|
 |
cd9d16 |
From f51851ea928882bd3d49cbb6d953723294239d8a Mon Sep 17 00:00:00 2001
|
|
|
cd9d16 |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
cd9d16 |
Date: Wed, 26 Oct 2011 12:25:52 +0200
|
|
|
cd9d16 |
Subject: [PATCH] vmdk: Fix possible segfaults
|
|
|
cd9d16 |
MIME-Version: 1.0
|
|
|
cd9d16 |
Content-Type: text/plain; charset=UTF-8
|
|
|
cd9d16 |
Content-Transfer-Encoding: 8bit
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Data we read from the disk isn't necessarily null terminated and may not
|
|
|
cd9d16 |
contain the string we're looking for. The code needs to be a bit more careful
|
|
|
cd9d16 |
here.
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
cd9d16 |
(cherry picked from commit 93897b9fd43548e9c15cf8bece2d9e5174b01fc7)
|
|
|
cd9d16 |
|
|
|
cd9d16 |
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
|
cd9d16 |
Signed-off-by: Andreas Färber <afaerber@suse.de>
|
|
|
cd9d16 |
---
|
|
|
cd9d16 |
block/vmdk.c | 7 ++++++-
|
|
|
cd9d16 |
1 file changed, 6 insertions(+), 1 deletion(-)
|
|
|
cd9d16 |
|
|
|
cd9d16 |
diff --git a/block/vmdk.c b/block/vmdk.c
|
|
|
cd9d16 |
index 8284747..f4fce08 100644
|
|
|
cd9d16 |
--- a/block/vmdk.c
|
|
|
cd9d16 |
+++ b/block/vmdk.c
|
|
|
cd9d16 |
@@ -196,6 +196,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
|
|
|
cd9d16 |
cid_str_size = sizeof("CID");
|
|
|
cd9d16 |
}
|
|
|
cd9d16 |
|
|
|
cd9d16 |
+ desc[DESC_SIZE - 1] = '\0';
|
|
|
cd9d16 |
p_name = strstr(desc, cid_str);
|
|
|
cd9d16 |
if (p_name != NULL) {
|
|
|
cd9d16 |
p_name += cid_str_size;
|
|
|
cd9d16 |
@@ -212,13 +213,17 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
|
|
|
cd9d16 |
BDRVVmdkState *s = bs->opaque;
|
|
|
cd9d16 |
int ret;
|
|
|
cd9d16 |
|
|
|
cd9d16 |
- memset(desc, 0, sizeof(desc));
|
|
|
cd9d16 |
ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
|
|
|
cd9d16 |
if (ret < 0) {
|
|
|
cd9d16 |
return ret;
|
|
|
cd9d16 |
}
|
|
|
cd9d16 |
|
|
|
cd9d16 |
+ desc[DESC_SIZE - 1] = '\0';
|
|
|
cd9d16 |
tmp_str = strstr(desc, "parentCID");
|
|
|
cd9d16 |
+ if (tmp_str == NULL) {
|
|
|
cd9d16 |
+ return -EINVAL;
|
|
|
cd9d16 |
+ }
|
|
|
cd9d16 |
+
|
|
|
cd9d16 |
pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);
|
|
|
cd9d16 |
p_name = strstr(desc, "CID");
|
|
|
cd9d16 |
if (p_name != NULL) {
|
|
|
cd9d16 |
--
|
|
|
cd9d16 |
1.7.11.2
|
|
|
cd9d16 |
|