[qemu-xen staging] s390x/s390-virtio-ccw: fix off-by-one in loadparm getter

[patchbot@xxxxxxx]

commit 148d25e0f6ad1dc3bd6aace092d65262d4217ec6
Author:     Halil Pasic <pasic@xxxxxxxxxxxxx>
AuthorDate: Thu Jul 30 15:01:56 2020 +0200
Commit:     Cornelia Huck <cohuck@xxxxxxxxxx>
CommitDate: Thu Jul 30 16:53:34 2020 +0200

    s390x/s390-virtio-ccw: fix off-by-one in loadparm getter
    
    As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1)
    reads one past of the end of ms->loadparm, so g_memdup() can not be used
    here.
    
    Let's use g_strndup instead!
    
    Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter")
    Fixes: Coverity CID 1431058
    Reported-by: Peter Maydell <peter.maydell@xxxxxxxxxx>
    Signed-off-by: Halil Pasic <pasic@xxxxxxxxxxxxx>
    Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
    Reviewed-by: Peter Maydell <peter.maydell@xxxxxxxxxx>
    Message-Id: <20200730130156.35063-1-pasic@xxxxxxxxxxxxx>
    Signed-off-by: Cornelia Huck <cohuck@xxxxxxxxxx>
---
 hw/s390x/s390-virtio-ccw.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 403d30e13b..e72c61d2ea 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -701,12 +701,9 @@ bool hpage_1m_allowed(void)
 static char *machine_get_loadparm(Object *obj, Error **errp)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
-    char *loadparm_str;
 
     /* make a NUL-terminated string */
-    loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
-    loadparm_str[sizeof(ms->loadparm)] = 0;
-    return loadparm_str;
+    return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm));
 }
 
 static void machine_set_loadparm(Object *obj, const char *val, Error **errp)
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#staging