From: Fam Zheng <famz@redhat.com>
Date: Fri, 11 Oct 2013 11:48:29 +0000 (+0800)
Subject: vmdk: Fix vmdk_parse_extents
X-Git-Tag: qemu-xen-4.4.0-rc3~32
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=b685f6af6f3aa34a845f156b334c1e24661fd344;p=qemu-upstream-4.4-testing.git

vmdk: Fix vmdk_parse_extents

An extra 'p++' after while loop when *p == '\n' will move p to unknown
data position, risking parsing junk data or memory access violation.

Cc: qemu-stable@nongnu.org
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 899f1ae219d5eaa96a53c996026cb0178d62a86d)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/block/vmdk.c b/block/vmdk.c
index 258a24f3c..dcee07a30 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -755,10 +755,13 @@ static int vmdk_parse_extents(const char *desc, BlockDriverState *bs,
         }
 next_line:
         /* move to next line */
-        while (*p && *p != '\n') {
+        while (*p) {
+            if (*p == '\n') {
+                p++;
+                break;
+            }
             p++;
         }
-        p++;
     }
     return 0;
 }