[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-trivial] [PATCH] readline: Fix buffer overrun on re-add to history
From: |
Markus Armbruster |
Subject: |
[Qemu-trivial] [PATCH] readline: Fix buffer overrun on re-add to history |
Date: |
Fri, 4 Nov 2011 11:10:01 +0100 |
readline_hist_add() moves the history entry to the end of history. It
uses memmove() to move rs->history[idx + 1..] to rs->history[idx..].
However, its size argument is off by two array elements, so it writes
one element beyond rs->history[], and reads two.
On my system, this clobbers rs->hist_entry and the hole right after
it. Since the function assigns to rs->hist_entry in time, the bug has
no ill effects for me.
Spotted by Coverity.
Signed-off-by: Markus Armbruster <address@hidden>
---
readline.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/readline.c b/readline.c
index 6a3160a..a6c0039 100644
--- a/readline.c
+++ b/readline.c
@@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char
*cmdline)
new_entry = hist_entry;
/* Put this entry at the end of history */
memmove(&rs->history[idx], &rs->history[idx + 1],
- (READLINE_MAX_CMDS - idx + 1) * sizeof(char *));
+ (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
rs->history[READLINE_MAX_CMDS - 1] = NULL;
for (; idx < READLINE_MAX_CMDS; idx++) {
if (rs->history[idx] == NULL)
--
1.7.6.4
- [Qemu-trivial] [PATCH] readline: Fix buffer overrun on re-add to history,
Markus Armbruster <=