From c21e271d36e71b8c2feef99dfea30562f2c1fbee Mon Sep 17 00:00:00 2001 From: Michal Privoznik Date: Fri, 11 Mar 2022 09:13:56 +0100 Subject: [PATCH] virsh: Properly terminate string list in virshDomainInterfaceSourceModeCompleter() A completer must return a NULL terminated list of strings, which means that when dealing with enums, it has to allocate one pointer more than the value of VIR_XXX_LAST. But this is not honoured in virshDomainInterfaceSourceModeCompleter() leading to out of bounds read. Signed-off-by: Michal Privoznik Reviewed-by: Pavel Hrdina --- tools/virsh-completer-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-completer-domain.c b/tools/virsh-completer-domain.c index 250dd8b21a..9cc27b84cb 100644 --- a/tools/virsh-completer-domain.c +++ b/tools/virsh-completer-domain.c @@ -500,7 +500,7 @@ virshDomainInterfaceSourceModeCompleter(vshControl *ctl G_GNUC_UNUSED, virCheckFlags(0, NULL); - ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST); + ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST + 1); for (i = 0; i < VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST; i++) ret[i] = g_strdup(virshDomainInterfaceSourceModeTypeToString(i));