Re: [Libguestfs] [PATCH 2/2] daemon: Always reflect command stderr to stderr when debugging.

Richard W.M. Jones wrote: > + if (stderror) { > + se_size += r; > + p = realloc (*stderror, se_size); > + if (p == NULL) { > + perror ("realloc"); > + goto quit; > + } > + *stderror = p; > + memcpy (*stderror + se_size - r, buf, r); Hi Rich, This change looks fine. However, there's an unrelated problem: if stderr is very large, incrementing se_size by "r" could result in a smaller total size (overflow). Then, the following memcpy would clobber the heap by writing a potentially very large amount of data into a much smaller (or even 0-length) buffer. One way to avoid it: size_t new_size = se_size + r; if (new_size < se_size) { perror ("standard error too large"); goto quit; } se_size = new_size; Or perhaps better: limit the buffer size to say 1MiB, and warn if truncation is required.