From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40887) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YHHpi-0000k4-C2 for qemu-devel@nongnu.org; Fri, 30 Jan 2015 15:06:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YHHpd-0004VU-Mb for qemu-devel@nongnu.org; Fri, 30 Jan 2015 15:06:26 -0500 Message-ID: <54CBE435.9090409@redhat.com> Date: Fri, 30 Jan 2015 15:06:13 -0500 From: John Snow MIME-Version: 1.0 References: <1422646675-17657-1-git-send-email-kwolf@redhat.com> In-Reply-To: <1422646675-17657-1-git-send-email-kwolf@redhat.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] qemu-sockets: Fix buffer overflow in inet_parse() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Kevin Wolf , qemu-devel@nongnu.org Cc: qemu-trivial@nongnu.org, pbonzini@redhat.com On 01/30/2015 02:37 PM, Kevin Wolf wrote: > The size of the stack allocated host[] array didn't account for the > terminating '\0' byte that sscanf() writes. Fix the array size. > > Signed-off-by: Kevin Wolf > --- > util/qemu-sockets.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c > index a76bb3c..aacf1fc 100644 > --- a/util/qemu-sockets.c > +++ b/util/qemu-sockets.c > @@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp) > { > InetSocketAddress *addr; > const char *optstr, *h; > - char host[64]; > + char host[65]; > char port[33]; > int to; > int pos; > You don't really need reviews for trivial, right? *shrug* Reviewed-by: John Snow