NuKVM/libvirt
3
0
Fork 0
mirror of https://github.com/libvirt/libvirt.git synced 2026-08-03 09:53:13 -05:00
Code Issues Packages Projects Releases Wiki Activity

tools: check for failure decoding secret base64 value

Browse Source 
The g_base64_decode function will return a valid pointer, but with
length of zero when it fails to decode data. Report an error in that
scenario, so avoid a later more obsecure error.

eg old behaviour

  # virsh secret-set-value  f52a81b2-424e-490c-823d-6bd4235bc507 foo
  warning: Passing secret value as command-line argument is insecure!
  error: Failed to set secret value
  error: value in virSecretSetValue must not be NULL

new behaviour

  # /home/berrange/virsh secret-set-value  f52a81b2-424e-490c-823d-6bd4235bc507 foo
  warning: Passing secret value as command-line argument is insecure!
  error: Secret value is not valid base64

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé
2026-01-06 10:59:46 +00:00
parent 2d65cdeba8
commit b3ede6618d
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/virsh-secret.c
+5
View File
@@ -267,6 +267,11 @@ cmdSecretSetValue(vshControl *ctl, const vshCmd *cmd)
secret_val = (char *) g_base64_decode(tmp, &secret_len);
virSecureErase(tmp, tmp_len);
if (!secret_len) {
vshError(ctl, "%s", _("Secret value is not valid base64"));
return false;
}
}
res = virSecretSetValue(secret, (unsigned char *) secret_val, secret_len, 0);