[libvirt] [PATCH] qemu: avoid text monitor null deref
Detected by Coverity. If, for some reason, our text monitor input
does not match our assumptions, we end up incrementing p while it
is NULL, then dereferencing the pointer 0x1, which will fault.
* src/qemu/qemu_monitor_text.c
(qemuMonitorTextGetBlockStatsParamsNumber): Rewrite to avoid
deref of strchr failure. Fix indentation.
---
src/qemu/qemu_monitor_text.c | 33 +++++++++++++++------------------
1 files changed, 15 insertions(+), 18 deletions(-)
diff --git a/src/qemu/qemu_monitor_text.c b/src/qemu/qemu_monitor_text.c
index 51e8c5c..1eb9846 100644
--- a/src/qemu/qemu_monitor_text.c
+++ b/src/qemu/qemu_monitor_text.c
@@ -1036,26 +1036,23 @@ int qemuMonitorTextGetBlockStatsParamsNumber(qemuMonitorPtr mon,
* "floppy0: ")
*/
p = strchr(p, ' ');
- p++;
- while (*p) {
- if (STRPREFIX (p, "rd_bytes=") ||
- STRPREFIX (p, "wr_bytes=") ||
- STRPREFIX (p, "rd_operations=") ||
- STRPREFIX (p, "wr_operations=") ||
- STRPREFIX (p, "rd_total_times_ns=") ||
- STRPREFIX (p, "wr_total_times_ns=") ||
- STRPREFIX (p, "flush_operations=") ||
- STRPREFIX (p, "flush_total_times_ns=")) {
- num++;
- } else {
- VIR_DEBUG ("unknown block stat near %s", p);
- }
+ while (p && p < eol) {
+ if (STRPREFIX (p, " rd_bytes=") ||
+ STRPREFIX (p, " wr_bytes=") ||
+ STRPREFIX (p, " rd_operations=") ||
+ STRPREFIX (p, " wr_operations=") ||
+ STRPREFIX (p, " rd_total_times_ns=") ||
+ STRPREFIX (p, " wr_total_times_ns=") ||
+ STRPREFIX (p, " flush_operations=") ||
+ STRPREFIX (p, " flush_total_times_ns=")) {
+ num++;
+ } else {
+ VIR_DEBUG ("unknown block stat near %s", p);
+ }
- /* Skip to next label. */
- p = strchr (p, ' ');
- if (!p || p >= eol) break;
- p++;
+ /* Skip to next label. */
+ p = strchr(p + 1, ' ');
}
*nparams = num;
--
1.7.4.4