launch: appliance: Handle non-\0 terminated buffer correctly.

The read_all function is used as a callback for

  guestfs___cmd_set_stdout_callback (cmd, read_all, [str],
                                     CMD_STDOUT_FLAG_WHOLE_BUFFER);

As noted in the documentation for CMD_STDOUT_FLAG_WHOLE_BUFFER, the
buffer returned is not \0-terminated, and so using memdup will create
an unterminated string, and therefore potentially a memory overrun
when reading or searching the string.

Use strndup instead so the final string is \0-terminated.

0 files changed, 0 insertions, 0 deletions