diff mbox

ivshmem-server: fix possible OVERRUN

Message ID 1446426828-18084-1-git-send-email-arei.gonglei@huawei.com
State New
Headers show

Commit Message

Gonglei (Arei) Nov. 2, 2015, 1:13 a.m. UTC 
From: Gonglei <arei.gonglei@huawei.com>

>>>     CID 1337991:  Memory - illegal accesses  (OVERRUN)
>>>     Decrementing "i". The value of "i" is now 65534.
218         while (i--) {
219             event_notifier_cleanup(&peer->vectors[i]);
220         }

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
---
 contrib/ivshmem-server/ivshmem-server.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Marc-Andre Lureau Nov. 2, 2015, 2:20 p.m. UTC | #1 
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

----- Original Message -----
> From: Gonglei <arei.gonglei@huawei.com>
> 
> >>>     CID 1337991:  Memory - illegal accesses  (OVERRUN)
> >>>     Decrementing "i". The value of "i" is now 65534.
> 218         while (i--) {
> 219             event_notifier_cleanup(&peer->vectors[i]);
> 220         }
> 
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
>  contrib/ivshmem-server/ivshmem-server.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/contrib/ivshmem-server/ivshmem-server.c
> b/contrib/ivshmem-server/ivshmem-server.c
> index 5e5239c..d9e26b0 100644
> --- a/contrib/ivshmem-server/ivshmem-server.c
> +++ b/contrib/ivshmem-server/ivshmem-server.c
> @@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
>      }
>      if (i == G_MAXUINT16) {
>          IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
> -        goto fail;
> +        close(newfd);
> +        g_free(peer);
> +        return -1;
>      }
>      peer->id = server->cur_id++;
>  
> --
> 1.7.12.4
> 
> 
>
Michael Tokarev Nov. 3, 2015, 12:14 p.m. UTC | #2 
Applied to -trivial, thanks!

/mjt
diff mbox

Patch

diff --git a/contrib/ivshmem-server/ivshmem-server.c b/contrib/ivshmem-server/ivshmem-server.c
index 5e5239c..d9e26b0 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -168,7 +168,9 @@  ivshmem_server_handle_new_conn(IvshmemServer *server)
     }
     if (i == G_MAXUINT16) {
         IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
-        goto fail;
+        close(newfd);
+        g_free(peer);
+        return -1;
     }
     peer->id = server->cur_id++;