From: Halil Pasic Date: Thu, 30 Jul 2020 13:01:56 +0000 (+0200) Subject: s390x/s390-virtio-ccw: fix off-by-one in loadparm getter X-Git-Tag: qemu-xen-4.15.0~16^2 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=148d25e0f6ad1dc3bd6aace092d65262d4217ec6;p=qemu-xen.git s390x/s390-virtio-ccw: fix off-by-one in loadparm getter As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1) reads one past of the end of ms->loadparm, so g_memdup() can not be used here. Let's use g_strndup instead! Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter") Fixes: Coverity CID 1431058 Reported-by: Peter Maydell Signed-off-by: Halil Pasic Reviewed-by: David Hildenbrand Reviewed-by: Peter Maydell Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck --- diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 403d30e13b..e72c61d2ea 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -701,12 +701,9 @@ bool hpage_1m_allowed(void) static char *machine_get_loadparm(Object *obj, Error **errp) { S390CcwMachineState *ms = S390_CCW_MACHINE(obj); - char *loadparm_str; /* make a NUL-terminated string */ - loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1); - loadparm_str[sizeof(ms->loadparm)] = 0; - return loadparm_str; + return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm)); } static void machine_set_loadparm(Object *obj, const char *val, Error **errp)