[Qemu-trivial] [PATCH] readline: Fix buffer overrun on re-add to history

[Qemu-trivial] [PATCH] readline: Fix buffer overrun on re-add to history

[Markus Armbruster]

readline_hist_add() moves the history entry to the end of history.  It
uses memmove() to move rs->history[idx + 1..] to rs->history[idx..].
However, its size argument is off by two array elements, so it writes
one element beyond rs->history[], and reads two.

On my system, this clobbers rs->hist_entry and the hole right after
it.  Since the function assigns to rs->hist_entry in time, the bug has
no ill effects for me.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 readline.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/readline.c b/readline.c
index 6a3160a..a6c0039 100644
--- a/readline.c
+++ b/readline.c
@@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
 	    new_entry = hist_entry;
 	    /* Put this entry at the end of history */
 	    memmove(&rs->history[idx], &rs->history[idx + 1],
-		    (READLINE_MAX_CMDS - idx + 1) * sizeof(char *));
+		    (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
 	    rs->history[READLINE_MAX_CMDS - 1] = NULL;
 	    for (; idx < READLINE_MAX_CMDS; idx++) {
 		if (rs->history[idx] == NULL)
-- 
1.7.6.4

Re: [Qemu-trivial] [Qemu-devel] [PATCH] readline: Fix buffer overrun on re-add to history

[Stefan Hajnoczi]

On Fri, Nov 04, 2011 at 11:10:01AM +0100, Markus Armbruster wrote:
> readline_hist_add() moves the history entry to the end of history.  It
> uses memmove() to move rs->history[idx + 1..] to rs->history[idx..].
> However, its size argument is off by two array elements, so it writes
> one element beyond rs->history[], and reads two.
> 
> On my system, this clobbers rs->hist_entry and the hole right after
> it.  Since the function assigns to rs->hist_entry in time, the bug has
> no ill effects for me.
> 
> Spotted by Coverity.
> 
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
>  readline.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)

Thanks, applied to the trivial patches tree:
http://repo.or.cz/w/qemu/stefanha.git/shortlog/refs/heads/trivial-patches

Stefan