[PATCH] readline: Fix possible array index out of bounds in readline_hist_add()

[PATCH] readline: Fix possible array index out of bounds in readline_hist_add()

[Alex Chen]

When the 'cmdline' is the last entry in 'rs->history' array, there is
no need to put this entry to the end of the array, partly because it is
the last entry, and partly because the next operition will lead to array
index out of bounds.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
 util/readline.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/util/readline.c b/util/readline.c
index e534460da6..f1ac6e4769 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -240,6 +240,9 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
+            if (idx == READLINE_MAX_CMDS - 1) {
+                return;
+            }
             new_entry = hist_entry;
             /* Put this entry at the end of history */
             memmove(&rs->history[idx], &rs->history[idx + 1],
-- 
2.19.1

Re: [PATCH] readline: Fix possible array index out of bounds in readline_hist_add()

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 582 bytes --]

On Thu, Dec 03, 2020 at 01:50:43PM +0000, Alex Chen wrote:
> When the 'cmdline' is the last entry in 'rs->history' array, there is
> no need to put this entry to the end of the array, partly because it is
> the last entry, and partly because the next operition will lead to array
> index out of bounds.
> 
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Alex Chen <alex.chen@huawei.com>
> ---
>  util/readline.c | 3 +++
>  1 file changed, 3 insertions(+)

Thanks, applied to my block tree:
https://gitlab.com/stefanha/qemu/commits/block

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]