RE: [Qemu-devel] New Qemu Crash found with evidence of memorycorruption

[Alexey Eremenko]

-----Original Message-----
From: address@hidden on behalf of Andreas Schwab
Sent: Sun 12/16/2007 9:24 AM
To: address@hidden
Cc: Yaniv Kaul
Subject: Re: [Qemu-devel] New Qemu Crash found with evidence of memorycorruption

Please try this:

--- readline.c  09 Dez 2007 19:27:48 +0100      1.7
+++ readline.c  16 Dez 2007 18:22:43 +0100     
@@ -267,7 +267,7 @@ static void term_hist_add(const char *cm
            new_entry = hist_entry;
            /* Put this entry at the end of history */
            memmove(&term_history[idx], &term_history[idx + 1],
-                   &term_history[TERM_MAX_CMDS] - &term_history[idx + 1]);
+                   (TERM_MAX_CMDS - idx + 1) * sizeof(char *));
            term_history[TERM_MAX_CMDS - 1] = NULL;
            for (; idx < TERM_MAX_CMDS; idx++) {
                if (term_history[idx] == NULL)
@@ -280,7 +280,7 @@ static void term_hist_add(const char *cm
        /* Need to get one free slot */
        free(term_history[0]);
        memcpy(term_history, &term_history[1],
-              &term_history[TERM_MAX_CMDS] - &term_history[1]);
+              (TERM_MAX_CMDS - 1) * sizeof(char *));
        term_history[TERM_MAX_CMDS - 1] = NULL;
        idx = TERM_MAX_CMDS - 1;
     }

================================================================================

Hi Andreas,

Yes, this works ! Please submit this code to Qemu.

-Technologov, Qumranet