From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:46121) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RNLTy-0001Ve-Ep for qemu-devel@nongnu.org; Mon, 07 Nov 2011 04:27:12 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RNLTx-0002C6-Hb for qemu-devel@nongnu.org; Mon, 07 Nov 2011 04:27:10 -0500 Received: from mtagate3.uk.ibm.com ([194.196.100.163]:37805) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RNLTx-0002Bn-AU for qemu-devel@nongnu.org; Mon, 07 Nov 2011 04:27:09 -0500 Received: from d06nrmr1307.portsmouth.uk.ibm.com (d06nrmr1307.portsmouth.uk.ibm.com [9.149.38.129]) by mtagate3.uk.ibm.com (8.13.1/8.13.1) with ESMTP id pA79R8pf001798 for ; Mon, 7 Nov 2011 09:27:08 GMT Received: from d06av06.portsmouth.uk.ibm.com (d06av06.portsmouth.uk.ibm.com [9.149.37.217]) by d06nrmr1307.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pA79R7kQ2199622 for ; Mon, 7 Nov 2011 09:27:07 GMT Received: from d06av06.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av06.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pA7GR7jm020769 for ; Mon, 7 Nov 2011 09:27:07 -0700 From: Stefan Hajnoczi Date: Mon, 7 Nov 2011 09:26:59 +0000 Message-Id: <1320658020-4374-5-git-send-email-stefanha@linux.vnet.ibm.com> In-Reply-To: <1320658020-4374-1-git-send-email-stefanha@linux.vnet.ibm.com> References: <1320658020-4374-1-git-send-email-stefanha@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 4/5] readline: Fix buffer overrun on re-add to history List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Anthony Liguori , Markus Armbruster , Stefan Hajnoczi From: Markus Armbruster readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_entry and the hole right after it. Since the function assigns to rs->hist_entry in time, the bug has no ill effects for me. Spotted by Coverity. Signed-off-by: Markus Armbruster Signed-off-by: Stefan Hajnoczi --- readline.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/readline.c b/readline.c index 6a3160a..a6c0039 100644 --- a/readline.c +++ b/readline.c @@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline) new_entry = hist_entry; /* Put this entry at the end of history */ memmove(&rs->history[idx], &rs->history[idx + 1], - (READLINE_MAX_CMDS - idx + 1) * sizeof(char *)); + (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *)); rs->history[READLINE_MAX_CMDS - 1] = NULL; for (; idx < READLINE_MAX_CMDS; idx++) { if (rs->history[idx] == NULL) -- 1.7.7.1