QEMU-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PULL 0/1] another s390x fix
@ 2020-07-31  8:55 Cornelia Huck
  2020-07-31  8:55 ` [PULL 1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter Cornelia Huck
  2020-07-31 10:27 ` [PULL 0/1] another s390x fix Peter Maydell
  0 siblings, 2 replies; 3+ messages in thread
From: Cornelia Huck @ 2020-07-31  8:55 UTC (permalink / raw)
  To: Peter Maydell; +Cc: qemu-s390x, Cornelia Huck, qemu-devel

The following changes since commit 5772f2b1fc5d00e7e04e01fa28e9081d6550440a:

  Update version for v5.1.0-rc2 release (2020-07-28 21:51:03 +0100)

are available in the Git repository at:

  https://github.com/cohuck/qemu tags/s390x-20200731

for you to fetch changes up to 148d25e0f6ad1dc3bd6aace092d65262d4217ec6:

  s390x/s390-virtio-ccw: fix off-by-one in loadparm getter (2020-07-30 16:53:34 +0200)

----------------------------------------------------------------
Fix a problem introduced in a recent fix.

----------------------------------------------------------------

Halil Pasic (1):
  s390x/s390-virtio-ccw: fix off-by-one in loadparm getter

 hw/s390x/s390-virtio-ccw.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

-- 
2.25.4



^ permalink raw reply	[flat|nested] 3+ messages in thread

* [PULL 1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter
  2020-07-31  8:55 [PULL 0/1] another s390x fix Cornelia Huck
@ 2020-07-31  8:55 ` Cornelia Huck
  2020-07-31 10:27 ` [PULL 0/1] another s390x fix Peter Maydell
  1 sibling, 0 replies; 3+ messages in thread
From: Cornelia Huck @ 2020-07-31  8:55 UTC (permalink / raw)
  To: Peter Maydell
  Cc: Halil Pasic, qemu-s390x, Cornelia Huck, qemu-devel, David Hildenbrand

From: Halil Pasic <pasic@linux.ibm.com>

As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
reads one past of the end of ms->loadparm, so g_memdup() can not be used
here.

Let's use g_strndup instead!

Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter")
Fixes: Coverity CID 1431058
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 403d30e13bca..e72c61d2eae0 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -701,12 +701,9 @@ bool hpage_1m_allowed(void)
 static char *machine_get_loadparm(Object *obj, Error **errp)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
-    char *loadparm_str;
 
     /* make a NUL-terminated string */
-    loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
-    loadparm_str[sizeof(ms->loadparm)] = 0;
-    return loadparm_str;
+    return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm));
 }
 
 static void machine_set_loadparm(Object *obj, const char *val, Error **errp)
-- 
2.25.4



^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PULL 0/1] another s390x fix
  2020-07-31  8:55 [PULL 0/1] another s390x fix Cornelia Huck
  2020-07-31  8:55 ` [PULL 1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter Cornelia Huck
@ 2020-07-31 10:27 ` Peter Maydell
  1 sibling, 0 replies; 3+ messages in thread
From: Peter Maydell @ 2020-07-31 10:27 UTC (permalink / raw)
  To: Cornelia Huck; +Cc: qemu-s390x, QEMU Developers

On Fri, 31 Jul 2020 at 09:55, Cornelia Huck <cohuck@redhat.com> wrote:
>
> The following changes since commit 5772f2b1fc5d00e7e04e01fa28e9081d6550440a:
>
>   Update version for v5.1.0-rc2 release (2020-07-28 21:51:03 +0100)
>
> are available in the Git repository at:
>
>   https://github.com/cohuck/qemu tags/s390x-20200731
>
> for you to fetch changes up to 148d25e0f6ad1dc3bd6aace092d65262d4217ec6:
>
>   s390x/s390-virtio-ccw: fix off-by-one in loadparm getter (2020-07-30 16:53:34 +0200)
>
> ----------------------------------------------------------------
> Fix a problem introduced in a recent fix.
>
> ----------------------------------------------------------------


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/5.1
for any user-visible changes.

-- PMM


^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-31  8:55 [PULL 0/1] another s390x fix Cornelia Huck
2020-07-31  8:55 ` [PULL 1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter Cornelia Huck
2020-07-31 10:27 ` [PULL 0/1] another s390x fix Peter Maydell

QEMU-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/qemu-devel/0 qemu-devel/git/0.git
	git clone --mirror https://lore.kernel.org/qemu-devel/1 qemu-devel/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 qemu-devel qemu-devel/ https://lore.kernel.org/qemu-devel \
		qemu-devel@nongnu.org
	public-inbox-index qemu-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.nongnu.qemu-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git