db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2018-6163
Vulnerability description: Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

Project: Chrome

IDNSpoofChecker::IDNSpoofChecker() {
  UErrorCode status = U_ZERO_ERROR;
  checker_ = uspoof_open(&status);
  if (U_FAILURE(status)) {
    checker_ = nullptr;
    return;
  }


  uspoof_setRestrictionLevel(checker_, USPOOF_HIGHLY_RESTRICTIVE);

  SetAllowedUnicodeSet(&status);

  int32_t checks = uspoof_getChecks(checker_, &status) | USPOOF_AUX_INFO;
  uspoof_setChecks(checker_, checks, &status);

  deviation_characters_ = icu::UnicodeSet(
      UNICODE_STRING_SIMPLE("[\\u00df\\u03c2\\u200c\\u200d]"), status);
  deviation_characters_.freeze();

  non_ascii_latin_letters_ =
      icu::UnicodeSet(UNICODE_STRING_SIMPLE("[[:Latin:] - [a-zA-Z]]"), status);
  non_ascii_latin_letters_.freeze();

  kana_letters_exceptions_ = icu::UnicodeSet(
      UNICODE_STRING_SIMPLE("[\\u3078-\\u307a\\u30d8-\\u30da\\u30fb-\\u30fe]"),
      status);
  kana_letters_exceptions_.freeze();
  combining_diacritics_exceptions_ =
      icu::UnicodeSet(UNICODE_STRING_SIMPLE("[\\u0300-\\u0339]"), status);
  combining_diacritics_exceptions_.freeze();

  cyrillic_letters_latin_alike_ = icu::UnicodeSet(
      icu::UnicodeString::fromUTF8("[асԁеһіјӏорԛѕԝхуъЬҽпгѵѡ]"), status);
  cyrillic_letters_latin_alike_.freeze();

  cyrillic_letters_ =
      icu::UnicodeSet(UNICODE_STRING_SIMPLE("[[:Cyrl:]]"), status);
  cyrillic_letters_.freeze();

  DCHECK(U_SUCCESS(status));
  lgc_letters_n_ascii_ = icu::UnicodeSet(
      UNICODE_STRING_SIMPLE("[[:Latin:][:Greek:][:Cyrillic:][0-9\\u002e_"
                            "\\u002d][\\u0300-\\u0339]]"),
      status);
  lgc_letters_n_ascii_.freeze();

  UParseError parse_error;
  diacritic_remover_.reset(icu::Transliterator::createFromRules(
      UNICODE_STRING_SIMPLE("DropAcc"),
      icu::UnicodeString::fromUTF8("::NFD; ::[:Nonspacing Mark:] Remove; ::NFC;"
                                   " ł > l; ø > o; đ > d;"),
      UTRANS_FORWARD, parse_error, status));

  //   - {U+0437 (з), U+0499 (ҙ), U+04E1 (ӡ), U+10D5 (ვ), U+1012 (ဒ)} => 3
   extra_confusable_mapper_.reset(icu::Transliterator::createFromRules(
       UNICODE_STRING_SIMPLE("ExtraConf"),
      icu::UnicodeString::fromUTF8(
          "[æӕ] > ae; [þϼҏ] > p; [ħнћңҥӈӊԋԧԩ] > h;"
          "[ĸκкқҝҟҡӄԟ] > k; [ŋпԥ] > n; œ > ce;"
          "[ŧтҭԏ] > t; [ƅьҍв] > b;  [ωшщพฟພຟ] > w;"
           "[мӎ] > m; [єҽҿၔ] > e; ґ > r; [ғӻ] > f;"
           "[ҫင] > c; ұ > y; [χҳӽӿ] > x;"
           "ԃ  > d; [ԍဌ] > g; [ടรຣຮ] > s; ၂ > j;"
          "[зҙӡვဒ] > 3; [บບ] > u"),
       UTRANS_FORWARD, parse_error, status));
   DCHECK(U_SUCCESS(status))
       << "Spoofchecker initalization failed due to an error: "
      << u_errorName(status);
}
Commit message: None
CVE: CVE-2016-1675
CWE: CWE-284
Vulnerability description: Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during destruction, related to FrameLoader.cpp and LocalFrame.cpp.

Project: Chrome

std::string TestURLLoader::TestUntendedLoad() {
  pp::URLRequestInfo request(instance_);
  request.SetURL("test_url_loader_data/hello.txt");
  request.SetRecordDownloadProgress(true);
  TestCompletionCallback callback(instance_->pp_instance(), callback_type());

  pp::URLLoader loader(instance_);
  callback.WaitForResult(loader.Open(request, callback.GetCallback()));
  CHECK_CALLBACK_BEHAVIOR(callback);
  ASSERT_EQ(PP_OK, callback.result());

  int64_t bytes_received = 0;
  int64_t total_bytes_to_be_received = 0;
  while (true) {
     loader.GetDownloadProgress(&bytes_received, &total_bytes_to_be_received);
     if (total_bytes_to_be_received <= 0)
       return ReportError("URLLoader::GetDownloadProgress total size",
                         static_cast<int32_t>(total_bytes_to_be_received));
     if (bytes_received == total_bytes_to_be_received)
       break;
    if (pp::Module::Get()->core()->IsMainThread()) {
      NestedEvent event(instance_->pp_instance());
      event.PostSignal(10);
      event.Wait();
    }
  }
  std::string body;
  std::string error = ReadEntireResponseBody(&loader, &body);
  if (!error.empty())
    return error;
  if (body != "hello\n")
    return ReportError("Couldn't read data", callback.result());

  PASS();
}
Commit message: None
CVE: CVE-2015-1538
CWE: CWE-189
Vulnerability description: Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

Project: Android

status_t SampleTable::setSampleToChunkParams(
 off64_t data_offset, size_t data_size) {
 if (mSampleToChunkOffset >= 0) {
 return ERROR_MALFORMED;
 }

    mSampleToChunkOffset = data_offset;

 if (data_size < 8) {
 return ERROR_MALFORMED;
 }

 uint8_t header[8];
 if (mDataSource->readAt(
                data_offset, header, sizeof(header)) < (ssize_t)sizeof(header)) {
 return ERROR_IO;
 }

 if (U32_AT(header) != 0) {
 return ERROR_MALFORMED;
 }

    mNumSampleToChunkOffsets = U32_AT(&header[4]);

 if (data_size < 8 + mNumSampleToChunkOffsets * 12) {

         return ERROR_MALFORMED;
     }
 
    if (SIZE_MAX / sizeof(SampleToChunkEntry) <= mNumSampleToChunkOffsets)
        return ERROR_OUT_OF_RANGE;

     mSampleToChunkEntries =
         new SampleToChunkEntry[mNumSampleToChunkOffsets];
 
 for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) {
 uint8_t buffer[12];
 if (mDataSource->readAt(
                    mSampleToChunkOffset + 8 + i * 12, buffer, sizeof(buffer))
 != (ssize_t)sizeof(buffer)) {
 return ERROR_IO;
 }

        CHECK(U32_AT(buffer) >= 1); // chunk index is 1 based in the spec.

        mSampleToChunkEntries[i].startChunk = U32_AT(buffer) - 1;
        mSampleToChunkEntries[i].samplesPerChunk = U32_AT(&buffer[4]);
        mSampleToChunkEntries[i].chunkDesc = U32_AT(&buffer[8]);
 }

 return OK;
}
Commit message: None
CVE: CVE-2015-1474
CWE: CWE-189
Vulnerability description: Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values.

Project: Android

status_t GraphicBuffer::unflatten(
 void const*& buffer, size_t& size, int const*& fds, size_t& count) {
 if (size < 8*sizeof(int)) return NO_MEMORY;

 int const* buf = static_cast<int const*>(buffer);
 if (buf[0] != 'GBFR') return BAD_TYPE;


     const size_t numFds  = buf[8];
     const size_t numInts = buf[9];
 
    const size_t maxNumber = UINT_MAX / sizeof(int);
    if (numFds >= maxNumber || numInts >= (maxNumber - 10)) {
        width = height = stride = format = usage = 0;
        handle = NULL;
        ALOGE("unflatten: numFds or numInts is too large: %d, %d",
                numFds, numInts);
        return BAD_VALUE;
    }

     const size_t sizeNeeded = (10 + numInts) * sizeof(int);
     if (size < sizeNeeded) return NO_MEMORY;
 
    size_t fdCountNeeded = numFds;
     if (count < fdCountNeeded) return NO_MEMORY;
 
     if (handle) {
        free_handle();
 }

 if (numFds || numInts) {
        width  = buf[1];
        height = buf[2];
        stride = buf[3];

         format = buf[4];
         usage  = buf[5];
         native_handle* h = native_handle_create(numFds, numInts);
        if (!h) {
            width = height = stride = format = usage = 0;
            handle = NULL;
            ALOGE("unflatten: native_handle_create failed");
            return NO_MEMORY;
        }
         memcpy(h->data,          fds,     numFds*sizeof(int));
         memcpy(h->data + numFds, &buf[10], numInts*sizeof(int));
         handle = h;
 } else {
        width = height = stride = format = usage = 0;
        handle = NULL;
 }

    mId = static_cast<uint64_t>(buf[6]) << 32;
    mId |= static_cast<uint32_t>(buf[7]);

    mOwner = ownHandle;

 if (handle != 0) {
 status_t err = mBufferMapper.registerBuffer(handle);
 if (err != NO_ERROR) {
            width = height = stride = format = usage = 0;
            handle = NULL;
            ALOGE("unflatten: registerBuffer failed: %s (%d)",
                    strerror(-err), err);
 return err;
 }
 }

    buffer = reinterpret_cast<void const*>(static_cast<int const*>(buffer) + sizeNeeded);
    size -= sizeNeeded;
    fds += numFds;
    count -= numFds;

 return NO_ERROR;
}
Commit message: None
CVE: CVE-2016-2448
CWE: CWE-264
Vulnerability description: media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.

Project: Android

ssize_t NuPlayer::NuPlayerStreamListener::read(
 void *data, size_t size, sp<AMessage> *extra) {
    CHECK_GT(size, 0u);

    extra->clear();

 Mutex::Autolock autoLock(mLock);

 if (mEOS) {
 return 0;
 }

 if (mQueue.empty()) {
        mSendDataNotification = true;

 return -EWOULDBLOCK;
 }

 QueueEntry *entry = &*mQueue.begin();

 if (entry->mIsCommand) {
 switch (entry->mCommand) {
 case EOS:
 {
                mQueue.erase(mQueue.begin());
                entry = NULL;

                mEOS = true;
 return 0;
 }

 case DISCONTINUITY:
 {
 *extra = entry->mExtra;

                mQueue.erase(mQueue.begin());
                entry = NULL;

 return INFO_DISCONTINUITY;
 }

 default:
                TRESPASS();
 break;
 }
 }

 size_t copy = entry->mSize;
 if (copy > size) {

         copy = size;
     }
 
    if (entry->mIndex >= mBuffers.size()) {
        return ERROR_MALFORMED;
    }

    sp<IMemory> mem = mBuffers.editItemAt(entry->mIndex);
    if (mem == NULL || mem->size() < copy || mem->size() - copy < entry->mOffset) {
        return ERROR_MALFORMED;
    }

     memcpy(data,
           (const uint8_t *)mem->pointer()
             + entry->mOffset,
            copy);
 
    entry->mOffset += copy;
    entry->mSize -= copy;

 if (entry->mSize == 0) {
        mSource->onBufferAvailable(entry->mIndex);
        mQueue.erase(mQueue.begin());
        entry = NULL;
 }

 return copy;
}
Commit message: None
CVE: CVE-2016-2430
CWE: CWE-264
Vulnerability description: libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236.

Project: Android

 std::string Backtrace::GetFunctionName(uintptr_t pc, uintptr_t* offset) {
   std::string func_name = GetFunctionNameRaw(pc, offset);
   return func_name;
 }
Commit message: None
CVE: CVE-2017-0817
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63522430.

Project: Android

OMX_ERRORTYPE SimpleSoftOMXComponent::useBuffer(
        OMX_BUFFERHEADERTYPE **header,
        OMX_U32 portIndex,
        OMX_PTR appPrivate,
        OMX_U32 size,
        OMX_U8 *ptr) {

     Mutex::Autolock autoLock(mLock);
     CHECK_LT(portIndex, mPorts.size());
 
    PortInfo *port = &mPorts.editItemAt(portIndex);
    if (size < port->mDef.nBufferSize) {
        ALOGE("b/63522430, Buffer size is too small.");
        android_errorWriteLog(0x534e4554, "63522430");
        return OMX_ErrorBadParameter;
    }

     *header = new OMX_BUFFERHEADERTYPE;
     (*header)->nSize = sizeof(OMX_BUFFERHEADERTYPE);
     (*header)->nVersion.s.nVersionMajor = 1;
 (*header)->nVersion.s.nVersionMinor = 0;
 (*header)->nVersion.s.nRevision = 0;
 (*header)->nVersion.s.nStep = 0;
 (*header)->pBuffer = ptr;
 (*header)->nAllocLen = size;
 (*header)->nFilledLen = 0;
 (*header)->nOffset = 0;
 (*header)->pAppPrivate = appPrivate;
 (*header)->pPlatformPrivate = NULL;
 (*header)->pInputPortPrivate = NULL;
 (*header)->pOutputPortPrivate = NULL;
 (*header)->hMarkTargetComponent = NULL;
 (*header)->pMarkData = NULL;
 (*header)->nTickCount = 0;
 (*header)->nTimeStamp = 0;
 (*header)->nFlags = 0;

     (*header)->nOutputPortIndex = portIndex;
     (*header)->nInputPortIndex = portIndex;
 
     CHECK(mState == OMX_StateLoaded || port->mDef.bEnabled == OMX_FALSE);
 
     CHECK_LT(port->mBuffers.size(), port->mDef.nBufferCountActual);

    port->mBuffers.push();

 BufferInfo *buffer =
 &port->mBuffers.editItemAt(port->mBuffers.size() - 1);

    buffer->mHeader = *header;
    buffer->mOwnedByUs = false;

 if (port->mBuffers.size() == port->mDef.nBufferCountActual) {
        port->mDef.bPopulated = OMX_TRUE;
        checkTransitions();
 }

 return OMX_ErrorNone;
}
Commit message: None
CVE: CVE-2017-0809
CWE: CWE-119
Vulnerability description: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128.

Project: Android

sp<ABuffer> decodeBase64(const AString &s) {
 size_t n = s.size();
 if ((n % 4) != 0) {
 return NULL;
 }

 size_t padding = 0;
 if (n >= 1 && s.c_str()[n - 1] == '=') {
        padding = 1;

 if (n >= 2 && s.c_str()[n - 2] == '=') {
            padding = 2;

 if (n >= 3 && s.c_str()[n - 3] == '=') {
                padding = 3;
 }
 }
 }

 size_t outLen = (n / 4) * 3 - padding;

    sp<ABuffer> buffer = new ABuffer(outLen);

 uint8_t *out = buffer->data();
 if (out == NULL || buffer->size() < outLen) {
 return NULL;
 }
 size_t j = 0;
 uint32_t accum = 0;
 for (size_t i = 0; i < n; ++i) {
 char c = s.c_str()[i];
 unsigned value;
 if (c >= 'A' && c <= 'Z') {
            value = c - 'A';
 } else if (c >= 'a' && c <= 'z') {
            value = 26 + c - 'a';
 } else if (c >= '0' && c <= '9') {
            value = 52 + c - '0';
 } else if (c == '+') {
            value = 62;
 } else if (c == '/') {
            value = 63;
 } else if (c != '=') {
 return NULL;
 } else {
 if (i < n - padding) {
 return NULL;
 }

            value = 0;
 }


         accum = (accum << 6) | value;
 
         if (((i + 1) % 4) == 0) {
            if (j < outLen) { out[j++] = (accum >> 16); }
             if (j < outLen) { out[j++] = (accum >> 8) & 0xff; }
             if (j < outLen) { out[j++] = accum & 0xff; }
 
            accum = 0;
 }
 }

 return buffer;
}
Commit message: None
CVE: CVE-2015-1529
CWE: CWE-190
Vulnerability description: Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.

Project: Android

status_t BnSoundTriggerHwService::onTransact(
 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
 switch(code) {

         case LIST_MODULES: {
             CHECK_INTERFACE(ISoundTriggerHwService, data, reply);
             unsigned int numModulesReq = data.readInt32();
            if (numModulesReq > MAX_ITEMS_PER_LIST) {
                numModulesReq = MAX_ITEMS_PER_LIST;
            }
             unsigned int numModules = numModulesReq;
             struct sound_trigger_module_descriptor *modules =
                     (struct sound_trigger_module_descriptor *)calloc(numModulesReq,
                                                    sizeof(struct sound_trigger_module_descriptor));
            if (modules == NULL) {
                reply->writeInt32(NO_MEMORY);
                reply->writeInt32(0);
                return NO_ERROR;
            }
             status_t status = listModules(modules, &numModules);
             reply->writeInt32(status);
             reply->writeInt32(numModules);
            ALOGV("LIST_MODULES status %d got numModules %d", status, numModules);

 if (status == NO_ERROR) {
 if (numModulesReq > numModules) {
                    numModulesReq = numModules;
 }
                reply->write(modules,
                             numModulesReq * sizeof(struct sound_trigger_module_descriptor));
 }
            free(modules);
 return NO_ERROR;
 }

 case ATTACH: {
            CHECK_INTERFACE(ISoundTriggerHwService, data, reply);
 sound_trigger_module_handle_t handle;
            data.read(&handle, sizeof(sound_trigger_module_handle_t));
            sp<ISoundTriggerClient> client =
                    interface_cast<ISoundTriggerClient>(data.readStrongBinder());
            sp<ISoundTrigger> module;
 status_t status = attach(handle, client, module);
            reply->writeInt32(status);
 if (module != 0) {
                reply->writeInt32(1);
                reply->writeStrongBinder(IInterface::asBinder(module));
 } else {
                reply->writeInt32(0);
 }
 return NO_ERROR;
 } break;

 case SET_CAPTURE_STATE: {
            CHECK_INTERFACE(ISoundTriggerHwService, data, reply);
            reply->writeInt32(setCaptureState((bool)data.readInt32()));
 return NO_ERROR;
 } break;

 default:
 return BBinder::onTransact(code, data, reply, flags);
 }
}
Commit message: None
CVE: CVE-2018-9511
CWE: CWE-909
Vulnerability description: In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288

Project: Android

netdutils::Status XfrmController::ipSecSetEncapSocketOwner(const android::base::unique_fd& socket,
 int newUid, uid_t callerUid) {
    ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__);

 const int fd = socket.get();
 struct stat info;
 if (fstat(fd, &info)) {
 return netdutils::statusFromErrno(errno, "Failed to stat socket file descriptor");
 }
 if (info.st_uid != callerUid) {
 return netdutils::statusFromErrno(EPERM, "fchown disabled for non-owner calls");
 }
 if (S_ISSOCK(info.st_mode) == 0) {
 return netdutils::statusFromErrno(EINVAL, "File descriptor was not a socket");

     }
 
     int optval;
    socklen_t optlen = sizeof(optval);
     netdutils::Status status =
         getSyscallInstance().getsockopt(Fd(socket), IPPROTO_UDP, UDP_ENCAP, &optval, &optlen);
     if (status != netdutils::status::ok) {
 return status;
 }
 if (optval != UDP_ENCAP_ESPINUDP && optval != UDP_ENCAP_ESPINUDP_NON_IKE) {
 return netdutils::statusFromErrno(EINVAL, "Socket did not have UDP-encap sockopt set");
 }
 if (fchown(fd, newUid, -1)) {
 return netdutils::statusFromErrno(errno, "Failed to fchown socket file descriptor");
 }

 return netdutils::status::ok;
}
Commit message: net: add checks to validate ring buffer pointers(CVE-2015-5279)

Ne2000 NIC uses ring buffer of NE2000_MEM_SIZE(49152)
bytes to process network packets. While receiving packets
via ne2000_receive() routine, a local 'index' variable
could exceed the ring buffer size, which could lead to a
memory buffer overflow. Added other checks at initialisation.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: P J P <pjp@fedoraproject.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 9bbdbc66e5765068dce76e9269dce4547afd8ad4)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
CVE: None
Vulnerability description: None

Project: qemu
File: ne2000.c

static int ne2000_buffer_full(NE2000State *s)
{
    int avail, index, boundary;

    index = s->curpag << 8;
    boundary = s->boundary << 8;
    if (index < boundary)
        avail = boundary - index;
    else
        avail = (s->stop - s->start) - (index - boundary);
    if (avail < (MAX_ETH_FRAME_SIZE + 4))
        return 1;
    return 0;
}
Commit message: Fixed out of boundary write (CVE-2018-14600).

The length value is interpreted as signed char on many systems
(depending on default signedness of char), which can lead to an out of
boundary write up to 128 bytes in front of the allocated storage, but
limited to NUL byte(s).

Casting the length value to unsigned char fixes the problem and allows
string values with up to 255 characters.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
CVE: CVE-2018-14600
CWE: CWE-787
Vulnerability description: An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.

Project: libx11
File: GetFPath.c

XFreeFontPath (char **list)
{
	if (list != NULL) {
		Xfree (list[0]-1);
		Xfree (list);
	}
	return 1;
}

Project: libx11
File: ListExt.c

XFreeExtensionList (char **list)
{
	if (list != NULL) {
	    Xfree (list[0]-1);
	    Xfree (list);
	}
	return 1;
}
Commit message: 9pfs: fix information leak in xattr read

9pfs uses g_malloc() to allocate the xattr memory space, if the guest
reads this memory before writing to it, this will leak host heap memory
to the guest. This patch avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
CVE: CVE-2016-9103
CWE: CWE-119
Vulnerability description: The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.

Project: qemu
File: 9p.c

static void coroutine_fn v9fs_link(void *opaque)
{
    V9fsPDU *pdu = opaque;
    int32_t dfid, oldfid;
    V9fsFidState *dfidp, *oldfidp;
    V9fsString name;
    size_t offset = 7;
    int err = 0;

    v9fs_string_init(&name);
    err = pdu_unmarshal(pdu, offset, "dds", &dfid, &oldfid, &name);
    if (err < 0) {
        goto out_nofid;
    }
    trace_v9fs_link(pdu->tag, pdu->id, dfid, oldfid, name.data);

    if (name_is_illegal(name.data)) {
        err = -ENOENT;
        goto out_nofid;
    }

    if (!strcmp(".", name.data) || !strcmp("..", name.data)) {
        err = -EEXIST;
        goto out_nofid;
    }

    dfidp = get_fid(pdu, dfid);
    if (dfidp == NULL) {
        err = -ENOENT;
        goto out_nofid;
    }

    oldfidp = get_fid(pdu, oldfid);
    if (oldfidp == NULL) {
        err = -ENOENT;
        goto out;
    }
    err = v9fs_co_link(pdu, oldfidp, dfidp, &name);
    if (!err) {
        err = offset;
    }
out:
    put_fid(pdu, dfidp);
out_nofid:
    v9fs_string_free(&name);
    pdu_complete(pdu, err);
}