(set in virBufferGrow()))
> 
> So, virBufferEscapeString() has the same problem.
> 
> This patch sets to virBufferGrow() the size of the data
> which VirBufferVSprintf()(virBufferEscapeString()) received
> when it is over 1000 bytes.
> 
> Signed-off-by: Masayuki Sunou <fj1826dm aa jp fujitsu com>
> 
> Thanks,
> Masayuki Sunou.
> 
> ----------------------------------------------------------------------
> Index: src/buf.c
> ===================================================================
> RCS file: /data/cvs/libvirt/src/buf.c,v
> retrieving revision 1.3
> diff -u -p -r1.3 buf.c
> --- src/buf.c	9 Jul 2007 11:24:52 -0000	1.3
> +++ src/buf.c	24 Aug 2007 05:56:37 -0000
> @@ -159,7 +159,7 @@ virBufferContentAndFree (virBufferPtr bu
>  int
>  virBufferVSprintf(virBufferPtr buf, const char *format, ...)
>  {
> -    int size, count;
> +    int size, count, grow_size;
>      va_list locarg, argptr;
>  
>      if ((format == NULL) || (buf == NULL)) {
> @@ -172,7 +172,8 @@ virBufferVSprintf(virBufferPtr buf, cons
>                                 locarg)) < 0) || (count >= size - 1)) {
>          buf->content[buf->use] = 0;
>          va_end(locarg);
> -        if (virBufferGrow(buf, 1000) < 0) {
> +        grow_size = (count > 1000) ? count : 1000;
> +        if (virBufferGrow(buf, grow_size) < 0) {
>              return (-1);
>          }
>          size = buf->size - buf->use - 1;
> @@ -198,7 +199,7 @@ virBufferVSprintf(virBufferPtr buf, cons
>  int
>  virBufferEscapeString(virBufferPtr buf, const char *format, const char *str)
>  {
> -    int size, count, len;
> +    int size, count, len, grow_size;
>      char *escaped, *out;
>      const char *cur;
>  
> @@ -248,7 +249,8 @@ virBufferEscapeString(virBufferPtr buf, 
>      while (((count = snprintf(&buf->content[buf->use], size, format,
>                                (char *)escaped)) < 0) || (count >= size - 1)) {
>          buf->content[buf->use] = 0;
> -        if (virBufferGrow(buf, 1000) < 0) {
> +        grow_size = (count > 1000) ? count : 1000;
> +        if (virBufferGrow(buf, grow_size) < 0) {
>  	    free(escaped);
>              return (-1);
>          }
> ----------------------------------------------------------------------
> 
> --
> Libvir-list mailing list
> Libvir-list redhat com
> https://www.redhat.com/mailman/listinfo/libvir-list
> 
<domain type='xen'>
  <name>test</name>
  <currentMemory>358400</currentMemory>
  <memory>358400</memory>
  <uuid>926726ea-3533-1ef0-7a69-d19442aeaab9</uuid>
  <os>
    <type>linux</type>
    <kernel>/var/lib/xen/virtinst-vmlinuz.kvaCK_</kernel>
    <initrd>/var/lib/xen/virtinst-initrd.img.-Hqw-p</initrd>
    <cmdline> method=ftp://10.131.236.20/rhel5.1b_x86</cmdline>
  </os>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>destroy</on_reboot>
  <on_crash>destroy</on_crash>
  <vcpu>1</vcpu>
  <devices>
    <disk type='block' device='disk'>
      <source dev='/dev/sda5'/>
      <target dev='xvda'/>
    </disk>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:39:3b:59'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:0f:3c:8c'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:24:c0:26'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:37:1a:9f'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:31:96:3c'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:3b:bd:84'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:40:f9:fd'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:36:00:8d'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:4a:11:48'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:33:75:b0'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:25:93:9c'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:7d:cd:f4'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:38:b8:48'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:3e:08:09'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:0d:f3:86'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:27:a4:8a'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:3b:a7:1c'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:5c:1e:68'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:01:05:1e'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:7f:b2:3d'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:48:50:80'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:69:f7:e7'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:0f:14:4d'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:42:34:96'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:2b:9f:51'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:56:b1:ff'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:04:65:6a'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:5e:df:56'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:25:a4:95'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:46:49:0a'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:46:49:0b'/>
    </interface>
    <interface type='bridge'>
      <source bridge='xenbr0'/>
      <mac address='00:16:3e:46:49:0c'/>
    </interface>
    <input type='mouse' bus='xen'/>
    <graphics type='vnc' port='-1' />
  </devices>
</domain>

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]