done once, then copied over by copy-is-my-hobby, once by me too :)
While this is in the relative big SHM we get from the libqb backed
IPC mechanisms, and thus there's a really really low chance to hit a
corruption of another following data element here, it's still a
possibility.
Signed-off-by: Thomas Lamprecht <t.lampre...@proxmox.com>
---
data/src/server.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/data/src/server.c b/data/src/server.c
index 6371edb..36acc1d 100644
--- a/data/src/server.c
+++ b/data/src/server.c
@@ -245,7 +245,7 @@ static int32_t s1_msg_process_fn(
result = -EINVAL;
} else {
/* make sure path is 0 terminated */
- ((char *)data)[request_size] = 0;
+ ((char *)data)[request_size - 1] = 0;
char *path = (char*) data + sizeof(struct
qb_ipc_request_header);
if (ctx->read_only && path_is_private(path)) {
@@ -305,7 +305,7 @@ static int32_t s1_msg_process_fn(
result = -EINVAL;
} else {
/* make sure user string is 0 terminated */
- ((char *)data)[request_size] = 0;
+ ((char *)data)[request_size - 1] = 0;
char *user = (char*) data +
sizeof(cfs_log_get_request_header_t);
uint32_t max = rh->max_entries ? rh->max_entries : 50;
@@ -337,7 +337,7 @@ static int32_t s1_msg_process_fn(
cfs_debug("proplen <= 0, %d", proplen);
result = -EINVAL;
} else {
- ((char *)data)[request_size] = 0; // ensure property is
0 terminated
+ ((char *)data)[request_size - 1] = 0; // ensure
property is 0 terminated
cfs_debug("cfs_get_guest_config_property: basic valid
checked, do request");
--
2.20.1
_______________________________________________
pve-devel mailing list
pve-devel@pve.proxmox.com
https://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
