Bug 680289 – off-by-one in virFileAbsPath can lead to memory corruption [5.7]

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 680289 - off-by-one in virFileAbsPath can lead to memory corruption [5.7]

Summary:	off-by-one in virFileAbsPath can lead to memory corruption [5.7]

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 5
Classification:	Red Hat
Component:	libvirt (Show other bugs)
Sub Component:
Version:	5.7
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Michal Privoznik
QA Contact:	Virtualization Bugs
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:	680281
Blocks:	807971
	Show dependency tree / graph

Reported:	2011-02-24 17:32 EST by Eric Blake
Modified:	2015-09-27 22:32 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:	libvirt-0.8.2-26.el5
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:	680281
Environment:
Last Closed:	2013-01-07 23:56:33 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2013:0127	normal	SHIPPED_LIVE	Low: libvirt security and bug fix update	2013-01-08 04:21:34 EST

Groups: None (edit)

Comment 3 RHEL Product and Program Management 2012-03-30 10:17:48 EDT

This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.

Comment 6 Michal Privoznik 2012-04-30 04:25:24 EDT

Moving to POST:

http://post-office.corp.redhat.com/archives/rhvirt-patches/2012-April/msg00884.html

Comment 9 zhe peng 2012-06-26 01:43:24 EDT

can reproduce this with:
libvirt-0.8.2-25.el5
kvm-83-249.el5
kernel-2.6.18-308.el5
valgrind-3.5.0-5.el5

verify with:
libvirt-0.8.2-26.el5
kvm-83-254.el5
kernel-2.6.18-321.el5

step:
# LIBVIRT_LOG_OUTPUTS='4:file:log' valgrind virsh version

==4259== Memcheck, a memory error detector
==4259== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==4259== Using Valgrind-3.5.0 and LibVEX; rerun with -h for copyright info
==4259== Command: virsh version
==4259== 
Compiled against library: libvir 0.8.2
Using library: libvir 0.8.2
Using API: QEMU 0.8.2
Running hypervisor: QEMU 0.9.1

==4259== Warning: invalid file descriptor -1 in syscall close()
==4259== 
==4259== HEAP SUMMARY:
==4259==     in use at exit: 21,631 bytes in 386 blocks
==4259==   total heap usage: 616 allocs, 230 frees, 1,977,444 bytes allocated
==4259== 
==4259== LEAK SUMMARY:
==4259==    definitely lost: 11 bytes in 1 blocks
==4259==    indirectly lost: 0 bytes in 0 blocks
==4259==      possibly lost: 0 bytes in 0 blocks
==4259==    still reachable: 21,620 bytes in 385 blocks
==4259==         suppressed: 0 bytes in 0 blocks
==4259== Rerun with --leak-check=full to see details of leaked memory
==4259== 
==4259== For counts of detected and suppressed errors, rerun with: -v
==4259== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 4 from 4)

no error detected,verification passed.move to verified.

Comment 11 errata-xmlrpc 2013-01-07 23:56:33 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0127.html

Note You need to log in before you can comment on or make changes to this bug.