commit e729fa6afed3aa917287b63034244f548b79ec60
author Jeff Cody <jcody@redhat.com> Tue Jan 27 08:33:55 2015 -0500
committer Kevin Wolf <kwolf@redhat.com> Fri Feb 06 17:24:21 2015 +0100
tree 8bb0af56cc2acc5f5145b53f7f91bb8cba2a42cd
parent 319fc53e344d5cead970c74f088ae5c607d426b3

block: fix off-by-one error in qcow and qcow2

This fixes an off-by-one error introduced in 9a29e18.  Both qcow and
qcow2 need to make sure to leave room for string terminator '\0' for
the backing file, so the max length of the non-terminated string is
either 1023 or PATH_MAX - 1.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>

block/qcow.c

diff --git a/block/qcow.c b/block/qcow.c
index ccbe9e0..0558969 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -215,7 +215,7 @@
     /* read the backing file name */
     if (header.backing_file_offset != 0) {
         len = header.backing_file_size;
-        if (len > 1023 || len > sizeof(bs->backing_file)) {
+        if (len > 1023 || len >= sizeof(bs->backing_file)) {
             error_setg(errp, "Backing file name too long");
             ret = -EINVAL;
             goto fail;