When testPipeFeeder copies the XML document into the padded buffer, it
tells virStrcpy that 'xmlsize' bytes are available. This is under
reporting size by 1 byte, and as a result it fails to copy the trailing
'\n' replacing it when '\0'. The return value of virStrcpy wasn't
checked, but was reporting this truncation.

When testPipeFeeder then sends the padded buffer down the pipe, it askes
to send 'emptyspace + xmlsize + 1' bytes, which means it sends the data,
as well as the trailing '\0' terminator.

Both bugs combined mean it is sending '\0\0' as the last bytes, instead
of '\n' which was intended. When virFileReadAll reads data from the
pipe, it ends up adding another '\0' resulting in in a very NUL
terminated string ('\0\0\0'). This is all harmless, but should be fixed
regardless.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/virshtest.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/virshtest.c b/tests/virshtest.c
index 7a7797647c..03d499b759 100644
--- a/tests/virshtest.c
+++ b/tests/virshtest.c
@@ -151,9 +151,9 @@ testPipeFeeder(void *opaque)
     }
 
     memset(doc, ' ', emptyspace);
-    virStrcpy(doc + emptyspace, xml, xmlsize);
+    g_assert(virStrcpy(doc + emptyspace, xml, xmlsize + 1) == 0);
 
-    if (safewrite(fd, doc, emptyspace + xmlsize + 1) < 0) {
+    if (safewrite(fd, doc, emptyspace + xmlsize) < 0) {
         fprintf(stderr, "\nfailed to write to pipe '%s': %s\n", pipepath, g_strerror(errno));
         return;
     }
-- 
2.43.0
_______________________________________________
Devel mailing list -- devel@lists.libvirt.org
To unsubscribe send an email to devel-leave@lists.libvirt.org

On Wed, May 08, 2024 at 01:11:31PM GMT, Daniel P. Berrangé wrote:
> When testPipeFeeder copies the XML document into the padded buffer, it
> tells virStrcpy that 'xmlsize' bytes are available. This is under
> reporting size by 1 byte, and as a result it fails to copy the trailing
> '\n' replacing it when '\0'. The return value of virStrcpy wasn't

*replacing it with

> checked, but was reporting this truncation.
>
> When testPipeFeeder then sends the padded buffer down the pipe, it askes

*asks

> to send 'emptyspace + xmlsize + 1' bytes, which means it sends the data,
> as well as the trailing '\0' terminator.
>
> Both bugs combined mean it is sending '\0\0' as the last bytes, instead
> of '\n' which was intended. When virFileReadAll reads data from the
> pipe, it ends up adding another '\0' resulting in in a very NUL

*resulting in a very

Reviewed-by: Andrea Bolognani <abologna@redhat.com>

-- 
Andrea Bolognani / Red Hat / Virtualization
_______________________________________________
Devel mailing list -- devel@lists.libvirt.org
To unsubscribe send an email to devel-leave@lists.libvirt.org