commit 25d943b95703ae45567395db4156b25052ee54c4
author Marc-André Lureau <marcandre.lureau@redhat.com> Wed Feb 17 17:47:54 2016 +0100
committer Michael Roth <mdroth@linux.vnet.ibm.com> Thu Feb 25 09:48:51 2016 -0600
tree 9377545cb6158a9393ef7d5583039a893271b2ae
parent 6c6916dac8a146f2e8ee845a2a4e8d459a8689eb

qga: fix off-by-one length check

Laszlo Ersek said: "The length check is off by one (in the safe direction); it
should be (nchars >= 2). The processing should be active for the wide string
L"\r\n" -- resulting in the empty wide string --, I believe."

Reported-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

qga/commands-win32.c

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index 2df1e2d..043ed68 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -1323,7 +1323,7 @@
     if (msg != NULL) {
         nchars = wcslen(msg);
 
-        if (nchars > 2 &&
+        if (nchars >= 2 &&
             msg[nchars - 1] == L'\n' &&
             msg[nchars - 2] == L'\r') {
             msg[nchars - 2] = L'\0';