search

lima-vm / socket_vmnet

vmnet.framework support for unmodified rootless QEMU (no dependency on VDE)
Apache License 2.0
101 stars 17 forks source link

client segfault with crafted arguments #73

Open tamird opened 2 days ago

tamird commented 2 days ago 
tamird@Mac socket_vmnet % $(brew --prefix socket_vmnet)/bin/socket_vmnet_client $(brew --prefix)/var/run/socket_vmnet --               
zsh: segmentation fault  $(brew --prefix socket_vmnet)/bin/socket_vmnet_client  --

this is caused by the special handling of --: https://github.com/lima-vm/socket_vmnet/blob/f486d475d4842bbddfe8f66ba09f7d1cb10cfbed/client/main.c#L36

I think the cleanest thing is to remove this. Typically -- is used to separate positional arguments from flags e.g. <cmd> --foo --bar -- pos1 pos2 but that is not how it works for the client.

nirs commented 2 days ago

-- is typically used to separate the command arguments from sub command arguments. For example kubectl exec pod -- command to exec inside the pod.

This is not really needed in the client, since our command is trivial, but it is nice to support this since users may already using this format. You are correct that the issue is not considering the special -- option - when we consume it we need to decrease argc, and fail if no argument left for execve().