From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35978) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YHHOJ-0000SI-54 for qemu-devel@nongnu.org; Fri, 30 Jan 2015 14:38:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YHHOF-0003X2-Pu for qemu-devel@nongnu.org; Fri, 30 Jan 2015 14:38:07 -0500 From: Kevin Wolf Date: Fri, 30 Jan 2015 20:37:55 +0100 Message-Id: <1422646675-17657-1-git-send-email-kwolf@redhat.com> Subject: [Qemu-devel] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, pbonzini@redhat.com, qemu-trivial@nongnu.org The size of the stack allocated host[] array didn't account for the terminating '\0' byte that sscanf() writes. Fix the array size. Signed-off-by: Kevin Wolf --- util/qemu-sockets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c index a76bb3c..aacf1fc 100644 --- a/util/qemu-sockets.c +++ b/util/qemu-sockets.c @@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp) { InetSocketAddress *addr; const char *optstr, *h; - char host[64]; + char host[65]; char port[33]; int to; int pos; -- 1.8.3.1