From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:42140)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1UZkgQ-0002Jx-L4
	for qemu-devel@nongnu.org; Tue, 07 May 2013 12:24:07 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1UZkgL-00040E-R5
	for qemu-devel@nongnu.org; Tue, 07 May 2013 12:24:06 -0400
Received: from mx1.redhat.com ([209.132.183.28]:2949)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1UZkgL-0003zt-KX
	for qemu-devel@nongnu.org; Tue, 07 May 2013 12:24:01 -0400
Date: Tue, 7 May 2013 17:23:52 +0100
From: "Daniel P. Berrange" <berrange@redhat.com>
Message-ID: <20130507162352.GH26527@redhat.com>
References: <1367911007-13990-1-git-send-email-qiaonuohan@cn.fujitsu.com>
	<1367911007-13990-2-git-send-email-qiaonuohan@cn.fujitsu.com>
	<51892853.8040001@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <51892853.8040001@redhat.com>
Subject: Re: [Qemu-devel] [PATCH 1/9] Add API to manipulate dump_bitmap
Reply-To: "Daniel P. Berrange" <berrange@redhat.com>
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Eric Blake <eblake@redhat.com>
Cc: Qiao Nuohan <qiaonuohan@cn.fujitsu.com>, qemu-devel@nongnu.org

On Tue, May 07, 2013 at 10:14:11AM -0600, Eric Blake wrote:
> On 05/07/2013 01:16 AM, Qiao Nuohan wrote:
> > Struct dump_bitmap is associated with a tmp file, and the tmp file can be used
> > to save data of bitmap in kdump-compressed format temporarily.
> > The following patch will use these functions to get the data of bitmap and cache
> > them into tmp files.
> > 
> > Signed-off-by: Qiao Nuohan <qiaonuohan@cn.fujitsu.com>
> > Reviewed-by: Zhang Xiaohe <zhangxh@cn.fujitsu.com>
> > ---
> 
> > +    db->file_name = (char *)g_malloc(strlen(filename) + strlen(tmpname) + 1);
> > +
> > +    strcpy(db->file_name, tmpname);
> > +    strcat(db->file_name, "/");
> > +    strcat(db->file_name, filename);
> 
> Off-by-one buffer overflow, since you forgot space for the NUL byte.  We
> use C, not C++, so you don't need to cast the result of g_malloc().

Using  g_strdup_printf("%s/%s", tmpname, filename); avoids the
allocation size problems entirely.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|