diff options
| author | Gan Qixin <ganqixin@huawei.com> | 2021-01-06 13:06:25 +0800 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2021-01-11 14:59:21 +0100 |
| commit | 661465c2e0977f2af995c92eb25ea47c4e9bed3f (patch) | |
| tree | 45778e88b4c55b4e48c1054d74c14839729ae4df /tests/qtest | |
| parent | b115ea3a0d24e12da9025faef5b695d44a552228 (diff) | |
| download | qemu-661465c2e0977f2af995c92eb25ea47c4e9bed3f.zip qemu-661465c2e0977f2af995c92eb25ea47c4e9bed3f.tar.gz qemu-661465c2e0977f2af995c92eb25ea47c4e9bed3f.tar.bz2 | |
qtest/libqtest: fix heap-buffer-overflow in qtest_cb_for_every_machine()
When the length of mname is less than 5, memcpy("xenfv", mname, 5) will cause
heap buffer overflow. Therefore, use strncmp to avoid this problem.
The asan showed stack:
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000f2f4 at
pc 0x7f65d8cc2225 bp 0x7ffe93cc5a60 sp 0x7ffe93cc5208 READ of size 5 at
0x60200000f2f4 thread T0
#0 0x7f65d8cc2224 in memcmp (/lib64/libasan.so.5+0xdf224)
#1 0x5632c20be95b in qtest_cb_for_every_machine tests/qtest/libqtest.c:1282
#2 0x5632c20b7995 in main tests/qtest/test-hmp.c:160
#3 0x7f65d88fed42 in __libc_start_main (/lib64/libc.so.6+0x26d42)
#4 0x5632c20b72cd in _start (build/tests/qtest/test-hmp+0x542cd)
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Message-Id: <20210106050625.518041-1-ganqixin@huawei.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'tests/qtest')
| -rw-r--r-- | tests/qtest/libqtest.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c index 8e93b0a..5249a62 100644 --- a/tests/qtest/libqtest.c +++ b/tests/qtest/libqtest.c @@ -1279,7 +1279,7 @@ void qtest_cb_for_every_machine(void (*cb)(const char *machine), g_assert(qstr); mname = qstring_get_str(qstr); /* Ignore machines that cannot be used for qtests */ - if (!memcmp("xenfv", mname, 5) || g_str_equal("xenpv", mname)) { + if (!strncmp("xenfv", mname, 5) || g_str_equal("xenpv", mname)) { continue; } if (!skip_old_versioned || !qtest_is_old_versioned_machine(mname)) { |