From: Cornelia Huck <cohuck@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: Halil Pasic <pasic@linux.ibm.com>,
qemu-s390x@nongnu.org, Cornelia Huck <cohuck@redhat.com>,
qemu-devel@nongnu.org, David Hildenbrand <david@redhat.com>
Subject: [PULL 1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter
Date: Fri, 31 Jul 2020 10:55:03 +0200 [thread overview]
Message-ID: <20200731085503.9008-2-cohuck@redhat.com> (raw)
In-Reply-To: <20200731085503.9008-1-cohuck@redhat.com>
From: Halil Pasic <pasic@linux.ibm.com>
As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
reads one past of the end of ms->loadparm, so g_memdup() can not be used
here.
Let's use g_strndup instead!
Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter")
Fixes: Coverity CID 1431058
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
hw/s390x/s390-virtio-ccw.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 403d30e13bca..e72c61d2eae0 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -701,12 +701,9 @@ bool hpage_1m_allowed(void)
static char *machine_get_loadparm(Object *obj, Error **errp)
{
S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
- char *loadparm_str;
/* make a NUL-terminated string */
- loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
- loadparm_str[sizeof(ms->loadparm)] = 0;
- return loadparm_str;
+ return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm));
}
static void machine_set_loadparm(Object *obj, const char *val, Error **errp)
--
2.25.4
next prev parent reply other threads:[~2020-07-31 8:56 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-31 8:55 [PULL 0/1] another s390x fix Cornelia Huck
2020-07-31 8:55 ` Cornelia Huck [this message]
2020-07-31 10:27 ` Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200731085503.9008-2-cohuck@redhat.com \
--to=cohuck@redhat.com \
--cc=david@redhat.com \
--cc=pasic@linux.ibm.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-s390x@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).