| Message ID | 1443094669-4144-33-git-send-email-marcandre.lureau@redhat.com |
|---|---|
| State | New |
| Headers | show |
On 24.09.2015 13:37, marcandre.lureau@redhat.com wrote: > From: Marc-André Lureau <marcandre.lureau@redhat.com> > > Check the number of vectors received from the server, to avoid > out of bound array access. > > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > --- > contrib/ivshmem-client/ivshmem-client.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c > index 11c805c..01e24a7 100644 > --- a/contrib/ivshmem-client/ivshmem-client.c > +++ b/contrib/ivshmem-client/ivshmem-client.c > @@ -128,6 +128,10 @@ ivshmem_client_handle_server_msg(IvshmemClient *client) > /* new vector */ > IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id %ld\n", > peer->vectors_count, fd, peer->id); > + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { > + return -1; > + } Anything we want to print with IVSHMEM_CLIENT_DEBUG ? The caller will only spew a "ivshmem_client_handle_server_msg() failed\n" in this case. > + > peer->vectors[peer->vectors_count] = fd; > peer->vectors_count++; > >
----- Original Message ----- > On 24.09.2015 13:37, marcandre.lureau@redhat.com wrote: > > From: Marc-André Lureau <marcandre.lureau@redhat.com> > > > > Check the number of vectors received from the server, to avoid > > out of bound array access. > > > > Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> > > --- > > contrib/ivshmem-client/ivshmem-client.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/contrib/ivshmem-client/ivshmem-client.c > > b/contrib/ivshmem-client/ivshmem-client.c > > index 11c805c..01e24a7 100644 > > --- a/contrib/ivshmem-client/ivshmem-client.c > > +++ b/contrib/ivshmem-client/ivshmem-client.c > > @@ -128,6 +128,10 @@ ivshmem_client_handle_server_msg(IvshmemClient > > *client) > > /* new vector */ > > IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id > > %ld\n", > > peer->vectors_count, fd, peer->id); > > + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { > > + return -1; > > + } > > Anything we want to print with IVSHMEM_CLIENT_DEBUG ? > The caller will only spew a "ivshmem_client_handle_server_msg() failed\n" in > this case. It could be deduced looking at the above new vector debug and the error, but better be more explicit: "Too many vector received, failing" ? > > > + > > peer->vectors[peer->vectors_count] = fd; > > peer->vectors_count++; > > > > > > >
diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c index 11c805c..01e24a7 100644 --- a/contrib/ivshmem-client/ivshmem-client.c +++ b/contrib/ivshmem-client/ivshmem-client.c @@ -128,6 +128,10 @@ ivshmem_client_handle_server_msg(IvshmemClient *client) /* new vector */ IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id %ld\n", peer->vectors_count, fd, peer->id); + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { + return -1; + } + peer->vectors[peer->vectors_count] = fd; peer->vectors_count++;