diff options
| author | Markus Armbruster <armbru@redhat.com> | 2011-11-04 11:10:01 +0100 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> | 2011-11-07 08:03:49 +0000 |
| commit | 8af42882a51c632a14d77277df0740f1aa8c958a (patch) | |
| tree | 5dd88832b4fabe453fc84169da51f730b22a7718 /hw/xen_platform.c | |
| parent | 47e8dd8fe9d83e8b51d40c2b87d7983bd0a78206 (diff) | |
| download | focaccia-qemu-8af42882a51c632a14d77277df0740f1aa8c958a.tar.gz focaccia-qemu-8af42882a51c632a14d77277df0740f1aa8c958a.zip | |
readline: Fix buffer overrun on re-add to history
readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_entry and the hole right after it. Since the function assigns to rs->hist_entry in time, the bug has no ill effects for me. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Diffstat (limited to 'hw/xen_platform.c')
0 files changed, 0 insertions, 0 deletions