SYS-OSS/FRET-qemu
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

s390x/s390-virtio-ccw: fix off-by-one in loadparm getter

Browse Source 
As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
reads one past of the end of ms->loadparm, so g_memdup() can not be used
here.

Let's use g_strndup instead!

Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter")
Fixes: Coverity CID 1431058
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
This commit is contained in:
Halil Pasic 2020-07-30 15:01:56 +02:00 committed by Cornelia Huck
parent 5772f2b1fc
commit 148d25e0f6
1 changed files with 1 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
hw/s390x/s390-virtio-ccw.c
View File

@ -701,12 +701,9 @@ bool hpage_1m_allowed(void)
static char *machine_get_loadparm(Object *obj, Error **errp) static char *machine_get_loadparm(Object *obj, Error **errp)
{ {
S390CcwMachineState *ms = S390_CCW_MACHINE(obj); S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
char *loadparm_str;
/* make a NUL-terminated string */ /* make a NUL-terminated string */
loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1); return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm));
loadparm_str[sizeof(ms->loadparm)] = 0;
return loadparm_str;
} }
static void machine_set_loadparm(Object *obj, const char *val, Error **errp) static void machine_set_loadparm(Object *obj, const char *val, Error **errp)