External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-12-22 21:55:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

virsh: avoid heap corruption leading to virsh abort

Browse Source 
* tools/virsh.c (vshParseSnapshotDiskspec): Fix off-by-3 memmove
that would corrupt heap when parsing escaped --diskspec comma.
Bug introduced via commit v0.9.4-260-g35d52b5.
This commit is contained in:
Jim Meyering 2012-05-07 21:22:09 +02:00
parent cc0737713a
commit c6694ab85c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/virsh.c
View File

@ -16107,7 +16107,7 @@ vshParseSnapshotDiskspec(vshControl *ctl, virBufferPtr buf, const char *str)
while ((tmp = strchr(tmp, ','))) {
if (tmp[1] == ',') {
/* Recognize ,, as an escape for a literal comma */
memmove(&tmp[1], &tmp[2], len - (tmp - spec) + 2);
memmove(&tmp[1], &tmp[2], len - (tmp - spec) - 2 + 1);
len--;
tmp++;
continue;