tree c57a24a95c993f67f20b55a2d2510a06aacdcd1c
parent 15af6321f4d1f90d0ae1b5cb05093c48b41c4533
author Markus Armbruster <armbru@redhat.com> 1360182434 +0100
committer Anthony Liguori <aliguori@us.ibm.com> 1360190117 -0600

qmp: Fix design bug and read beyond buffer in memchar-write

Command memchar-write takes data and size parameter.  Begs the
question what happens when data doesn't match size.

With format base64, qmp_memchar_write() copies the full data argument,
regardless of size argument.

With format utf8, qmp_memchar_write() copies size bytes from data,
happily reading beyond data.  Copies crap from the heap or even
crashes.

Drop the size parameter, and always copy the full data argument.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>