]> xenbits.xensource.com Git - libvirt.git/commitdiff
completer: Doesn't alloc enough space for null terminated array of strings
authorSimon Kobyda <skobyda@redhat.com>
Thu, 12 Jul 2018 14:00:08 +0000 (16:00 +0200)
committerMichal Privoznik <mprivozn@redhat.com>
Thu, 12 Jul 2018 14:03:45 +0000 (16:03 +0200)
Functions virshSecretEventNameCompleter, virshPoolEventNameCompleter,
virshNodedevEventNameCompleter allocates only enough space
for array of N strings.

However these are null terminated strings, so program needs to
alloc space for array of N + 1 strings.

How to replicate error: valgrind virsh, use completer for
'nodedev-event --event' or 'pool-event --event' or
'secret-event --event'.

Signed-off-by: Simon Kobyda <skobyda@redhat.com>
tools/virsh-completer.c

index 2327e08340ae530cdd91afb41a174c2b02c6fa79..be59ea2e82a7cf40e80cc4741a66f6e3e8f0edb2 100644 (file)
@@ -709,7 +709,7 @@ virshSecretEventNameCompleter(vshControl *ctl ATTRIBUTE_UNUSED,
 
     virCheckFlags(0, NULL);
 
-    if (VIR_ALLOC_N(ret, VIR_SECRET_EVENT_ID_LAST) < 0)
+    if (VIR_ALLOC_N(ret, VIR_SECRET_EVENT_ID_LAST + 1) < 0)
         goto error;
 
     for (i = 0; i < VIR_SECRET_EVENT_ID_LAST; i++) {
@@ -761,7 +761,7 @@ virshPoolEventNameCompleter(vshControl *ctl ATTRIBUTE_UNUSED,
 
     virCheckFlags(0, NULL);
 
-    if (VIR_ALLOC_N(ret, VIR_STORAGE_POOL_EVENT_ID_LAST) < 0)
+    if (VIR_ALLOC_N(ret, VIR_STORAGE_POOL_EVENT_ID_LAST + 1) < 0)
         goto error;
 
     for (i = 0; i < VIR_STORAGE_POOL_EVENT_ID_LAST; i++) {
@@ -787,7 +787,7 @@ virshNodedevEventNameCompleter(vshControl *ctl ATTRIBUTE_UNUSED,
 
     virCheckFlags(0, NULL);
 
-    if (VIR_ALLOC_N(ret, VIR_NODE_DEVICE_EVENT_ID_LAST) < 0)
+    if (VIR_ALLOC_N(ret, VIR_NODE_DEVICE_EVENT_ID_LAST + 1) < 0)
         goto error;
 
     for (i = 0; i < VIR_NODE_DEVICE_EVENT_ID_LAST; i++) {