* [Qemu-devel] [PATCH 2/3] check-qdict: Fix possible crash
@ 2011-01-21 21:50 Stefan Weil
2011-02-20 17:44 ` Aurelien Jarno
0 siblings, 1 reply; 2+ messages in thread
From: Stefan Weil @ 2011-01-21 21:50 UTC (permalink / raw)
To: QEMU Developers
This warning is reported by cppcheck:
check-qdict.c:270: warning: scanf without field width limits can crash with huge input data
Fix it by limiting the field widths to 127 (both key and value take
127 characters + a terminating '\0' byte).
Signed-off-by: Stefan Weil <weil@mail.berlios.de>
---
check-qdict.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/check-qdict.c b/check-qdict.c
index 6afce5a..ecc7fd7 100644
--- a/check-qdict.c
+++ b/check-qdict.c
@@ -267,8 +267,9 @@ static QString *read_line(FILE *file, char *key)
{
char value[128];
- if (fscanf(file, "%s%s", key, value) == EOF)
+ if (fscanf(file, "%127s%127s", key, value) == EOF) {
return NULL;
+ }
remove_dots(key);
return qstring_from_str(value);
}
--
1.7.2.3
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [PATCH 2/3] check-qdict: Fix possible crash
2011-01-21 21:50 [Qemu-devel] [PATCH 2/3] check-qdict: Fix possible crash Stefan Weil
@ 2011-02-20 17:44 ` Aurelien Jarno
0 siblings, 0 replies; 2+ messages in thread
From: Aurelien Jarno @ 2011-02-20 17:44 UTC (permalink / raw)
To: Stefan Weil; +Cc: QEMU Developers
On Fri, Jan 21, 2011 at 10:50:30PM +0100, Stefan Weil wrote:
> This warning is reported by cppcheck:
>
> check-qdict.c:270: warning: scanf without field width limits can crash with huge input data
>
> Fix it by limiting the field widths to 127 (both key and value take
> 127 characters + a terminating '\0' byte).
>
> Signed-off-by: Stefan Weil <weil@mail.berlios.de>
> ---
> check-qdict.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
Thanks, applied.
> diff --git a/check-qdict.c b/check-qdict.c
> index 6afce5a..ecc7fd7 100644
> --- a/check-qdict.c
> +++ b/check-qdict.c
> @@ -267,8 +267,9 @@ static QString *read_line(FILE *file, char *key)
> {
> char value[128];
>
> - if (fscanf(file, "%s%s", key, value) == EOF)
> + if (fscanf(file, "%127s%127s", key, value) == EOF) {
> return NULL;
> + }
> remove_dots(key);
> return qstring_from_str(value);
> }
> --
> 1.7.2.3
>
>
>
--
Aurelien Jarno GPG: 1024D/F1BCDB73
aurelien@aurel32.net http://www.aurel32.net
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-02-20 18:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-01-21 21:50 [Qemu-devel] [PATCH 2/3] check-qdict: Fix possible crash Stefan Weil
2011-02-20 17:44 ` Aurelien Jarno
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).