64ffbe04ea
When processing 'sendkey' command, hmp_sendkey routine null terminates the 'keyname_buf' array. This results in an OOB write issue, if 'keyname_len' was to fall outside of 'keyname_buf' array. Since the keyname's length is known the keyname_buf can be removed altogether by adding a length parameter to index_from_key() and using it for the error output as well. Reported-by: Ling Liu <liuling-it@360.cn> Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-Id: <20160113080958.GA18934@olga> [Comparison with "<" dumbed down, test for junk after strtoul() tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com> |
||
|---|---|---|
| .. | ||
| console.h | ||
| egl-context.h | ||
| egl-helpers.h | ||
| gtk.h | ||
| input.h | ||
| pixel_ops.h | ||
| qemu-pixman.h | ||
| qemu-spice.h | ||
| sdl2.h | ||
| shader.h | ||
| spice-display.h | ||