commit fd6f6a48619eb221afeb1c5965537534cd54e01d
Author: Daniel P. Berrange <berrange@redhat.com>
Date:   Mon Aug 19 14:55:21 2013 +0100

    Add bounds checking on virDomainMigrate*Params RPC calls (CVE-2013-4292)
    
    The parameters for the virDomainMigrate*Params RPC calls were
    not bounds checks, meaning a malicious client can cause libvirtd
    to consume arbitrary memory
    
    This issue was introduced in the 1.1.0 release of libvirt
    
    Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

Index: libvirt-1.1.1/daemon/remote.c
===================================================================
--- libvirt-1.1.1.orig/daemon/remote.c	2014-03-25 14:15:19.910627390 -0500
+++ libvirt-1.1.1/daemon/remote.c	2014-03-25 14:15:19.898627389 -0500
@@ -4620,6 +4620,13 @@ remoteDispatchDomainMigrateBegin3Params(
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
         goto cleanup;
 
@@ -4671,6 +4678,13 @@ remoteDispatchDomainMigratePrepare3Param
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
                                                     args->params.params_len,
                                                     0, &nparams)))
@@ -4726,6 +4740,13 @@ remoteDispatchDomainMigratePrepareTunnel
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
                                                     args->params.params_len,
                                                     0, &nparams)))
@@ -4790,6 +4811,13 @@ remoteDispatchDomainMigratePerform3Param
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
         goto cleanup;
 
@@ -4845,6 +4873,13 @@ remoteDispatchDomainMigrateFinish3Params
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(params = remoteDeserializeTypedParameters(args->params.params_val,
                                                     args->params.params_len,
                                                     0, &nparams)))
@@ -4897,6 +4932,13 @@ remoteDispatchDomainMigrateConfirm3Param
         goto cleanup;
     }
 
+    if (args->params.params_len > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       args->params.params_len, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (!(dom = get_nonnull_domain(priv->conn, args->dom)))
         goto cleanup;
 
Index: libvirt-1.1.1/src/remote/remote_driver.c
===================================================================
--- libvirt-1.1.1.orig/src/remote/remote_driver.c	2014-03-25 14:15:19.910627390 -0500
+++ libvirt-1.1.1/src/remote/remote_driver.c	2014-03-25 14:15:19.902627389 -0500
@@ -6037,6 +6037,13 @@ remoteDomainMigrateBegin3Params(virDomai
     make_nonnull_domain(&args.dom, domain);
     args.flags = flags;
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (remoteSerializeTypedParameters(params, nparams,
                                        &args.params.params_val,
                                        &args.params.params_len) < 0) {
@@ -6096,6 +6103,13 @@ remoteDomainMigratePrepare3Params(virCon
     memset(&args, 0, sizeof(args));
     memset(&ret, 0, sizeof(ret));
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     if (remoteSerializeTypedParameters(params, nparams,
                                        &args.params.params_val,
                                        &args.params.params_len) < 0) {
@@ -6171,6 +6185,13 @@ remoteDomainMigratePrepareTunnel3Params(
     memset(&args, 0, sizeof(args));
     memset(&ret, 0, sizeof(ret));
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     args.cookie_in.cookie_in_val = (char *)cookiein;
     args.cookie_in.cookie_in_len = cookieinlen;
     args.flags = flags;
@@ -6250,6 +6271,13 @@ remoteDomainMigratePerform3Params(virDom
     memset(&args, 0, sizeof(args));
     memset(&ret, 0, sizeof(ret));
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     make_nonnull_domain(&args.dom, dom);
     args.dconnuri = dconnuri == NULL ? NULL : (char **) &dconnuri;
     args.cookie_in.cookie_in_val = (char *)cookiein;
@@ -6315,6 +6343,13 @@ remoteDomainMigrateFinish3Params(virConn
     memset(&args, 0, sizeof(args));
     memset(&ret, 0, sizeof(ret));
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     args.cookie_in.cookie_in_val = (char *)cookiein;
     args.cookie_in.cookie_in_len = cookieinlen;
     args.flags = flags;
@@ -6380,6 +6415,13 @@ remoteDomainMigrateConfirm3Params(virDom
 
     memset(&args, 0, sizeof(args));
 
+    if (nparams > REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX) {
+        virReportError(VIR_ERR_RPC,
+                       _("Too many migration parameters '%d' for limit '%d'"),
+                       nparams, REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX);
+        goto cleanup;
+    }
+
     make_nonnull_domain(&args.dom, domain);
     args.cookie_in.cookie_in_len = cookieinlen;
     args.cookie_in.cookie_in_val = (char *) cookiein;
Index: libvirt-1.1.1/src/remote/remote_protocol.x
===================================================================
--- libvirt-1.1.1.orig/src/remote/remote_protocol.x	2014-03-25 14:15:19.910627390 -0500
+++ libvirt-1.1.1/src/remote/remote_protocol.x	2014-03-25 14:15:19.902627389 -0500
@@ -234,6 +234,9 @@ const REMOTE_DOMAIN_DISK_ERRORS_MAX = 25
  */
 const REMOTE_NODE_MEMORY_PARAMETERS_MAX = 64;
 
+/* Upper limit on migrate parameters */
+const REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX = 64;
+
 /* UUID.  VIR_UUID_BUFLEN definition comes from libvirt.h */
 typedef opaque remote_uuid[VIR_UUID_BUFLEN];
 
@@ -2770,7 +2773,7 @@ struct remote_domain_fstrim_args {
 
 struct remote_domain_migrate_begin3_params_args {
     remote_nonnull_domain dom;
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     unsigned int flags;
 };
 
@@ -2780,7 +2783,7 @@ struct remote_domain_migrate_begin3_para
 };
 
 struct remote_domain_migrate_prepare3_params_args {
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     opaque cookie_in<REMOTE_MIGRATE_COOKIE_MAX>;
     unsigned int flags;
 };
@@ -2791,7 +2794,7 @@ struct remote_domain_migrate_prepare3_pa
 };
 
 struct remote_domain_migrate_prepare_tunnel3_params_args {
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     opaque cookie_in<REMOTE_MIGRATE_COOKIE_MAX>;
     unsigned int flags;
 };
@@ -2803,7 +2806,7 @@ struct remote_domain_migrate_prepare_tun
 struct remote_domain_migrate_perform3_params_args {
     remote_nonnull_domain dom;
     remote_string dconnuri;
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     opaque cookie_in<REMOTE_MIGRATE_COOKIE_MAX>;
     unsigned int flags;
 };
@@ -2813,7 +2816,7 @@ struct remote_domain_migrate_perform3_pa
 };
 
 struct remote_domain_migrate_finish3_params_args {
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     opaque cookie_in<REMOTE_MIGRATE_COOKIE_MAX>;
     unsigned int flags;
     int cancelled;
@@ -2826,7 +2829,7 @@ struct remote_domain_migrate_finish3_par
 
 struct remote_domain_migrate_confirm3_params_args {
     remote_nonnull_domain dom;
-    remote_typed_param params<>;
+    remote_typed_param params<REMOTE_DOMAIN_MIGRATE_PARAM_LIST_MAX>;
     opaque cookie_in<REMOTE_MIGRATE_COOKIE_MAX>;
     unsigned int flags;
     int cancelled;
