esp: check command buffer length before write(CVE-2016-4439)
[qemu/ar7.git] / tests / test-filter-mirror.c
blobf60bf2adbe042348058fc2f776de0e9942d76b01
1 /*
2 * QTest testcase for filter-mirror
4 * Copyright (c) 2016 FUJITSU LIMITED
5 * Author: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
7 * This work is licensed under the terms of the GNU GPL, version 2 or
8 * later. See the COPYING file in the top-level directory.
9 */
11 #include "qemu/osdep.h"
12 #include <glib.h>
13 #include "libqtest.h"
14 #include "qemu/iov.h"
15 #include "qemu/sockets.h"
16 #include "qemu/error-report.h"
17 #include "qemu/main-loop.h"
19 static void test_mirror(void)
21 #ifndef _WIN32
22 /* socketpair(PF_UNIX) which does not exist on windows */
24 int send_sock[2], recv_sock;
25 char *cmdline;
26 uint32_t ret = 0, len = 0;
27 char send_buf[] = "Hello! filter-mirror~";
28 char sock_path[] = "filter-mirror.XXXXXX";
29 char *recv_buf;
30 uint32_t size = sizeof(send_buf);
31 size = htonl(size);
33 ret = socketpair(PF_UNIX, SOCK_STREAM, 0, send_sock);
34 g_assert_cmpint(ret, !=, -1);
36 ret = mkstemp(sock_path);
37 g_assert_cmpint(ret, !=, -1);
39 cmdline = g_strdup_printf("-netdev socket,id=qtest-bn0,fd=%d "
40 "-device e1000,netdev=qtest-bn0,id=qtest-e0 "
41 "-chardev socket,id=mirror0,path=%s,server,nowait "
42 "-object filter-mirror,id=qtest-f0,netdev=qtest-bn0,queue=tx,outdev=mirror0 "
43 , send_sock[1], sock_path);
44 qtest_start(cmdline);
45 g_free(cmdline);
47 recv_sock = unix_connect(sock_path, NULL);
48 g_assert_cmpint(recv_sock, !=, -1);
50 struct iovec iov[] = {
52 .iov_base = &size,
53 .iov_len = sizeof(size),
54 }, {
55 .iov_base = send_buf,
56 .iov_len = sizeof(send_buf),
60 /* send a qmp command to guarantee that 'connected' is setting to true. */
61 qmp("{ 'execute' : 'query-status'}");
62 ret = iov_send(send_sock[0], iov, 2, 0, sizeof(size) + sizeof(send_buf));
63 g_assert_cmpint(ret, ==, sizeof(send_buf) + sizeof(size));
64 close(send_sock[0]);
66 ret = qemu_recv(recv_sock, &len, sizeof(len), 0);
67 g_assert_cmpint(ret, ==, sizeof(len));
68 len = ntohl(len);
70 g_assert_cmpint(len, ==, sizeof(send_buf));
71 recv_buf = g_malloc(len);
72 ret = qemu_recv(recv_sock, recv_buf, len, 0);
73 g_assert_cmpstr(recv_buf, ==, send_buf);
75 g_free(recv_buf);
76 close(recv_sock);
77 unlink(sock_path);
79 #endif
82 int main(int argc, char **argv)
84 int ret;
86 g_test_init(&argc, &argv, NULL);
88 qtest_add_func("/netfilter/mirror", test_mirror);
89 ret = g_test_run();
90 qtest_end();
92 return ret;