Fix memory corruption issue with CopyStringOut()

CopyStringOut() improperly indexed setting the null
character, would result in zeroing a random byte
of memory after(out of bounds) the character array.

diff --git a/src/mem/fs_translating_port_proxy.cc b/src/mem/fs_translating_port_proxy.cc
index d202b22bdc205bb08f41bad2454a6c79a62fda20..c0898a0035e376da3220ab2f1fbdf8eebc7a71ef 100644 (file)
--- a/src/mem/fs_translating_port_proxy.cc
+++ b/src/mem/fs_translating_port_proxy.cc
@@ -138,15 +138,19 @@ CopyIn(ThreadContext *tc, Addr dest, void *source, size_t cplen)
 void
 CopyStringOut(ThreadContext *tc, char *dst, Addr vaddr, size_t maxlen)
 {
-    int len = 0;
     char *start = dst;
     FSTranslatingPortProxy* vp = tc->getVirtProxy();
 
-    do {
-        vp->readBlob(vaddr++, (uint8_t*)dst++, 1);
-    } while (len < maxlen && start[len++] != 0 );
+    bool foundNull = false;
+    while ((dst - start + 1) < maxlen && !foundNull) {
+        vp->readBlob(vaddr++, (uint8_t*)dst, 1);
+        if (dst == '\0')
+            foundNull = true;
+        dst++;
+    }
 
-    dst[len] = 0;
+    if (!foundNull)
+        *dst = '\0';
 }
 
 void