diff mbox

[4/5] qga: fix off-by-one length check

Message ID 1455727675-20625-5-git-send-email-marcandre.lureau@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Marc-André Lureau Feb. 17, 2016, 4:47 p.m. UTC 
From: Marc-André Lureau <marcandre.lureau@redhat.com>

Laszlo Ersek said: "The length check is off by one (in the safe direction); it
should be (nchars >= 2). The processing should be active for the wide string
L"\r\n" -- resulting in the empty wide string --, I believe."

Reported-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 qga/commands-win32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Roth Feb. 24, 2016, 3:37 p.m. UTC | #1 
Quoting marcandre.lureau@redhat.com (2016-02-17 10:47:54)
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> Laszlo Ersek said: "The length check is off by one (in the safe direction); it
> should be (nchars >= 2). The processing should be active for the wide string
> L"\r\n" -- resulting in the empty wide string --, I believe."
> 
> Reported-by: Laszlo Ersek <lersek@redhat.com>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>

> ---
>  qga/commands-win32.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/qga/commands-win32.c b/qga/commands-win32.c
> index b20f107..ae8cf3d 100644
> --- a/qga/commands-win32.c
> +++ b/qga/commands-win32.c
> @@ -1266,7 +1266,7 @@ get_net_error_message(gint error)
>      if (msg != NULL) {
>          nchars = wcslen(msg);
> 
> -        if (nchars > 2 &&
> +        if (nchars >= 2 &&
>              msg[nchars - 1] == L'\n' &&
>              msg[nchars - 2] == L'\r') {
>              msg[nchars - 2] = L'\0';
> -- 
> 2.5.0
>
diff mbox

Patch

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index b20f107..ae8cf3d 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -1266,7 +1266,7 @@  get_net_error_message(gint error)
     if (msg != NULL) {
         nchars = wcslen(msg);
 
-        if (nchars > 2 &&
+        if (nchars >= 2 &&
             msg[nchars - 1] == L'\n' &&
             msg[nchars - 2] == L'\r') {
             msg[nchars - 2] = L'\0';