[Libguestfs] [PATCH] lib: update inspect_list_applications to return all installed RPMs (RHBZ#859885)

[Richard W.M. Jones]

On Mon, Oct 29, 2012 at 03:12:36PM -0400, John Eckersberg wrote:
> >> +      offset = be32toh(*(uint32_t *) (cursor + 8));
> >> +      return safe_strdup(g, store + offset);

.. and also isn't this calculation suspect?  'offset' is entirely
calculated from user data, potentially causing 'store + offset' to
point to more or less arbitrary memory in the process.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into Xen guests.
http://et.redhat.com/~rjones/virt-p2v