[virt-tools-list] [PATCH rhsrvany] fix crash due to access beyond array end

Richard W.M. Jones rjones at redhat.com
Mon Jan 19 14:03:46 UTC 2015


On Thu, Jan 15, 2015 at 01:36:27PM +0300, Roman Kagan wrote:
> If rhsrvany is called without non-option arguments, as is the case when
> it's run as a service, compat_tmain(argc, argv) accesses argv[argc]
> which is invalid.  (For me it crashes reliably in 64bit Windows).
> 
> Signed-off-by: Roman Kagan <rkagan at parallels.com>
> ---
>  RHSrvAny/RHSrvAny.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
> 
> diff --git a/RHSrvAny/RHSrvAny.c b/RHSrvAny/RHSrvAny.c
> index 0258031..8047495 100644
> --- a/RHSrvAny/RHSrvAny.c
> +++ b/RHSrvAny/RHSrvAny.c
> @@ -113,16 +113,15 @@ compat_tmain (int argc, TCHAR *argv[])
>  
>          /* Stop parsing arguments when we hit something which isn't an option */
>          else {
> +            if (lstrcmpi(arg, TEXT("install")) == 0) {
> +                return SvcInstall();
> +            } else if (lstrcmpi(arg, TEXT("uninstall")) == 0) {
> +                return SvcUninstall();
> +            }
>              break;
>          }
>      }
>  
> -    if (lstrcmpi(argv[i], TEXT("install")) == 0) {
> -        return SvcInstall();
> -    } else if (lstrcmpi(argv[i], TEXT("uninstall")) == 0) {
> -        return SvcUninstall();
> -    }
> -
>      DispatchTable[0].lpServiceName = svcname;
>      DispatchTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION) SvcMain;
>      DispatchTable[1].lpServiceName = NULL;
> -- 
> 2.1.0

Thanks - pushed upstream.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-p2v converts physical machines to virtual machines.  Boot with a
live CD or over the network (PXE) and turn machines into KVM guests.
http://libguestfs.org/virt-v2v




More information about the virt-tools-list mailing list