diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2011-10-26 12:25:52 +0200 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2011-10-28 19:25:49 +0200 |
| commit | 93897b9fd43548e9c15cf8bece2d9e5174b01fc7 (patch) | |
| tree | c5edbf523835ebaa0d0c477ada19e95ca5284d79 | |
| parent | 99f1835d9bc744f98370254600530e66f32e6d81 (diff) | |
| download | qemu-93897b9fd43548e9c15cf8bece2d9e5174b01fc7.tar.gz qemu-93897b9fd43548e9c15cf8bece2d9e5174b01fc7.tar.bz2 qemu-93897b9fd43548e9c15cf8bece2d9e5174b01fc7.zip | |
vmdk: Fix possible segfaults
Data we read from the disk isn't necessarily null terminated and may not
contain the string we're looking for. The code needs to be a bit more careful
here.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
| -rw-r--r-- | block/vmdk.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/vmdk.c b/block/vmdk.c index fa0e8bd168..8caaf0b522 100644 --- a/block/vmdk.c +++ b/block/vmdk.c @@ -227,6 +227,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent) cid_str_size = sizeof("CID"); } + desc[DESC_SIZE - 1] = '\0'; p_name = strstr(desc, cid_str); if (p_name != NULL) { p_name += cid_str_size; @@ -243,13 +244,17 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid) BDRVVmdkState *s = bs->opaque; int ret; - memset(desc, 0, sizeof(desc)); ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE); if (ret < 0) { return ret; } + desc[DESC_SIZE - 1] = '\0'; tmp_str = strstr(desc, "parentCID"); + if (tmp_str == NULL) { + return -EINVAL; + } + pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str); p_name = strstr(desc, "CID"); if (p_name != NULL) { |