[virt-tools-list] [PATCH rhsrvany] fix crash due to access beyond array end

Roman Kagan rkagan at parallels.com
Thu Jan 15 10:36:27 UTC 2015


If rhsrvany is called without non-option arguments, as is the case when
it's run as a service, compat_tmain(argc, argv) accesses argv[argc]
which is invalid.  (For me it crashes reliably in 64bit Windows).

Signed-off-by: Roman Kagan <rkagan at parallels.com>
---
 RHSrvAny/RHSrvAny.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/RHSrvAny/RHSrvAny.c b/RHSrvAny/RHSrvAny.c
index 0258031..8047495 100644
--- a/RHSrvAny/RHSrvAny.c
+++ b/RHSrvAny/RHSrvAny.c
@@ -113,16 +113,15 @@ compat_tmain (int argc, TCHAR *argv[])
 
         /* Stop parsing arguments when we hit something which isn't an option */
         else {
+            if (lstrcmpi(arg, TEXT("install")) == 0) {
+                return SvcInstall();
+            } else if (lstrcmpi(arg, TEXT("uninstall")) == 0) {
+                return SvcUninstall();
+            }
             break;
         }
     }
 
-    if (lstrcmpi(argv[i], TEXT("install")) == 0) {
-        return SvcInstall();
-    } else if (lstrcmpi(argv[i], TEXT("uninstall")) == 0) {
-        return SvcUninstall();
-    }
-
     DispatchTable[0].lpServiceName = svcname;
     DispatchTable[0].lpServiceProc = (LPSERVICE_MAIN_FUNCTION) SvcMain;
     DispatchTable[1].lpServiceName = NULL;
-- 
2.1.0




More information about the virt-tools-list mailing list