diff mbox

[03/39] ivhsmem: read do not accept more than sizeof(long)

Message ID 1435330185-23248-4-git-send-email-marcandre.lureau@gmail.com
State New
Headers show

Commit Message

Marc-André Lureau June 26, 2015, 2:49 p.m. UTC 
ivshmem_read() only reads sizeof(long) from the input buffer.  Accepting
more could lead to fifo8 abort() on x86 if it's not empty.

Signed-off-by: Marc-André Lureau <marcandre.lureau@gmail.com>
---
 hw/misc/ivshmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index cc76989..fb53b3f 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -272,7 +272,7 @@  static void ivshmem_receive(void *opaque, const uint8_t *buf, int size)
 
 static int ivshmem_can_receive(void * opaque)
 {
-    return 8;
+    return sizeof(long);
 }
 
 static void ivshmem_event(void *opaque, int event)