External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-07 21:45:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

virsh: avoid heap corruption leading to virsh abort

Browse Source 
* tools/virsh.c (vshParseSnapshotDiskspec): Fix off-by-3 memmove
that would corrupt heap when parsing escaped --diskspec comma.
Bug introduced via commit v0.9.4-260-g35d52b5.
(cherry picked from commit c6694ab85c)
This commit is contained in:
Jim Meyering 2012-05-07 21:22:09 +02:00 committed by Cole Robinson
parent 0ddca6ab09
commit 8f755aa295
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/virsh.c
View File

@ -15800,7 +15800,7 @@ vshParseSnapshotDiskspec(vshControl *ctl, virBufferPtr buf, const char *str)
while ((tmp = strchr(tmp, ','))) { while ((tmp = strchr(tmp, ','))) {
if (tmp[1] == ',') { if (tmp[1] == ',') {
/* Recognize ,, as an escape for a literal comma */ /* Recognize ,, as an escape for a literal comma */
memmove(&tmp[1], &tmp[2], len - (tmp - spec) + 2); memmove(&tmp[1], &tmp[2], len - (tmp - spec) - 2 + 1);
len--; len--;
tmp++; tmp++;
continue; continue;