Re: [Xen-devel] [PATCH v2] libxl: fix the bug which will cause heap to break down

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Fri, 2014-06-27 at 15:40 +0800, Liliang wrote:
> From: Li Liang <liangx.z.li@xxxxxxxxx>
> 
> If the JSON message contains more bytes than QMP_RECEIVE_BUFFER_SIZE,
> this bug will break down the heap, that leads to core dump. One more
> byte should be allocated to contain the appended null character.
> 
> Signed-off-by: Li Liang <liangx.z.li@xxxxxxxxx>

Does this differ from v1 in some way? I can't spot it. I'm not sure if
maybe you meant to send with a different but accidentally resent v1
again, so I won't apply just yet.

I take the +1 is for the NULL terminator?

Also, please CC the maintainer. You can use ./scripts/get_maintainers.pl
to guide you on who that is for a given patch.

> ---
>  tools/libxl/libxl_qmp.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/libxl/libxl_qmp.c b/tools/libxl/libxl_qmp.c
> index 8433e42..5cc56b1 100644
> --- a/tools/libxl/libxl_qmp.c
> +++ b/tools/libxl/libxl_qmp.c
> @@ -456,7 +456,7 @@ static int qmp_next(libxl__gc *gc, libxl__qmp_handler 
> *qmp)
>              if (incomplete) {
>                  size_t current_pos = s - incomplete;
>                  incomplete = libxl__realloc(gc, incomplete,
> -                                            incomplete_size + rd);
> +                                            incomplete_size + rd + 1);
>                  strncat(incomplete + incomplete_size, qmp->buffer, rd);
>                  s = incomplete + current_pos;
>                  incomplete_size += rd;



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel