A completer must return a NULL terminated list of strings, which means that when dealing with enums, it has to allocate one pointer more than the value of VIR_XXX_LAST. But this is not honoured in virshDomainInterfaceSourceModeCompleter() leading to out of bounds read. Signed-off-by: Michal Privoznik <mprivozn@xxxxxxxxxx> --- tools/virsh-completer-domain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/virsh-completer-domain.c b/tools/virsh-completer-domain.c index 250dd8b21a..9cc27b84cb 100644 --- a/tools/virsh-completer-domain.c +++ b/tools/virsh-completer-domain.c @@ -500,7 +500,7 @@ virshDomainInterfaceSourceModeCompleter(vshControl *ctl G_GNUC_UNUSED, virCheckFlags(0, NULL); - ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST); + ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST + 1); for (i = 0; i < VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST; i++) ret[i] = g_strdup(virshDomainInterfaceSourceModeTypeToString(i)); -- 2.34.1