[Xen-changelog] [xen master] libxl: fix the bug which will cause heap to break down

[patchbot@xxxxxxx]

commit 35fa07df87bf26ae705fddd85802c47d442cda69
Author:     Li Liang <liangx.z.li@xxxxxxxxx>
AuthorDate: Mon Jun 30 08:48:37 2014 +0800
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Thu Jul 3 10:49:51 2014 +0100

    libxl: fix the bug which will cause heap to break down
    
    If the JSON message contains more bytes than QMP_RECEIVE_BUFFER_SIZE,
    this bug will break down the heap, that leads to core dump. One more
    byte should be allocated to contain the appended null character.
    
    Signed-off-by: Li Liang <liangx.z.li@xxxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
---
 tools/libxl/libxl_qmp.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c
index 8433e42..5cc56b1 100644
--- a/tools/libxl/libxl_qmp.c
+++ b/tools/libxl/libxl_qmp.c
@@ -456,7 +456,7 @@ static int qmp_next(libxl__gc *gc, libxl__qmp_handler *qmp)
             if (incomplete) {
                 size_t current_pos = s - incomplete;
                 incomplete = libxl__realloc(gc, incomplete,
-                                            incomplete_size + rd);
+                                            incomplete_size + rd + 1);
                 strncat(incomplete + incomplete_size, qmp->buffer, rd);
                 s = incomplete + current_pos;
                 incomplete_size += rd;
--
generated by git-patchbot for /home/xen/git/xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog