mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

readline: Fix buffer overrun on re-add to history

Browse Source 
readline_hist_add() moves the history entry to the end of history.  It
uses memmove() to move rs->history[idx + 1..] to rs->history[idx..].
However, its size argument is off by two array elements, so it writes
one element beyond rs->history[], and reads two.

On my system, this clobbers rs->hist_entry and the hole right after
it.  Since the function assigns to rs->hist_entry in time, the bug has
no ill effects for me.

Spotted by Coverity.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
This commit is contained in:
Markus Armbruster 2011-11-04 11:10:01 +01:00 committed by Stefan Hajnoczi
parent 47e8dd8fe9
commit 8af42882a5
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
readline.c
View File

@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
new_entry = hist_entry; new_entry = hist_entry;
/* Put this entry at the end of history */ /* Put this entry at the end of history */
memmove(&rs->history[idx], &rs->history[idx + 1], memmove(&rs->history[idx], &rs->history[idx + 1],
(READLINE_MAX_CMDS - idx + 1) * sizeof(char *)); (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
rs->history[READLINE_MAX_CMDS - 1] = NULL; rs->history[READLINE_MAX_CMDS - 1] = NULL;
for (; idx < READLINE_MAX_CMDS; idx++) { for (; idx < READLINE_MAX_CMDS; idx++) {
if (rs->history[idx] == NULL) if (rs->history[idx] == NULL)