已合并
remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) #445
hanzhibian创建于 28 天前
remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) #445
已合并
共 1 个文件变更+5-4
| @@ -6620,13 +6620,14 @@ remoteDispatchNodeGetFreePages(virNetServer *server G_GNUC_UNUSED, | |||
| 6620 | if (!conn) | 6620 | if (!conn) |
| 6621 | goto cleanup; | 6621 | goto cleanup; |
| 6622 | 6622 | ||
| 6623 | - if (args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { | 6623 | + if (VIR_INT_MULTIPLY_OVERFLOW(args->pages.pages_len, args->cellCount) || |
| 6624 | - virReportError(VIR_ERR_INTERNAL_ERROR, "%s", | 6624 | + args->pages.pages_len * args->cellCount > REMOTE_NODE_MAX_CELLS) { |
| 6625 | - _("the result won't fit into REMOTE_NODE_MAX_CELLS")); | 6625 | + virReportError(VIR_ERR_INTERNAL_ERROR, |
| 6626 | + _("npages * cellcount > REMOTE_NODE_MAX_CELLS (%1$u)"), | ||
| 6627 | + REMOTE_NODE_MAX_CELLS); | ||
| 6626 | goto cleanup; | 6628 | goto cleanup; |
| 6627 | } | 6629 | } |
| 6628 | 6630 | ||
| 6629 | - /* Allocate return buffer. */ | ||
| 6630 | ret->counts.counts_val = g_new0(uint64_t, | 6631 | ret->counts.counts_val = g_new0(uint64_t, |
| 6631 | args->pages.pages_len * args->cellCount); | 6632 | args->pages.pages_len * args->cellCount); |
| 6632 | 6633 | ||