Re: [Qemu-devel] [PATCH] Improve error handling in do_snapshot_blkdev()

[Stefan Hajnoczi]

On Thu, Mar 3, 2011 at 10:44 AM,  <address@hidden> wrote:
> +    char old_filename[1024];
> +
> +    old_filename[1023] = '\0';
>
>     if (!filename) {
>         qerror_report(QERR_MISSING_PARAMETER, "snapshot_file");
> @@ -591,6 +594,10 @@ int do_snapshot_blkdev(Monitor *mon, const QDict *qdict, 
> QObject **ret_data)
>         goto out;
>     }
>
> +    strncpy(old_filename, bs->filename, 1024);

strncpy does not NUL-terminate if you reach the maximum length.  The
source buffer is 1024 chars so we should be fine unless there is a bug
somewhere else too, but please move the old_filename[1023] = '\0'
after the strncpy and use sizeof(old_filename) as the maximum instead
of 1024.

Stefan