[libvirt] [PATCH] Avoid crash in virBufferEscapeString

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



If virBufferEscapeString is called on a buffer that has 0 bytes of
space, a size of -1 will be passed to snprintf, resulting in a
segmentation fault. This patch checks for 0 space, and grows the
buffer if needed prior to determining size.

I discovered this when I accidentally made virBufferEscapeString the
first function to add something to a newly minted buffer.
---
 src/util/buf.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/src/util/buf.c b/src/util/buf.c
index c802aa2..9681635 100644
--- a/src/util/buf.c
+++ b/src/util/buf.c
@@ -318,6 +318,12 @@ virBufferEscapeString(const virBufferPtr buf, const char *format, const char *st
     }
     *out = 0;
 
+    if ((buf->use >= buf->size) &&
+        virBufferGrow(buf, 100) < 0) {
+        VIR_FREE(escaped);
+        return;
+    }
+
     size = buf->size - buf->use - 1;
     while (((count = snprintf(&buf->content[buf->use], size, format,
                               (char *)escaped)) < 0) || (count >= size - 1)) {
-- 
1.6.2.5

--
Libvir-list mailing list
Libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list

[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]