Re: [Qemu-devel] [PATCH] readline: Fix buffer overrun on re-add to history

2011-11-07 Thread Stefan Hajnoczi
On Fri, Nov 04, 2011 at 11:10:01AM +0100, Markus Armbruster wrote: > readline_hist_add() moves the history entry to the end of history. It > uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. > However, its size argument is off by two array elements, so it writes > one element be

[Qemu-devel] [PATCH] readline: Fix buffer overrun on re-add to history

2011-11-04 Thread Markus Armbruster
readline_hist_add() moves the history entry to the end of history. It uses memmove() to move rs->history[idx + 1..] to rs->history[idx..]. However, its size argument is off by two array elements, so it writes one element beyond rs->history[], and reads two. On my system, this clobbers rs->hist_en