From 82e59a676c01b3df3b53998d428d0a64a55f2439 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 6 Feb 2013 21:27:14 +0100 Subject: qmp: Fix design bug and read beyond buffer in memchar-write Command memchar-write takes data and size parameter. Begs the question what happens when data doesn't match size. With format base64, qmp_memchar_write() copies the full data argument, regardless of size argument. With format utf8, qmp_memchar_write() copies size bytes from data, happily reading beyond data. Copies crap from the heap or even crashes. Drop the size parameter, and always copy the full data argument. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Signed-off-by: Anthony Liguori --- hmp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'hmp.c') diff --git a/hmp.c b/hmp.c index 1689e6f1fd..9fdf1ce516 100644 --- a/hmp.c +++ b/hmp.c @@ -664,13 +664,11 @@ void hmp_pmemsave(Monitor *mon, const QDict *qdict) void hmp_memchar_write(Monitor *mon, const QDict *qdict) { - uint32_t size; const char *chardev = qdict_get_str(qdict, "device"); const char *data = qdict_get_str(qdict, "data"); Error *errp = NULL; - size = strlen(data); - qmp_memchar_write(chardev, size, data, false, 0, &errp); + qmp_memchar_write(chardev, data, false, 0, &errp); hmp_handle_error(mon, &errp); } -- cgit v1.2.1