target-ppc: kvm: Fix memory overflow issue about strncat()

PATCH Applied Chen Gang 2 participants 2 messages Oct 15, 2014 KVM

Share & tools

Chen Gang

author

2014-10-15 13:48 UTC #0 lore raw

PATCH v2 1/1 target-ppc: kvm: Fix memory overflow issue about strncat()

strncat() will append additional '\0' to destination buffer, so need additional 1 byte for it, or may cause memory overflow, just like other area within QEMU have done.

And can use g_strdup_printf() instead of strncat(), which may be more easier understanding.

Signed-off-by Chen Gang <[email protected]>

---
 target-ppc/kvm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

target-ppc/kvm.c +4 -4

index 66e7ce5..cea6a87 100644
@@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len)
  * format) */
 static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
 {
-    char buf[PATH_MAX];
+    char buf[PATH_MAX], *tmp;
     union {
         uint32_t v32;
         uint64_t v64;

@@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname)
         return -1;
     }
 
-    strncat(buf, "/", sizeof(buf) - strlen(buf));
-    strncat(buf, propname, sizeof(buf) - strlen(buf));
+    tmp = g_strdup_printf("%s/%s", buf, propname);
 
-    f = fopen(buf, "rb");
+    f = fopen(tmp, "rb");
+    g_free(tmp);
     if (!f) {
         return -1;
     }

Signature · 1 line

1.9.3

Alexander Graf

Applied

2014-10-15 13:52 UTC #1 lore raw

Quoted 8 lines · Chen Gang

strncat() will append additional '\0' to destination buffer, so need additional 1 byte for it, or may cause memory overflow, just like other area within QEMU have done.
And can use g_strdup_printf() instead of strncat(), which may be more easier understanding.
Signed-off-by Chen Gang <[email protected]>

Thanks, applied to ppc-next. And sorry for not replying earlier.

Alex