From: Chen Gang <gang.chen.5i5j@gmail.com>
To: agraf@suse.de, Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-ppc@nongnu.org, kvm@vger.kernel.org,
qemu-devel <qemu-devel@nongnu.org>
Subject: [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
Date: Wed, 15 Oct 2014 21:48:07 +0800 [thread overview]
Message-ID: <543E7B17.1050902@gmail.com> (raw)
strncat() will append additional '\0' to destination buffer, so need
additional 1 byte for it, or may cause memory overflow, just like other
area within QEMU have done.
And can use g_strdup_printf() instead of strncat(), which may be more
easier understanding.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
---
target-ppc/kvm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 66e7ce5..cea6a87 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len)
* format) */
static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
{
- char buf[PATH_MAX];
+ char buf[PATH_MAX], *tmp;
union {
uint32_t v32;
uint64_t v64;
@@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
return -1;
}
- strncat(buf, "/", sizeof(buf) - strlen(buf));
- strncat(buf, propname, sizeof(buf) - strlen(buf));
+ tmp = g_strdup_printf("%s/%s", buf, propname);
- f = fopen(buf, "rb");
+ f = fopen(tmp, "rb");
+ g_free(tmp);
if (!f) {
return -1;
}
--
1.9.3
WARNING: multiple messages have this Message-ID (diff)
From: Chen Gang <gang.chen.5i5j@gmail.com>
To: agraf@suse.de, Paolo Bonzini <pbonzini@redhat.com>
Cc: qemu-ppc@nongnu.org, qemu-devel <qemu-devel@nongnu.org>,
kvm@vger.kernel.org
Subject: [Qemu-devel] [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
Date: Wed, 15 Oct 2014 21:48:07 +0800 [thread overview]
Message-ID: <543E7B17.1050902@gmail.com> (raw)
strncat() will append additional '\0' to destination buffer, so need
additional 1 byte for it, or may cause memory overflow, just like other
area within QEMU have done.
And can use g_strdup_printf() instead of strncat(), which may be more
easier understanding.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
---
target-ppc/kvm.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 66e7ce5..cea6a87 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len)
* format) */
static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
{
- char buf[PATH_MAX];
+ char buf[PATH_MAX], *tmp;
union {
uint32_t v32;
uint64_t v64;
@@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
return -1;
}
- strncat(buf, "/", sizeof(buf) - strlen(buf));
- strncat(buf, propname, sizeof(buf) - strlen(buf));
+ tmp = g_strdup_printf("%s/%s", buf, propname);
- f = fopen(buf, "rb");
+ f = fopen(tmp, "rb");
+ g_free(tmp);
if (!f) {
return -1;
}
--
1.9.3
next reply other threads:[~2014-10-15 13:48 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-10-15 13:48 Chen Gang [this message]
2014-10-15 13:48 ` [Qemu-devel] [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat() Chen Gang
2014-10-15 13:52 ` Alexander Graf
2014-10-15 13:52 ` [Qemu-devel] " Alexander Graf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=543E7B17.1050902@gmail.com \
--to=gang.chen.5i5j@gmail.com \
--cc=agraf@suse.de \
--cc=kvm@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.