s390x/s390-virtio-ccw: fix off-by-one in loadparm getter

As pointed out by Peter, g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1) reads one past of the end of ms->loadparm, so g_memdup() can not be used here. Let's use g_strndup instead! Fixes: d664548 ("s390x/s390-virtio-ccw: fix loadparm property getter") Fixes: Coverity CID 1431058 Reported-by: Peter Maydell <[email protected]> Signed-off-by: Halil Pasic <[email protected]> Reviewed-by: David Hildenbrand <[email protected]> Reviewed-by: Peter Maydell <[email protected]> Message-Id: <[email protected]> Signed-off-by: Cornelia Huck <[email protected]>
tx2rx · Jul 30, 2020 · 148d25e · 148d25e
1 parent 5772f2b
commit 148d25e
Showing 1 changed file with 1 addition and 4 deletions.
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
@@ -701,12 +701,9 @@ bool hpage_1m_allowed(void)
 static char *machine_get_loadparm(Object *obj, Error **errp)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
-    char *loadparm_str;
 
     /* make a NUL-terminated string */
-    loadparm_str = g_memdup(ms->loadparm, sizeof(ms->loadparm) + 1);
-    loadparm_str[sizeof(ms->loadparm)] = 0;
-    return loadparm_str;
+    return g_strndup((char *) ms->loadparm, sizeof(ms->loadparm));
 }
 
 static void machine_set_loadparm(Object *obj, const char *val, Error **errp)