[libvirt PATCH] storage: logical: don't write past buffer bounds

Ján Tomko via Devel posted 1 patch 3 days, 15 hours ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/0e9b28fad597faca95799b9f18e04f69c569c296.1787309497.git.jtomko@redhat.com
src/storage/storage_backend_logical.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
[libvirt PATCH] storage: logical: don't write past buffer bounds
Posted by Ján Tomko via Devel 3 days, 15 hours ago
From: Ján Tomko <jtomko@redhat.com>

If parsed number of extents is 0, the calculated buffer size
won't hold the first regex_unit.

Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913
Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/storage/storage_backend_logical.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c
index 51e9337820..81f9d62d8b 100644
--- a/src/storage/storage_backend_logical.c
+++ b/src/storage/storage_backend_logical.c
@@ -161,12 +161,12 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol,
 
     /* Allocate space for 'nextents' regex_unit strings plus a comma for each */
     regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1);
-    strcat(regex, regex_unit);
-    for (i = 1; i < nextents; i++) {
+    for (i = 0; i < nextents; i++) {
         /* "," is the separator of "devices" field */
-        strcat(regex, ",");
         strcat(regex, regex_unit);
+        strcat(regex, ",");
     }
+    regex[strlen(regex) - 1] = '\0';
 
     re = g_regex_new(regex, 0, 0, &err);
     if (!re) {
-- 
2.55.0

Re: [libvirt PATCH] storage: logical: don't write past buffer bounds
Posted by Michal Prívozník via Devel 18 hours ago
On 8/21/26 12:51, Ján Tomko via Devel wrote:
> From: Ján Tomko <jtomko@redhat.com>
> 
> If parsed number of extents is 0, the calculated buffer size
> won't hold the first regex_unit.
> 
> Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/storage/storage_backend_logical.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 

Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Michal