Skip to content

Commit 661465c

Browse files
Ganqxhuth
authored andcommitted
qtest/libqtest: fix heap-buffer-overflow in qtest_cb_for_every_machine()
When the length of mname is less than 5, memcpy("xenfv", mname, 5) will cause heap buffer overflow. Therefore, use strncmp to avoid this problem. The asan showed stack: ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000f2f4 at pc 0x7f65d8cc2225 bp 0x7ffe93cc5a60 sp 0x7ffe93cc5208 READ of size 5 at 0x60200000f2f4 thread T0 #0 0x7f65d8cc2224 in memcmp (/lib64/libasan.so.5+0xdf224) #1 0x5632c20be95b in qtest_cb_for_every_machine tests/qtest/libqtest.c:1282 qemu#2 0x5632c20b7995 in main tests/qtest/test-hmp.c:160 qemu#3 0x7f65d88fed42 in __libc_start_main (/lib64/libc.so.6+0x26d42) qemu#4 0x5632c20b72cd in _start (build/tests/qtest/test-hmp+0x542cd) Reported-by: Euler Robot <[email protected]> Signed-off-by: Gan Qixin <[email protected]> Reviewed-by: Laurent Vivier <[email protected]> Message-Id: <[email protected]> Signed-off-by: Thomas Huth <[email protected]>
1 parent b115ea3 commit 661465c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

tests/qtest/libqtest.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1279,7 +1279,7 @@ void qtest_cb_for_every_machine(void (*cb)(const char *machine),
12791279
g_assert(qstr);
12801280
mname = qstring_get_str(qstr);
12811281
/* Ignore machines that cannot be used for qtests */
1282-
if (!memcmp("xenfv", mname, 5) || g_str_equal("xenpv", mname)) {
1282+
if (!strncmp("xenfv", mname, 5) || g_str_equal("xenpv", mname)) {
12831283
continue;
12841284
}
12851285
if (!skip_old_versioned || !qtest_is_old_versioned_machine(mname)) {

0 commit comments

Comments
 (0)