xl: Fix stack corruption caused by non-terminated call to libxl__xs_writev

Signed-off-by: Gianni Tedesco <gianni.tedesco@citrix.com>
Tested-by: Christoph Egger <Christoph.Egger@amd.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>

diff --git a/tools/libxl/libxl.c b/tools/libxl/libxl.c
index 8b086b912342803ec237608dc95eb94414d1a748..4e1fd042848f12d216a5e7e8161dc31479fdcfcb 100644 (file)
--- a/tools/libxl/libxl.c
+++ b/tools/libxl/libxl.c
@@ -1718,7 +1718,7 @@ retry_transaction:
         vm_path = libxl__xs_read(&gc,t,libxl__sprintf(&gc, "%s/vm", p->dom_path));
         if (vm_path) {
             /* Now write the vncpassword into it. */
-            pass_stuff = libxl__calloc(&gc, 2, sizeof(char *));
+            pass_stuff = libxl__calloc(&gc, 3, sizeof(char *));
             pass_stuff[0] = "vncpasswd";
             pass_stuff[1] = info->vncpasswd;
             libxl__xs_writev(&gc,t,vm_path,pass_stuff);