diff mbox series

[1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter

Message ID 20200729130222.29026-1-pasic@linux.ibm.com
State New
Headers show
Series [1/1] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter | expand

Commit Message

Halil Pasic July 29, 2020, 1:02 p.m. UTC 
As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
reads one past of the end of ms->loadparm, so g_memdup() can not be used
here.

Let's use malloc and memcpy instead!

Fixes: d664548328 ("s390x/s390-virtio-ccw: fix loadparm property getter")
Fixes: Coverity CID 1431058
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
---
 hw/s390x/s390-virtio-ccw.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


base-commit: 5772f2b1fc5d00e7e04e01fa28e9081d6550440a
diff mbox series

Patch

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 403d30e13b..8b7bac0392 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -704,8 +704,8 @@  static char *machine_get_loadparm(Object *obj, Error **errp)
     char *loadparm_str;
 
     /* make a NUL-terminated string */
-    loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
-    loadparm_str[sizeof(ms->loadparm)] = 0;
+    loadparm_str = g_malloc0(sizeof(ms->loadparm) + 1);
+    memcpy(loadparm_str, ms->loadparm, sizeof(ms->loadparm));
     return loadparm_str;
 }