From 25d943b95703ae45567395db4156b25052ee54c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 17 Feb 2016 17:47:54 +0100 Subject: qga: fix off-by-one length check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Laszlo Ersek said: "The length check is off by one (in the safe direction); it should be (nchars >= 2). The processing should be active for the wide string L"\r\n" -- resulting in the empty wide string --, I believe." Reported-by: Laszlo Ersek Signed-off-by: Marc-André Lureau Reviewed-by: Laszlo Ersek Reviewed-by: Michael Roth Signed-off-by: Michael Roth --- qga/commands-win32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'qga') diff --git a/qga/commands-win32.c b/qga/commands-win32.c index 2df1e2d61b..043ed684a4 100644 --- a/qga/commands-win32.c +++ b/qga/commands-win32.c @@ -1323,7 +1323,7 @@ get_net_error_message(gint error) if (msg != NULL) { nchars = wcslen(msg); - if (nchars > 2 && + if (nchars >= 2 && msg[nchars - 1] == L'\n' && msg[nchars - 2] == L'\r') { msg[nchars - 2] = L'\0'; -- cgit v1.2.1