mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-31 05:57:16 +00:00
virsh: avoid heap corruption leading to virsh abort
* tools/virsh.c (vshParseSnapshotDiskspec): Fix off-by-3 memmove that would corrupt heap when parsing escaped --diskspec comma. Bug introduced via commit v0.9.4-260-g35d52b5.
This commit is contained in:
parent
cc0737713a
commit
c6694ab85c
@ -16107,7 +16107,7 @@ vshParseSnapshotDiskspec(vshControl *ctl, virBufferPtr buf, const char *str)
|
|||||||
while ((tmp = strchr(tmp, ','))) {
|
while ((tmp = strchr(tmp, ','))) {
|
||||||
if (tmp[1] == ',') {
|
if (tmp[1] == ',') {
|
||||||
/* Recognize ,, as an escape for a literal comma */
|
/* Recognize ,, as an escape for a literal comma */
|
||||||
memmove(&tmp[1], &tmp[2], len - (tmp - spec) + 2);
|
memmove(&tmp[1], &tmp[2], len - (tmp - spec) - 2 + 1);
|
||||||
len--;
|
len--;
|
||||||
tmp++;
|
tmp++;
|
||||||
continue;
|
continue;
|
||||||
|
Loading…
Reference in New Issue
Block a user