From 148d25e0f6ad1dc3bd6aace092d65262d4217ec6 Mon Sep 17 00:00:00 2001 From: Halil Pasic Date: Thu, 30 Jul 2020 15:01:56 +0200 Subject: s390x/s390-virtio-ccw: fix off-by-one in loadparm getter As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1) reads one past of the end of ms->loadparm, so g_memdup() can not be used here. Let's use g_strndup instead! Fixes: d6645483285f ("s390x/s390-virtio-ccw: fix loadparm property getter") Fixes: Coverity CID 1431058 Reported-by: Peter Maydell Signed-off-by: Halil Pasic Reviewed-by: David Hildenbrand Reviewed-by: Peter Maydell Message-Id: <20200730130156.35063-1-pasic@linux.ibm.com> Signed-off-by: Cornelia Huck --- hw/s390x/s390-virtio-ccw.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c index 403d30e..e72c61d 100644 --- a/hw/s390x/s390-virtio-ccw.c +++ b/hw/s390x/s390-virtio-ccw.c @@ -701,12 +701,9 @@ bool hpage_1m_allowed(void) static char *machine_get_loadparm(Object *obj, Error **errp) { S390CcwMachineState *ms = S390_CCW_MACHINE(obj); - char *loadparm_str; /* make a NUL-terminated string */ - loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1); - loadparm_str[sizeof(ms->loadparm)] = 0; - return loadparm_str; + return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm)); } static void machine_set_loadparm(Object *obj, const char *val, Error **errp) -- cgit v1.1