[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-trivial] [PATCH] ivshmem-server: fix possible OVERRUN
From: |
Marc-André Lureau |
Subject: |
Re: [Qemu-trivial] [PATCH] ivshmem-server: fix possible OVERRUN |
Date: |
Mon, 2 Nov 2015 09:20:32 -0500 (EST) |
Reviewed-by: Marc-André Lureau <address@hidden>
----- Original Message -----
> From: Gonglei <address@hidden>
>
> >>> CID 1337991: Memory - illegal accesses (OVERRUN)
> >>> Decrementing "i". The value of "i" is now 65534.
> 218 while (i--) {
> 219 event_notifier_cleanup(&peer->vectors[i]);
> 220 }
>
> Signed-off-by: Gonglei <address@hidden>
> ---
> contrib/ivshmem-server/ivshmem-server.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/contrib/ivshmem-server/ivshmem-server.c
> b/contrib/ivshmem-server/ivshmem-server.c
> index 5e5239c..d9e26b0 100644
> --- a/contrib/ivshmem-server/ivshmem-server.c
> +++ b/contrib/ivshmem-server/ivshmem-server.c
> @@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
> }
> if (i == G_MAXUINT16) {
> IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
> - goto fail;
> + close(newfd);
> + g_free(peer);
> + return -1;
> }
> peer->id = server->cur_id++;
>
> --
> 1.7.12.4
>
>
>