From patchwork Wed Mar 18 09:34:55 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 451310 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id EAB8E14008F for ; Wed, 18 Mar 2015 20:42:52 +1100 (AEDT) Received: from localhost ([::1]:60488 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYAV0-00034x-RS for incoming@patchwork.ozlabs.org; Wed, 18 Mar 2015 05:42:50 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59253) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYAO0-0006re-Sy for qemu-devel@nongnu.org; Wed, 18 Mar 2015 05:35:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YYANw-0005bf-3i for qemu-devel@nongnu.org; Wed, 18 Mar 2015 05:35:36 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34481) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YYANv-0005bW-Ve for qemu-devel@nongnu.org; Wed, 18 Mar 2015 05:35:32 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 8DD5F2BCD81; Wed, 18 Mar 2015 09:35:31 +0000 (UTC) Received: from jason-ThinkPad-T430s.nay.redhat.com ([10.66.70.106]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t2I9ZBAC027132; Wed, 18 Mar 2015 05:35:29 -0400 From: Jason Wang To: qemu-devel@nongnu.org Date: Wed, 18 Mar 2015 17:34:55 +0800 Message-Id: <1426671309-13645-6-git-send-email-jasowang@redhat.com> In-Reply-To: <1426671309-13645-1-git-send-email-jasowang@redhat.com> References: <1426671309-13645-1-git-send-email-jasowang@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: cornelia.huck@de.ibm.com, Jason Wang , Luiz Capitulino , mst@redhat.com Subject: [Qemu-devel] [PATCH V4 05/19] monitor: check return value of qemu_find_net_clients_except() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org qemu_find_net_clients_except() may return a value which is greater than the size of array we provided. So we should check this value before using it, otherwise this may cause unexpected memory access. This patch fixes the net related command completion when we have a virtio-net nic with more than 255 queues. Cc: Luiz Capitulino Signed-off-by: Jason Wang --- monitor.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/monitor.c b/monitor.c index 07dfed0..3c0abfd 100644 --- a/monitor.c +++ b/monitor.c @@ -4480,7 +4480,7 @@ void set_link_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NONE, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { const char *name = ncs[i]->name; if (!strncmp(str, name, len)) { readline_add_completion(rs, name); @@ -4505,7 +4505,7 @@ void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str) readline_set_completion_index(rs, len); count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { QemuOpts *opts; const char *name = ncs[i]->name; if (strncmp(str, name, len)) { @@ -4579,7 +4579,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NONE, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { int id; char name[16]; @@ -4596,7 +4596,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { int id; const char *name;