From: Michal Privoznik <mprivozn@redhat.com>
Date: Fri, 11 Mar 2022 08:13:56 +0000 (+0100)
Subject: virsh: Properly terminate string list in virshDomainInterfaceSourceModeCompleter()
X-Git-Tag: v8.2.0-rc1~99
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c21e271d36e71b8c2feef99dfea30562f2c1fbee;p=thirdparty%2Flibvirt.git

virsh: Properly terminate string list in virshDomainInterfaceSourceModeCompleter()

A completer must return a NULL terminated list of strings, which
means that when dealing with enums, it has to allocate one
pointer more than the value of VIR_XXX_LAST. But this is not
honoured in virshDomainInterfaceSourceModeCompleter() leading to
out of bounds read.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Pavel Hrdina <phrdina@redhat.com>
---

diff --git a/tools/virsh-completer-domain.c b/tools/virsh-completer-domain.c
index 250dd8b21a..9cc27b84cb 100644
--- a/tools/virsh-completer-domain.c
+++ b/tools/virsh-completer-domain.c
@@ -500,7 +500,7 @@ virshDomainInterfaceSourceModeCompleter(vshControl *ctl G_GNUC_UNUSED,
 
     virCheckFlags(0, NULL);
 
-    ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST);
+    ret = g_new0(char *, VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST + 1);
 
     for (i = 0; i < VIRSH_DOMAIN_INTERFACE_SOURCE_MODE_LAST; i++)
         ret[i] = g_strdup(virshDomainInterfaceSourceModeTypeToString(i));