diff options
| author | Markus Armbruster | 2013-02-06 21:27:14 +0100 |
|---|---|---|
| committer | Anthony Liguori | 2013-02-06 23:35:17 +0100 |
| commit | 82e59a676c01b3df3b53998d428d0a64a55f2439 (patch) | |
| tree | c57a24a95c993f67f20b55a2d2510a06aacdcd1c /qapi | |
| parent | vnc: recognize Hungarian doubleacutes (diff) | |
| download | qemu-82e59a676c01b3df3b53998d428d0a64a55f2439.tar.gz qemu-82e59a676c01b3df3b53998d428d0a64a55f2439.tar.xz qemu-82e59a676c01b3df3b53998d428d0a64a55f2439.zip | |
qmp: Fix design bug and read beyond buffer in memchar-write
Command memchar-write takes data and size parameter. Begs the
question what happens when data doesn't match size.
With format base64, qmp_memchar_write() copies the full data argument,
regardless of size argument.
With format utf8, qmp_memchar_write() copies size bytes from data,
happily reading beyond data. Copies crap from the heap or even
crashes.
Drop the size parameter, and always copy the full data argument.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'qapi')
0 files changed, 0 insertions, 0 deletions