diff options
| author | Chen Gang <gang.chen.5i5j@gmail.com> | 2014-10-15 21:48:07 +0800 |
|---|---|---|
| committer | Alexander Graf <agraf@suse.de> | 2014-11-04 23:26:13 +0100 |
| commit | cc64b1a1940dc2e041c5b06b003d9acf64c22372 (patch) | |
| tree | f80e14e66dc41dcc7c0ba4dd18f65467eacc1f59 /target-ppc | |
| parent | f58aa483145789fbcc3b8a39873ce2b45d5b8d52 (diff) | |
| download | qemu-cc64b1a1940dc2e041c5b06b003d9acf64c22372.tar.gz | |
target-ppc: kvm: Fix memory overflow issue about strncat()
strncat() will append additional '\0' to destination buffer, so need
additional 1 byte for it, or may cause memory overflow, just like other
area within QEMU have done.
And can use g_strdup_printf() instead of strncat(), which may be more
easier understanding.
Signed-off-by: Chen Gang <gang.chen.5i5j@gmail.com>
Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'target-ppc')
| -rw-r--r-- | target-ppc/kvm.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/target-ppc/kvm.c b/target-ppc/kvm.c index 9c23c6ba0d..6843fa0b98 100644 --- a/target-ppc/kvm.c +++ b/target-ppc/kvm.c @@ -1782,7 +1782,7 @@ static int kvmppc_find_cpu_dt(char *buf, int buf_len) * format) */ static uint64_t kvmppc_read_int_cpu_dt(const char *propname) { - char buf[PATH_MAX]; + char buf[PATH_MAX], *tmp; union { uint32_t v32; uint64_t v64; @@ -1794,10 +1794,10 @@ static uint64_t kvmppc_read_int_cpu_dt(const char *propname) return -1; } - strncat(buf, "/", sizeof(buf) - strlen(buf)); - strncat(buf, propname, sizeof(buf) - strlen(buf)); + tmp = g_strdup_printf("%s/%s", buf, propname); - f = fopen(buf, "rb"); + f = fopen(tmp, "rb"); + g_free(tmp); if (!f) { return -1; } |