[libvirt] [PATCH] qemu: avoid leaking uninit data from hotplug to dumpxml

[Michal Privoznik]

On 22.10.2011 01:16, Eric Blake wrote:
> Detected by Coverity.  Both text and JSON monitors set only the
> bus and unit fields, which means driveAddr.controller spends
> life as garbage on the stack, and is then memcpy()'d into the
> in-memory representation which the user can see via dumpxml.
> 
> * src/qemu/qemu_hotplug.c (qemuDomainAttachSCSIDisk): Only copy
> defined fields.
> ---
> 
> I have to admit that Coverity is good - it took me several minutes
> to follow the trail down to qemu_monitor_{text,json}.c and prove to
> myself that driveAddr.controller really is untouched on success.
> 
> I didn't actually try to exploit this one - it depends on whatever
> is already on the stack, and your compiler optimization levels,
> before you would ever see dumpxml giving bogus information in
> the <address controller='garbage'> field of the hotplugged <disk>.
> 
>  src/qemu/qemu_hotplug.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
> 

ACK