aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2011-11-04 11:10:01 +0100
committerStefan Hajnoczi <stefanha@linux.vnet.ibm.com>2011-11-07 08:03:49 +0000
commit8af42882a51c632a14d77277df0740f1aa8c958a (patch)
tree5dd88832b4fabe453fc84169da51f730b22a7718
parent47e8dd8fe9d83e8b51d40c2b87d7983bd0a78206 (diff)
readline: Fix buffer overrun on re-add to history
readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_entry and the hole right after it. Since the function assigns to rs->hist_entry in time, the bug has no ill effects for me. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
-rw-r--r--readline.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/readline.c b/readline.c
index 6a3160aba5..a6c0039ad2 100644
--- a/readline.c
+++ b/readline.c
@@ -236,7 +236,7 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
new_entry = hist_entry;
/* Put this entry at the end of history */
memmove(&rs->history[idx], &rs->history[idx + 1],
- (READLINE_MAX_CMDS - idx + 1) * sizeof(char *));
+ (READLINE_MAX_CMDS - (idx + 1)) * sizeof(char *));
rs->history[READLINE_MAX_CMDS - 1] = NULL;
for (; idx < READLINE_MAX_CMDS; idx++) {
if (rs->history[idx] == NULL)