Commit b34d259a81500d75e4cf435f1e8b262ba7e1421a
1 parent
a78b03cb
Add a path length check to prevent heap overflow (Eric Milliken).
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@3916 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
2 additions
and
0 deletions
block-vmdk.c
| ... | ... | @@ -341,6 +341,8 @@ static int vmdk_parent_open(BlockDriverState *bs, const char * filename) |
| 341 | 341 | p_name += sizeof("parentFileNameHint") + 1; |
| 342 | 342 | if ((end_name = strchr(p_name,'\"')) == 0) |
| 343 | 343 | return -1; |
| 344 | + if ((end_name - p_name) > sizeof (s->hd->backing_file) - 1) | |
| 345 | + return -1; | |
| 344 | 346 | |
| 345 | 347 | strncpy(s->hd->backing_file, p_name, end_name - p_name); |
| 346 | 348 | if (stat(s->hd->backing_file, &file_buf) != 0) { | ... | ... |