* [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN
@ 2015-11-02 1:13 arei.gonglei
2015-11-02 14:20 ` Marc-André Lureau
2015-11-03 12:14 ` Michael Tokarev
0 siblings, 2 replies; 3+ messages in thread
From: arei.gonglei @ 2015-11-02 1:13 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-trivial, marcandre.lureau, Gonglei
From: Gonglei <arei.gonglei@huawei.com>
>>> CID 1337991: Memory - illegal accesses (OVERRUN)
>>> Decrementing "i". The value of "i" is now 65534.
218 while (i--) {
219 event_notifier_cleanup(&peer->vectors[i]);
220 }
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
---
contrib/ivshmem-server/ivshmem-server.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/contrib/ivshmem-server/ivshmem-server.c b/contrib/ivshmem-server/ivshmem-server.c
index 5e5239c..d9e26b0 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
}
if (i == G_MAXUINT16) {
IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
- goto fail;
+ close(newfd);
+ g_free(peer);
+ return -1;
}
peer->id = server->cur_id++;
--
1.7.12.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN
2015-11-02 1:13 [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN arei.gonglei
@ 2015-11-02 14:20 ` Marc-André Lureau
2015-11-03 12:14 ` Michael Tokarev
1 sibling, 0 replies; 3+ messages in thread
From: Marc-André Lureau @ 2015-11-02 14:20 UTC (permalink / raw)
To: arei gonglei; +Cc: qemu-trivial, marcandre lureau, qemu-devel
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
----- Original Message -----
> From: Gonglei <arei.gonglei@huawei.com>
>
> >>> CID 1337991: Memory - illegal accesses (OVERRUN)
> >>> Decrementing "i". The value of "i" is now 65534.
> 218 while (i--) {
> 219 event_notifier_cleanup(&peer->vectors[i]);
> 220 }
>
> Signed-off-by: Gonglei <arei.gonglei@huawei.com>
> ---
> contrib/ivshmem-server/ivshmem-server.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/contrib/ivshmem-server/ivshmem-server.c
> b/contrib/ivshmem-server/ivshmem-server.c
> index 5e5239c..d9e26b0 100644
> --- a/contrib/ivshmem-server/ivshmem-server.c
> +++ b/contrib/ivshmem-server/ivshmem-server.c
> @@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
> }
> if (i == G_MAXUINT16) {
> IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
> - goto fail;
> + close(newfd);
> + g_free(peer);
> + return -1;
> }
> peer->id = server->cur_id++;
>
> --
> 1.7.12.4
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN
2015-11-02 1:13 [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN arei.gonglei
2015-11-02 14:20 ` Marc-André Lureau
@ 2015-11-03 12:14 ` Michael Tokarev
1 sibling, 0 replies; 3+ messages in thread
From: Michael Tokarev @ 2015-11-03 12:14 UTC (permalink / raw)
To: arei.gonglei, qemu-devel; +Cc: qemu-trivial, marcandre.lureau
Applied to -trivial, thanks!
/mjt
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-11-03 12:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-11-02 1:13 [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN arei.gonglei
2015-11-02 14:20 ` Marc-André Lureau
2015-11-03 12:14 ` Michael Tokarev
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.