On Thu, Mar 3, 2011 at 10:44 AM, <jes.soren...@redhat.com> wrote: > + char old_filename[1024]; > + > + old_filename[1023] = '\0'; > > if (!filename) { > qerror_report(QERR_MISSING_PARAMETER, "snapshot_file"); > @@ -591,6 +594,10 @@ int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, > QObject **ret_data) > goto out; > } > > + strncpy(old_filename, bs->filename, 1024);
strncpy does not NUL-terminate if you reach the maximum length. The source buffer is 1024 chars so we should be fine unless there is a bug somewhere else too, but please move the old_filename[1023] = '\0' after the strncpy and use sizeof(old_filename) as the maximum instead of 1024. Stefan