Patchwork [v2,08/27] qom: fix off-by-one

login
register
mail settings
Submitter Paolo Bonzini
Date Feb. 4, 2012, 8:02 a.m.
Message ID <1328342577-25732-9-git-send-email-pbonzini@redhat.com>
Download mbox | patch
Permalink /patch/139554/
State New
Headers show

Comments

Paolo Bonzini - Feb. 4, 2012, 8:02 a.m.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 qom/object.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
Anthony Liguori - Feb. 6, 2012, 2:19 p.m.
On 02/04/2012 02:02 AM, Paolo Bonzini wrote:
> Signed-off-by: Paolo Bonzini<pbonzini@redhat.com>
> ---
>   qom/object.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/qom/object.c b/qom/object.c
> index b26272f..314fc7a 100644
> --- a/qom/object.c
> +++ b/qom/object.c
> @@ -871,7 +871,7 @@ static void object_set_link_property(Object *obj, Visitor *v, void *opaque,
>               gchar *target_type;
>
>               target_type = g_strdup(&type[5]);
> -            target_type[strlen(target_type) - 2] = 0;
> +            *strchr(target_type, '>') = 0;

Should use an intermediate variable here and do a NULL check.

My eyes can't handle dereferencing strchr() directly even if I understand why 
it's safe to do :-)

Regards,

Anthony Liguori

>
>               if (object_dynamic_cast(target, target_type)) {
>                   object_ref(target);
Paolo Bonzini - Feb. 7, 2012, 9:13 a.m.
On 02/06/2012 03:19 PM, Anthony Liguori wrote:
>>
>>               target_type = g_strdup(&type[5]);
>> -            target_type[strlen(target_type) - 2] = 0;
>> +            *strchr(target_type, '>') = 0;
>
> Should use an intermediate variable here and do a NULL check.
>
> My eyes can't handle dereferencing strchr() directly even if I
> understand why it's safe to do :-)

Ok, I'll change to strrchr too since I have to respin.

Paolo

Patch

diff --git a/qom/object.c b/qom/object.c
index b26272f..314fc7a 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -871,7 +871,7 @@  static void object_set_link_property(Object *obj, Visitor *v, void *opaque,
             gchar *target_type;
 
             target_type = g_strdup(&type[5]);
-            target_type[strlen(target_type) - 2] = 0;
+            *strchr(target_type, '>') = 0;
 
             if (object_dynamic_cast(target, target_type)) {
                 object_ref(target);