From: Jim Meyering <meyering@redhat.com>
Date: Mon, 7 May 2012 19:22:09 +0000 (+0200)
Subject: virsh: avoid heap corruption leading to virsh abort
X-Git-Tag: v0.9.12-rc2~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c6694ab85c207e51c6f39cd958c4323b636d8d8d;p=thirdparty%2Flibvirt.git

virsh: avoid heap corruption leading to virsh abort

* tools/virsh.c (vshParseSnapshotDiskspec): Fix off-by-3 memmove
that would corrupt heap when parsing escaped --diskspec comma.
Bug introduced via commit v0.9.4-260-g35d52b5.
---

diff --git a/tools/virsh.c b/tools/virsh.c
index 1207ac9c50..dd9292a1f0 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -16107,7 +16107,7 @@ vshParseSnapshotDiskspec(vshControl *ctl, virBufferPtr buf, const char *str)
     while ((tmp = strchr(tmp, ','))) {
         if (tmp[1] == ',') {
             /* Recognize ,, as an escape for a literal comma */
-            memmove(&tmp[1], &tmp[2], len - (tmp - spec) + 2);
+            memmove(&tmp[1], &tmp[2], len - (tmp - spec) - 2 + 1);
             len--;
             tmp++;
             continue;