[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 04/39] ivshmem: fix number of bytes to push to fifo
From: |
Marc-André Lureau |
Subject: |
[Qemu-devel] [PATCH 04/39] ivshmem: fix number of bytes to push to fifo |
Date: |
Fri, 26 Jun 2015 16:49:10 +0200 |
If the fifo has 0 bytes, and the read is of size 1, the call to
fifo8_push_all() will copy out of bounds data.
Signed-off-by: Marc-André Lureau <address@hidden>
---
hw/misc/ivshmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index fb53b3f..2162d02 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -455,7 +455,7 @@ static void ivshmem_read(void *opaque, const uint8_t *buf,
int size)
uint32_t num;
IVSHMEM_DPRINTF("short read of %d bytes\n", size);
- num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
+ num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
fifo8_push_all(&s->incoming_fifo, buf, num);
if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {
return;
--
2.4.3
- [Qemu-devel] [PATCH 00/39] ivshmem server/client, cleanups & test, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 01/39] char: add qemu_chr_free(), Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 02/39] msix: add VMSTATE_MSIX_TEST, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 04/39] ivshmem: fix number of bytes to push to fifo,
Marc-André Lureau <=
- [Qemu-devel] [PATCH 05/39] ivshmem: factor out the incoming fifo handling, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 03/39] ivhsmem: read do not accept more than sizeof(long), Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 07/39] ivshmem: remove superflous ivshmem_attr field, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 08/39] ivshmem: remove useless doorbell field, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 06/39] ivshmem: remove unnecessary dup(), Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 09/39] ivshmem: more qdev conversion, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 10/39] ivshmem: remove last exit(1), Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 11/39] ivshmem: increase_dynamic_storage() improvements, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 13/39] ivshmem: initialize max_peer to -1, Marc-André Lureau, 2015/06/26
- [Qemu-devel] [PATCH 12/39] ivshmem: remove useless ivshmem_update_irq() val argument, Marc-André Lureau, 2015/06/26