* [Qemu-trivial] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse()
@ 2015-01-30 19:37 ` Kevin Wolf
0 siblings, 0 replies; 6+ messages in thread
From: Kevin Wolf @ 2015-01-30 19:37 UTC (permalink / raw)
To: qemu-devel; +Cc: kwolf, pbonzini, qemu-trivial
The size of the stack allocated host[] array didn't account for the
terminating '\0' byte that sscanf() writes. Fix the array size.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
util/qemu-sockets.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index a76bb3c..aacf1fc 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
{
InetSocketAddress *addr;
const char *optstr, *h;
- char host[64];
+ char host[65];
char port[33];
int to;
int pos;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [Qemu-devel] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse()
@ 2015-01-30 19:37 ` Kevin Wolf
0 siblings, 0 replies; 6+ messages in thread
From: Kevin Wolf @ 2015-01-30 19:37 UTC (permalink / raw)
To: qemu-devel; +Cc: kwolf, pbonzini, qemu-trivial
The size of the stack allocated host[] array didn't account for the
terminating '\0' byte that sscanf() writes. Fix the array size.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
util/qemu-sockets.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index a76bb3c..aacf1fc 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
{
InetSocketAddress *addr;
const char *optstr, *h;
- char host[64];
+ char host[65];
char port[33];
int to;
int pos;
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Qemu-trivial] [Qemu-devel] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse()
2015-01-30 19:37 ` [Qemu-devel] " Kevin Wolf
@ 2015-01-30 20:06 ` John Snow
-1 siblings, 0 replies; 6+ messages in thread
From: John Snow @ 2015-01-30 20:06 UTC (permalink / raw)
To: Kevin Wolf, qemu-devel; +Cc: qemu-trivial, pbonzini
On 01/30/2015 02:37 PM, Kevin Wolf wrote:
> The size of the stack allocated host[] array didn't account for the
> terminating '\0' byte that sscanf() writes. Fix the array size.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
> util/qemu-sockets.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> index a76bb3c..aacf1fc 100644
> --- a/util/qemu-sockets.c
> +++ b/util/qemu-sockets.c
> @@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
> {
> InetSocketAddress *addr;
> const char *optstr, *h;
> - char host[64];
> + char host[65];
> char port[33];
> int to;
> int pos;
>
You don't really need reviews for trivial, right?
*shrug*
Reviewed-by: John Snow <jsnow@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [Qemu-devel] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse()
@ 2015-01-30 20:06 ` John Snow
0 siblings, 0 replies; 6+ messages in thread
From: John Snow @ 2015-01-30 20:06 UTC (permalink / raw)
To: Kevin Wolf, qemu-devel; +Cc: qemu-trivial, pbonzini
On 01/30/2015 02:37 PM, Kevin Wolf wrote:
> The size of the stack allocated host[] array didn't account for the
> terminating '\0' byte that sscanf() writes. Fix the array size.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
> util/qemu-sockets.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> index a76bb3c..aacf1fc 100644
> --- a/util/qemu-sockets.c
> +++ b/util/qemu-sockets.c
> @@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
> {
> InetSocketAddress *addr;
> const char *optstr, *h;
> - char host[64];
> + char host[65];
> char port[33];
> int to;
> int pos;
>
You don't really need reviews for trivial, right?
*shrug*
Reviewed-by: John Snow <jsnow@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-trivial] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse()
2015-01-30 19:37 ` [Qemu-devel] " Kevin Wolf
@ 2015-02-07 9:08 ` Michael Tokarev
-1 siblings, 0 replies; 6+ messages in thread
From: Michael Tokarev @ 2015-02-07 9:08 UTC (permalink / raw)
To: Kevin Wolf, qemu-devel; +Cc: qemu-trivial, pbonzini
30.01.2015 22:37, Kevin Wolf wrote:
> The size of the stack allocated host[] array didn't account for the
> terminating '\0' byte that sscanf() writes. Fix the array size.
Applied to -trivial, thank you!
/mjt
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-02-07 9:09 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-01-30 19:37 [Qemu-trivial] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse() Kevin Wolf
2015-01-30 19:37 ` [Qemu-devel] " Kevin Wolf
2015-01-30 20:06 ` [Qemu-trivial] " John Snow
2015-01-30 20:06 ` John Snow
2015-02-07 9:08 ` [Qemu-trivial] " Michael Tokarev
2015-02-07 9:08 ` [Qemu-devel] " Michael Tokarev
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.