* [PATCH] libxl: fix the bug which will cause heap to break down
@ 2014-06-30 0:48 Liliang
2014-07-03 10:03 ` Ian Campbell
0 siblings, 1 reply; 3+ messages in thread
From: Liliang @ 2014-06-30 0:48 UTC (permalink / raw)
To: xen-devel
Cc: Li Liang, xen-devel, ian.jackson, ian.campbell, stefano.stabellini
From: Li Liang <liangx.z.li@intel.com>
If the JSON message contains more bytes than QMP_RECEIVE_BUFFER_SIZE,
this bug will break down the heap, that leads to core dump. One more
byte should be allocated to contain the appended null character.
Signed-off-by: Li Liang <liangx.z.li@intel.com>
---
tools/libxl/libxl_qmp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c
index 8433e42..5cc56b1 100644
--- a/tools/libxl/libxl_qmp.c
+++ b/tools/libxl/libxl_qmp.c
@@ -456,7 +456,7 @@ static int qmp_next(libxl__gc *gc, libxl__qmp_handler *qmp)
if (incomplete) {
size_t current_pos = s - incomplete;
incomplete = libxl__realloc(gc, incomplete,
- incomplete_size + rd);
+ incomplete_size + rd + 1);
strncat(incomplete + incomplete_size, qmp->buffer, rd);
s = incomplete + current_pos;
incomplete_size += rd;
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] libxl: fix the bug which will cause heap to break down
2014-06-30 0:48 [PATCH] libxl: fix the bug which will cause heap to break down Liliang
@ 2014-07-03 10:03 ` Ian Campbell
0 siblings, 0 replies; 3+ messages in thread
From: Ian Campbell @ 2014-07-03 10:03 UTC (permalink / raw)
To: Liliang; +Cc: xen-devel, xen-devel, ian.jackson, stefano.stabellini
On Mon, 2014-06-30 at 08:48 +0800, Liliang wrote:
> From: Li Liang <liangx.z.li@intel.com>
>
> If the JSON message contains more bytes than QMP_RECEIVE_BUFFER_SIZE,
> this bug will break down the heap, that leads to core dump. One more
> byte should be allocated to contain the appended null character.
>
> Signed-off-by: Li Liang <liangx.z.li@intel.com>
Acked + applied. Thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] libxl: fix the bug which will cause heap to break down
@ 2014-06-27 6:21 Liliang
0 siblings, 0 replies; 3+ messages in thread
From: Liliang @ 2014-06-27 6:21 UTC (permalink / raw)
To: xen-devel; +Cc: Li Liang, ian.campbell
From: Li Liang <liangx.z.li@intel.com>
If the JSON message contains more bytes than QMP_RECEIVE_BUFFER_SIZE,
this bug will break down the heap, that leads to core dump. One more
byte should be allocated to contain the appended null character.
Signed-off-by: Li Liang <liangx.z.li@intel.com>
---
tools/libxl/libxl_qmp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c
index 8433e42..5cc56b1 100644
--- a/tools/libxl/libxl_qmp.c
+++ b/tools/libxl/libxl_qmp.c
@@ -456,7 +456,7 @@ static int qmp_next(libxl__gc *gc, libxl__qmp_handler *qmp)
if (incomplete) {
size_t current_pos = s - incomplete;
incomplete = libxl__realloc(gc, incomplete,
- incomplete_size + rd);
+ incomplete_size + rd + 1);
strncat(incomplete + incomplete_size, qmp->buffer, rd);
s = incomplete + current_pos;
incomplete_size += rd;
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-07-03 10:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-30 0:48 [PATCH] libxl: fix the bug which will cause heap to break down Liliang
2014-07-03 10:03 ` Ian Campbell
-- strict thread matches above, loose matches on Subject: below --
2014-06-27 6:21 Liliang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.