From: Fam Zheng <f...@redhat.com>
An extra 'p++' after while loop when *p == '\n' will move p to unknown
data position, risking parsing junk data or memory access violation.
Cc: qemu-sta...@nongnu.org
Signed-off-by: Fam Zheng <f...@redhat.com>
Signed-off-by: Kevin Wolf <kw...@redhat.com>
---
block/vmdk.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/block/vmdk.c b/block/vmdk.c
index 709aa3d..5a9f278 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -772,10 +772,13 @@ static int vmdk_parse_extents(const char *desc,
BlockDriverState *bs,
}
next_line:
/* move to next line */
- while (*p && *p != '\n') {
+ while (*p) {
+ if (*p == '\n') {
+ p++;
+ break;
+ }
p++;
}
- p++;
}
return 0;
}
--
1.8.1.4
