• P
    virbitmap: Refactor virBitmapParse to avoid access beyond bounds of array · ecad40d8
    Peter Krempa 提交于
    The virBitmapParse function was calling virBitmapIsSet() function that
    requires the caller to check the bounds of the bitmap without checking
    them. This resulted into crashes when parsing a bitmap string that was
    exceeding the bounds used as argument.
    
    This patch refactors the function to use virBitmapSetBit without
    checking if the bit is set (this function does the checks internally)
    and then counts the bits in the bitmap afterwards (instead of keeping
    track while parsing the string).
    
    This patch also changes the "parse_error" label to a more common
    "error".
    
    The refactor should also get rid of the need to call sa_assert on the
    returned variable as the callpath should allow coverity to infer the
    possible return values.
    
    Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=997367
    
    Thanks to Alex Jia for tracking down the issue. This issue is introduced
    by commit 0fc89098.
    
    (cherry picked from commit 47b9127e)
    
    Conflicts:
    	src/util/bitmap.c - context, coverity fix not backported
    ecad40d8
bitmap.c 13.7 KB