diff mbox

qemu-sockets: Fix buffer overflow in inet_parse()

Message ID 1422646675-17657-1-git-send-email-kwolf@redhat.com
State New
Headers show

Commit Message

Kevin Wolf Jan. 30, 2015, 7:37 p.m. UTC 
The size of the stack allocated host[] array didn't account for the
terminating '\0' byte that sscanf() writes. Fix the array size.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/qemu-sockets.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

John Snow Jan. 30, 2015, 8:06 p.m. UTC | #1 
On 01/30/2015 02:37 PM, Kevin Wolf wrote:
> The size of the stack allocated host[] array didn't account for the
> terminating '\0' byte that sscanf() writes. Fix the array size.
>
> Signed-off-by: Kevin Wolf <kwolf@redhat.com>
> ---
>   util/qemu-sockets.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
> index a76bb3c..aacf1fc 100644
> --- a/util/qemu-sockets.c
> +++ b/util/qemu-sockets.c
> @@ -512,7 +512,7 @@ InetSocketAddress *inet_parse(const char *str, Error **errp)
>   {
>       InetSocketAddress *addr;
>       const char *optstr, *h;
> -    char host[64];
> +    char host[65];
>       char port[33];
>       int to;
>       int pos;
>

You don't really need reviews for trivial, right?
*shrug*

Reviewed-by: John Snow <jsnow@redhat.com>
Michael Tokarev Feb. 7, 2015, 9:08 a.m. UTC | #2 
30.01.2015 22:37, Kevin Wolf wrote:
> The size of the stack allocated host[] array didn't account for the
> terminating '\0' byte that sscanf() writes. Fix the array size.

Applied to -trivial, thank you!

/mjt
diff mbox

Patch

diff --git a/util/qemu-sockets.c b/util/qemu-sockets.c
index a76bb3c..aacf1fc 100644
--- a/util/qemu-sockets.c
+++ b/util/qemu-sockets.c
@@ -512,7 +512,7 @@  InetSocketAddress *inet_parse(const char *str, Error **errp)
 {
     InetSocketAddress *addr;
     const char *optstr, *h;
-    char host[64];
+    char host[65];
     char port[33];
     int to;
     int pos;