From: Alex Chen <alex.chen@huawei.com>
Date: Thu, 3 Dec 2020 13:50:43 +0000 (+0000)
Subject: readline: Fix possible array index out of bounds in readline_hist_add()
X-Git-Tag: v6.0.0-rc0~163^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=593621f36b716eb091c4ec791db72dd4461789da;p=thirdparty%2Fqemu.git

readline: Fix possible array index out of bounds in readline_hist_add()

When the 'cmdline' is the last entry in 'rs->history' array, there is
no need to put this entry to the end of the array, partly because it is
the last entry, and partly because the next operition will lead to array
index out of bounds.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201203135043.117072-1-alex.chen@huawei.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---

diff --git a/util/readline.c b/util/readline.c
index e534460da68..f1ac6e47694 100644
--- a/util/readline.c
+++ b/util/readline.c
@@ -240,6 +240,9 @@ static void readline_hist_add(ReadLineState *rs, const char *cmdline)
         }
         if (strcmp(hist_entry, cmdline) == 0) {
         same_entry:
+            if (idx == READLINE_MAX_CMDS - 1) {
+                return;
+            }
             new_entry = hist_entry;
             /* Put this entry at the end of history */
             memmove(&rs->history[idx], &rs->history[idx + 1],