diff options
| author | Halil Pasic <pasic@linux.ibm.com> | 2020-07-30 15:01:56 +0200 |
|---|---|---|
| committer | Cornelia Huck <cohuck@redhat.com> | 2020-07-30 16:53:34 +0200 |
| commit | 148d25e0f6ad1dc3bd6aace092d65262d4217ec6 (patch) | |
| tree | 15e6ed3e53d141379516d66acc46b3d615a32b6d | |
| parent | 5772f2b1fc5d00e7e04e01fa28e9081d6550440a (diff) | |
| download | focaccia-qemu-148d25e0f6ad1dc3bd6aace092d65262d4217ec6.tar.gz focaccia-qemu-148d25e0f6ad1dc3bd6aace092d65262d4217ec6.zip | |
s390x/s390-virtio-ccw: fix off-by-one in loadparm getter
As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
reads one past of the end of ms->loadparm, so g_memdup() can not be used
here.
Let's use g_strndup instead!
Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter")
Fixes: Coverity CID 1431058
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
| -rw-r--r-- | hw/s390x/s390-virtio-ccw.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 403d30e13b..e72c61d2ea 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -701,12 +701,9 @@ bool hpage_1m_allowed(void) static char *machine_get_loadparm(Object *obj, Error **errp) { S390CcwMachineState *ms = S390_CCW_MACHINE(obj); - char *loadparm_str; /* make a NUL-terminated string */ - loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1); - loadparm_str[sizeof(ms->loadparm)] = 0; - return loadparm_str; + return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm)); } static void machine_set_loadparm(Object *obj, const char *val, Error **errp) |