From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57987) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YlAWq-0007vF-Bn for qemu-devel@nongnu.org; Thu, 23 Apr 2015 02:22:29 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YlAWp-0001dP-GP for qemu-devel@nongnu.org; Thu, 23 Apr 2015 02:22:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35175) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YlAWp-0001d3-BQ for qemu-devel@nongnu.org; Thu, 23 Apr 2015 02:22:27 -0400 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id EB3298E3C0 for ; Thu, 23 Apr 2015 06:22:26 +0000 (UTC) From: Jason Wang Date: Thu, 23 Apr 2015 14:21:39 +0800 Message-Id: <1429770109-23873-7-git-send-email-jasowang@redhat.com> In-Reply-To: <1429770109-23873-1-git-send-email-jasowang@redhat.com> References: <1429770109-23873-1-git-send-email-jasowang@redhat.com> Subject: [Qemu-devel] [PATCH V7 06/16] monitor: check return value of qemu_find_net_clients_except() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Jason Wang , Luiz Capitulino , mst@redhat.com qemu_find_net_clients_except() may return a value which is greater than the size of array we provided. So we should check this value before using it, otherwise this may cause unexpected memory access. This patch fixes the net related command completion when we have a virtio-net nic with more than 255 queues. Cc: Luiz Capitulino Signed-off-by: Jason Wang --- monitor.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/monitor.c b/monitor.c index a039edf..2b5643d 100644 --- a/monitor.c +++ b/monitor.c @@ -4477,7 +4477,7 @@ void set_link_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NONE, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { const char *name = ncs[i]->name; if (!strncmp(str, name, len)) { readline_add_completion(rs, name); @@ -4502,7 +4502,7 @@ void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str) readline_set_completion_index(rs, len); count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { QemuOpts *opts; const char *name = ncs[i]->name; if (strncmp(str, name, len)) { @@ -4576,7 +4576,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NONE, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { int id; char name[16]; @@ -4593,7 +4593,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str) count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC, MAX_QUEUE_NUM); - for (i = 0; i < count; i++) { + for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) { int id; const char *name; -- 2.1.0