From 87c16c7216f6c7862e06704139e3f073bd1e73f6 Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 18 Jan 2012 10:38:26 +0100 Subject: [PATCH 32/52] readline: Fix buffer overrun on re-add to history RH-Author: Markus Armbruster Message-id: <1326883126-22053-33-git-send-email-armbru@redhat.com> Patchwork-id: 36594 O-Subject: [RHEL-6.3 PATCH qemu-kvm 32/52] readline: Fix buffer overrun on re-add to history Bugzilla: 758194 RH-Acked-by: Miroslav Rezanina RH-Acked-by: Laszlo Ersek RH-Acked-by: Amit Shah readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_entry and the hole right after it. Since the function assigns to rs->hist_entry in time, the bug has no ill effects for me. Spotted by Coverity. Signed-off-by: Markus Armbruster Signed-off-by: Stefan Hajnoczi (cherry picked from commit 8af42882a51c632a14d77277df0740f1aa8c958a) --- readline.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) Signed-off-by: Michal Novotny --- readline.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/readline.c b/readline.c index 7834af0..ef56d59 100644 --- a/readline.c +++ b/readline.c @@ -235,7 +235,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline) new_entry = hist_entry; /* Put this entry at the end of history */ memmove(&rs->history[idx], &rs->history[idx + 1], - (READLINE_MAX_CMDS - idx + 1) * sizeof(char *)); + (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *)); rs->history[READLINE_MAX_CMDS - 1] = NULL; for (; idx < READLINE_MAX_CMDS; idx++) { if (rs->history[idx] == NULL) -- 1.7.7.5