On Wed, Jul 29, 2020 at 03:02:22PM +0200, Halil Pasic wrote:
> As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
> reads one past of the end of ms->loadparm, so g_memdup() can not be used
> here.
>
> Let's use malloc and memcpy instead!
>
> Fixes: d664548328 ("s390x/s390-virtio-ccw: fix loadparm property getter")
> Fixes: Coverity CID 1431058
> Reported-by: Peter Maydell <peter.mayd...@linaro.org>
> Signed-off-by: Halil Pasic <pa...@linux.ibm.com>
> ---
> hw/s390x/s390-virtio-ccw.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
> index 403d30e13b..8b7bac0392 100644
> --- a/hw/s390x/s390-virtio-ccw.c
> +++ b/hw/s390x/s390-virtio-ccw.c
> @@ -704,8 +704,8 @@ static char *machine_get_loadparm(Object *obj, Error
> **errp)
> char *loadparm_str;
>
> /* make a NUL-terminated string */
> - loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
> - loadparm_str[sizeof(ms->loadparm)] = 0;
> + loadparm_str = g_malloc0(sizeof(ms->loadparm) + 1);
> + memcpy(loadparm_str, ms->loadparm, sizeof(ms->loadparm));
I feel like g_strndup(ms->loadparm, sizeof(ms->loadparm))
is what should have been used here.
It copies N characters, but allocates N+1 adding a trailing NUL
which are the semantic we wanted here.
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
