| Message ID | 1443812991-17356-33-git-send-email-marcandre.lureau@redhat.com |
|---|---|
| State | New |
| Headers | show |
On 02.10.2015 21:09, marcandre.lureau@redhat.com wrote: > From: Marc-André Lureau <marcandre.lureau@redhat.com> > > Check the number of vectors received from the server, to avoid > out of bound array access. > > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > --- > contrib/ivshmem-client/ivshmem-client.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c > index 11c805c..34a65b1 100644 > --- a/contrib/ivshmem-client/ivshmem-client.c > +++ b/contrib/ivshmem-client/ivshmem-client.c > @@ -128,6 +128,11 @@ ivshmem_client_handle_server_msg(IvshmemClient *client) > /* new vector */ > IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id %ld\n", > peer->vectors_count, fd, peer->id); > + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { > + IVSHMEM_CLIENT_DEBUG(client, "Too many vector received, failing"); nit: "Too many vectors" Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com> > + return -1; > + } > + > peer->vectors[peer->vectors_count] = fd; > peer->vectors_count++; > >
diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c index 11c805c..34a65b1 100644 --- a/contrib/ivshmem-client/ivshmem-client.c +++ b/contrib/ivshmem-client/ivshmem-client.c @@ -128,6 +128,11 @@ ivshmem_client_handle_server_msg(IvshmemClient *client) /* new vector */ IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id %ld\n", peer->vectors_count, fd, peer->id); + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { + IVSHMEM_CLIENT_DEBUG(client, "Too many vector received, failing"); + return -1; + } + peer->vectors[peer->vectors_count] = fd; peer->vectors_count++;