From 82e59a676c01b3df3b53998d428d0a64a55f2439 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 6 Feb 2013 21:27:14 +0100 Subject: qmp: Fix design bug and read beyond buffer in memchar-write Command memchar-write takes data and size parameter. Begs the question what happens when data doesn't match size. With format base64, qmp_memchar_write() copies the full data argument, regardless of size argument. With format utf8, qmp_memchar_write() copies size bytes from data, happily reading beyond data. Copies crap from the heap or even crashes. Drop the size parameter, and always copy the full data argument. Signed-off-by: Markus Armbruster Reviewed-by: Eric Blake Signed-off-by: Anthony Liguori --- qmp-commands.hx | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'qmp-commands.hx') diff --git a/qmp-commands.hx b/qmp-commands.hx index bbb21f3583..8468f1022d 100644 --- a/qmp-commands.hx +++ b/qmp-commands.hx @@ -467,7 +467,7 @@ EQMP { .name = "memchar-write", - .args_type = "device:s,size:i,data:s,format:s?", + .args_type = "device:s,data:s,format:s?", .mhandler.cmd_new = qmp_marshal_input_memchar_write, }, @@ -481,7 +481,6 @@ char device. Arguments: - "device": the name of the char device, must be unique (json-string) -- "size": the memory size, in bytes, should be power of 2 (json-int) - "data": the source data write to memory (json-string) - "format": the data format write to memory, default is utf8. (json-string, optional) @@ -491,7 +490,6 @@ Example: -> { "execute": "memchar-write", "arguments": { "device": foo, - "size": 8, "data": "abcdefgh", "format": "utf8" } } <- { "return": {} } -- cgit v1.2.1