| Message ID | 1320401401-28871-1-git-send-email-armbru@redhat.com |
|---|---|
| State | New |
| Headers | show |
On Fri, Nov 04, 2011 at 11:10:01AM +0100, Markus Armbruster wrote: > readline_hist_add() moves the history entry to the end of history. It > uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. > However, its size argument is off by two array elements, so it writes > one element beyond rs->history[], and reads two. > > On my system, this clobbers rs->hist_entry and the hole right after > it. Since the function assigns to rs->hist_entry in time, the bug has > no ill effects for me. > > Spotted by Coverity. > > Signed-off-by: Markus Armbruster <armbru@redhat.com> > --- > readline.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) Thanks, applied to the trivial patches tree: http://repo.or.cz/w/qemu/stefanha.git/shortlog/refs/heads/trivial-patches Stefan
diff --git a/readline.c b/readline.c index 6a3160a..a6c0039 100644 --- a/readline.c +++ b/readline.c @@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline) new_entry = hist_entry; /* Put this entry at the end of history */ memmove(&rs->history[idx], &rs->history[idx + 1], - (READLINE_MAX_CMDS - idx + 1) * sizeof(char *)); + (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *)); rs->history[READLINE_MAX_CMDS - 1] = NULL; for (; idx < READLINE_MAX_CMDS; idx++) { if (rs->history[idx] == NULL)
readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_entry and the hole right after it. Since the function assigns to rs->hist_entry in time, the bug has no ill effects for me. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> --- readline.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)