Luiz Capitulino <lcapitul...@redhat.com> writes: > We should use 'dinfo->serial' length, 'serial' is a pointer, so > the serial number length is currently limited to the pointer size. > > This fixes https://bugs.launchpad.net/qemu/+bug/584143 and is also > valid for stable. > > Signed-off-by: Luiz Capitulino <lcapitul...@redhat.com> > --- > vl.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/vl.c b/vl.c > index 417554f..3de2166 100644 > --- a/vl.c > +++ b/vl.c > @@ -1060,7 +1060,7 @@ DriveInfo *drive_init(QemuOpts *opts, void *opaque, > dinfo->on_write_error = on_write_error; > dinfo->opts = opts; > if (serial) > - strncpy(dinfo->serial, serial, sizeof(serial)); > + strncpy(dinfo->serial, serial, sizeof(dinfo->serial) - 1); > QTAILQ_INSERT_TAIL(&drives, dinfo, next); > > switch(type) {
Correct, because dinfo->serial[] is zero-initialized. Patch conflicts with my "blockdev: Collect block device code in new blockdev.c", but resolution is trivial.
