Fixed buffer overflow in qemu networking

ChangeLog

+Tue Mar 20 10:00:06 EST 2007 Daniel P. Berrange <berrange@redhat.com>
+
+	* qemud/conf.c: Fixed buffer overflow in code building up
+	command line args for qemu networking
+
 Tue Mar 20 16:40:06 CET 2007 Daniel Veillard <veillard@redhat.com>
 
 	* src/virsh.c: add error messages for negative memory size as

qemud/conf.c

@@ -1301,13 +1301,14 @@ int qemudBuildCommandLine(struct qemud_server *server,
     } else {
         int vlan = 0;
         while (net) {
-            char nic[3+1+7+1+17+1];
+            char nic[100];
 
-            sprintf(nic, "nic,macaddr=%02x:%02x:%02x:%02x:%02x:%02x,vlan=%d",
-                    net->mac[0], net->mac[1],
-                    net->mac[2], net->mac[3],
-                    net->mac[4], net->mac[5],
-                    vlan);
+            if (snprintf(nic, sizeof(nic), "nic,macaddr=%02x:%02x:%02x:%02x:%02x:%02x,vlan=%d",
+                         net->mac[0], net->mac[1],
+                         net->mac[2], net->mac[3],
+                         net->mac[4], net->mac[5],
+                         vlan) >= sizeof(nic))
+                goto error;
 
             if (!((*argv)[++n] = strdup("-net")))
                 goto no_memory;