A buffer overflow was found in getkeys getkeys()

When calculating the greatest possible number of matching keys in getkeys(), the current expression

MIN (1, ks->nrkeys)

is wrong -- it will return at most 1.

If all "nrkeys" keys match however, then we require "nrkeys" non-NULL entries in the result array; in other words, we need

MAX (1, ks->nrkeys)

(The comment just above the expression is correct; the code is wrong.)

This buffer overflow is easiest to trigger in those guestfs tools that parse the "--key" option in C; that is, with "OPTIONkey". For example, the command

$ virt-cat $(seq -f '--key /dev/sda2:key:%g' 200) -d DOMAIN /no-such-file

which passes 200 (different) passphrases for the LUKS-encrypted block device "/dev/sda2", crashes with a SIGSEGV.

Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.

virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.