aboutsummaryrefslogtreecommitdiff
path: root/block/vmdk.c
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2011-10-26 12:25:52 +0200
committerKevin Wolf <kwolf@redhat.com>2011-10-28 19:25:49 +0200
commit93897b9fd43548e9c15cf8bece2d9e5174b01fc7 (patch)
treec5edbf523835ebaa0d0c477ada19e95ca5284d79 /block/vmdk.c
parent99f1835d9bc744f98370254600530e66f32e6d81 (diff)
vmdk: Fix possible segfaults
Data we read from the disk isn't necessarily null terminated and may not contain the string we're looking for. The code needs to be a bit more careful here. Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Diffstat (limited to 'block/vmdk.c')
-rw-r--r--block/vmdk.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/block/vmdk.c b/block/vmdk.c
index fa0e8bd168..8caaf0b522 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -227,6 +227,7 @@ static uint32_t vmdk_read_cid(BlockDriverState *bs, int parent)
cid_str_size = sizeof("CID");
}
+ desc[DESC_SIZE - 1] = '\0';
p_name = strstr(desc, cid_str);
if (p_name != NULL) {
p_name += cid_str_size;
@@ -243,13 +244,17 @@ static int vmdk_write_cid(BlockDriverState *bs, uint32_t cid)
BDRVVmdkState *s = bs->opaque;
int ret;
- memset(desc, 0, sizeof(desc));
ret = bdrv_pread(bs->file, s->desc_offset, desc, DESC_SIZE);
if (ret < 0) {
return ret;
}
+ desc[DESC_SIZE - 1] = '\0';
tmp_str = strstr(desc, "parentCID");
+ if (tmp_str == NULL) {
+ return -EINVAL;
+ }
+
pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);
p_name = strstr(desc, "CID");
if (p_name != NULL) {