All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
@ 2014-10-15 13:48 ` Chen Gang
  0 siblings, 0 replies; 4+ messages in thread
From: Chen Gang @ 2014-10-15 13:48 UTC (permalink / raw)
  To: agraf, Paolo Bonzini; +Cc: qemu-ppc, kvm, qemu-devel

strncat() will append additional '\0' to destination buffer, so need
additional 1 byte for it, or may cause memory overflow, just like other
area within QEMU have done.

And can use g_strdup_printf() instead of strncat(), which may be more
easier understanding.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
---
 target-ppc/kvm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 66e7ce5..cea6a87 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len)
  * format) */
 static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
 {
-    char buf[PATH_MAX];
+    char buf[PATH_MAX], *tmp;
     union {
         uint32_t v32;
         uint64_t v64;
@@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
         return -1;
     }
 
-    strncat(buf, "/", sizeof(buf) - strlen(buf));
-    strncat(buf, propname, sizeof(buf) - strlen(buf));
+    tmp = g_strdup_printf("%s/%s", buf, propname);
 
-    f = fopen(buf, "rb");
+    f = fopen(tmp, "rb");
+    g_free(tmp);
     if (!f) {
         return -1;
     }
-- 
1.9.3

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* [Qemu-devel] [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
@ 2014-10-15 13:48 ` Chen Gang
  0 siblings, 0 replies; 4+ messages in thread
From: Chen Gang @ 2014-10-15 13:48 UTC (permalink / raw)
  To: agraf, Paolo Bonzini; +Cc: qemu-ppc, qemu-devel, kvm

strncat() will append additional '\0' to destination buffer, so need
additional 1 byte for it, or may cause memory overflow, just like other
area within QEMU have done.

And can use g_strdup_printf() instead of strncat(), which may be more
easier understanding.

Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
---
 target-ppc/kvm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c
index 66e7ce5..cea6a87 100644
--- a/target-ppc/kvm.c
+++ b/target-ppc/kvm.c
@@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len)
  * format) */
 static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
 {
-    char buf[PATH_MAX];
+    char buf[PATH_MAX], *tmp;
     union {
         uint32_t v32;
         uint64_t v64;
@@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
         return -1;
     }
 
-    strncat(buf, "/", sizeof(buf) - strlen(buf));
-    strncat(buf, propname, sizeof(buf) - strlen(buf));
+    tmp = g_strdup_printf("%s/%s", buf, propname);
 
-    f = fopen(buf, "rb");
+    f = fopen(tmp, "rb");
+    g_free(tmp);
     if (!f) {
         return -1;
     }
-- 
1.9.3

^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
  2014-10-15 13:48 ` [Qemu-devel] " Chen Gang
@ 2014-10-15 13:52   ` Alexander Graf
  -1 siblings, 0 replies; 4+ messages in thread
From: Alexander Graf @ 2014-10-15 13:52 UTC (permalink / raw)
  To: Chen Gang, Paolo Bonzini; +Cc: qemu-ppc, kvm, qemu-devel



On 15.10.14 15:48, Chen Gang wrote:
> strncat() will append additional '\0' to destination buffer, so need
> additional 1 byte for it, or may cause memory overflow, just like other
> area within QEMU have done.
> 
> And can use g_strdup_printf() instead of strncat(), which may be more
> easier understanding.
> 
> Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>

Thanks, applied to ppc-next. And sorry for not replying earlier.


Alex

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat()
@ 2014-10-15 13:52   ` Alexander Graf
  0 siblings, 0 replies; 4+ messages in thread
From: Alexander Graf @ 2014-10-15 13:52 UTC (permalink / raw)
  To: Chen Gang, Paolo Bonzini; +Cc: qemu-ppc, qemu-devel, kvm



On 15.10.14 15:48, Chen Gang wrote:
> strncat() will append additional '\0' to destination buffer, so need
> additional 1 byte for it, or may cause memory overflow, just like other
> area within QEMU have done.
> 
> And can use g_strdup_printf() instead of strncat(), which may be more
> easier understanding.
> 
> Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>

Thanks, applied to ppc-next. And sorry for not replying earlier.


Alex

^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-10-15 13:52 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-10-15 13:48 [PATCH v2] target-ppc: kvm: Fix memory overflow issue about strncat() Chen Gang
2014-10-15 13:48 ` [Qemu-devel] " Chen Gang
2014-10-15 13:52 ` Alexander Graf
2014-10-15 13:52   ` [Qemu-devel] " Alexander Graf

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.