tests: utils: Fix out-of-bounds access to memory in virTestCompareToFile

[libvirt] [PATCH] tests: utils: Fix out-of-bounds access to memory in virTestCompareToFile

Peter Krempa posted 1 patch 6 years ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/728d88cf2fd41d54fc922d81cee38944072e3e06.1522765125.git.pkrempa@redhat.com

Test syntax-check passed

tests/testutils.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

Expand all Fold all

[libvirt] [PATCH] tests: utils: Fix out-of-bounds access to memory in virTestCompareToFile

Posted by Peter Krempa 6 years ago

Similarly to 3506f1ecfde, the contents of 'cmpcontent' may be an empty
string so the following code would access memory out of the array.

Signed-off-by: Peter Krempa <pkrempa@redhat.com>
---
 tests/testutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/testutils.c b/tests/testutils.c
index 4bd1b63755..7c095caac9 100644
--- a/tests/testutils.c
+++ b/tests/testutils.c
@@ -797,10 +797,11 @@ virTestCompareToFile(const char *strcontent,

     if (filecontent) {
         size_t filecontentLen = strlen(filecontent);
+        size_t cmpcontentLen = strlen(cmpcontent);

         if (filecontentLen > 0 &&
             filecontent[filecontentLen - 1] == '\n' &&
-            cmpcontent[strlen(cmpcontent) - 1] != '\n') {
+            (cmpcontentLen == 0 || cmpcontent[cmpcontentLen - 1] != '\n')) {
             if (virAsprintf(&fixedcontent, "%s\n", cmpcontent) < 0)
                 goto failure;
             cmpcontent = fixedcontent;
-- 
2.16.2

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCH] tests: utils: Fix out-of-bounds access to memory in virTestCompareToFile

Posted by Michal Privoznik 6 years ago

On 04/03/2018 04:18 PM, Peter Krempa wrote:
> Similarly to 3506f1ecfde, the contents of 'cmpcontent' may be an empty
> string so the following code would access memory out of the array.
> 
> Signed-off-by: Peter Krempa <pkrempa@redhat.com>
> ---
>  tests/testutils.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

ACK

Michal

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list