[PATCH V2 1/2] uuid: fix possible non-terminated string

[Stefan Berger <stefanb@xxxxxxxxxxxxxxxxxx>]

Error: STRING_NULL:
/libvirt/src/util/uuid.c:273:
string_null_argument: Function "getDMISystemUUID" does not terminate string "*dmiuuid".
/libvirt/src/util/uuid.c:241:
string_null_argument: Function "saferead" fills array "*uuid" with a non-terminated string.
/libvirt/src/util/util.c:101:
string_null_argument: Function "read" fills array "*buf" with a non-terminated string.
/libvirt/src/util/uuid.c:274:
string_null: Passing unterminated string "dmiuuid" to a function expecting a null-terminated string.
/libvirt/src/util/uuid.c:138:
var_assign_parm: Assigning: "cur" = "uuidstr". They now point to the same thing.
/libvirt/src/util/uuid.c:164:
string_null_sink_loop: Searching for null termination in an unterminated array "cur".

---
 src/util/uuid.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

Index: libvirt-acl/src/util/uuid.c
===================================================================
--- libvirt-acl.orig/src/util/uuid.c
+++ libvirt-acl/src/util/uuid.c
@@ -238,7 +238,8 @@ getDMISystemUUID(char *uuid, int len)
     while (paths[i]) {
         int fd = open(paths[i], O_RDONLY);
         if (fd >= 0) {
-            if (saferead(fd, uuid, len) == len) {
+            if (saferead(fd, uuid, len - 1) == len - 1) {
+                uuid[len - 1] = '\0';
                 VIR_FORCE_CLOSE(fd);
                 return 0;
             }
@@ -270,7 +271,7 @@ virSetHostUUIDStr(const char *uuid)
 
     if (!uuid) {
         memset(dmiuuid, 0, sizeof(dmiuuid));
-        if (!getDMISystemUUID(dmiuuid, sizeof(dmiuuid) - 1)) {
+        if (!getDMISystemUUID(dmiuuid, sizeof(dmiuuid))) {
             if (!virUUIDParse(dmiuuid, host_uuid))
                 return 0;
         }

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list