[libvirt PATCH v2] storage: logical: don't write past buffer bounds

Ján Tomko via Devel posted 1 patch 2 weeks, 3 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/c66914b96529578ffbefbd6c3f62af7c2cf7249f.1787839164.git.jtomko@redhat.com
src/storage/storage_backend_logical.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
[libvirt PATCH v2] storage: logical: don't write past buffer bounds
Posted by Ján Tomko via Devel 2 weeks, 3 days ago
From: Ján Tomko <jtomko@redhat.com>

If parsed number of extents is 0, the calculated buffer size
won't hold the first regex_unit.

Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913
Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/storage/storage_backend_logical.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c
index 51e9337820..6138c6fb81 100644
--- a/src/storage/storage_backend_logical.c
+++ b/src/storage/storage_backend_logical.c
@@ -127,6 +127,7 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol,
     unsigned long long offset;
     unsigned long long size;
     unsigned long long length;
+    g_auto(GStrv) regex_array = NULL;
     g_autofree char *regex = NULL;
 
     /* Assume 1 extent (the regex for 'devices' is "(\\S+)") and only
@@ -160,13 +161,10 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol,
     }
 
     /* Allocate space for 'nextents' regex_unit strings plus a comma for each */
-    regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1);
-    strcat(regex, regex_unit);
-    for (i = 1; i < nextents; i++) {
-        /* "," is the separator of "devices" field */
-        strcat(regex, ",");
-        strcat(regex, regex_unit);
-    }
+    regex_array = g_new0(char *, nextents + 1);
+    for (i = 0; i < nextents; i++)
+        regex_array[i] = g_strdup(regex_unit);
+    regex = g_strjoinv(",", regex_array);
 
     re = g_regex_new(regex, 0, 0, &err);
     if (!re) {
-- 
2.55.0

Re: [libvirt PATCH v2] storage: logical: don't write past buffer bounds
Posted by Peter Krempa via Devel 1 week, 5 days ago
On Thu, Aug 27, 2026 at 15:59:24 +0200, Ján Tomko via Devel wrote:
> From: Ján Tomko <jtomko@redhat.com>
> 
> If parsed number of extents is 0, the calculated buffer size
> won't hold the first regex_unit.
> 
> Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/storage/storage_backend_logical.c | 12 +++++-------
>  1 file changed, 5 insertions(+), 7 deletions(-)

Reviewed-by: Peter Krempa <pkrempa@redhat.com>