From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:56449)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Claudio.Fontana@huawei.com>) id 1ZgvG2-0004YX-9J
	for qemu-devel@nongnu.org; Tue, 29 Sep 2015 09:47:54 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <Claudio.Fontana@huawei.com>) id 1ZgvFy-0005Uc-6i
	for qemu-devel@nongnu.org; Tue, 29 Sep 2015 09:47:50 -0400
Received: from lhrrgout.huawei.com ([194.213.3.17]:59431)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Claudio.Fontana@huawei.com>) id 1ZgvFx-0005UG-2H
	for qemu-devel@nongnu.org; Tue, 29 Sep 2015 09:47:46 -0400
References: <1443094669-4144-1-git-send-email-marcandre.lureau@redhat.com>
	<1443094669-4144-33-git-send-email-marcandre.lureau@redhat.com>
From: Claudio Fontana <claudio.fontana@huawei.com>
Message-ID: <560A967C.1080602@huawei.com>
Date: Tue, 29 Sep 2015 15:47:40 +0200
MIME-Version: 1.0
In-Reply-To: <1443094669-4144-33-git-send-email-marcandre.lureau@redhat.com>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Subject: Re: [Qemu-devel] [PATCH v4 32/47] ivshmem-client: check the number
	of vectors
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: marcandre.lureau@redhat.com, qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, drjones@redhat.com, cam@cs.ualberta.ca, stefanha@redhat.com

On 24.09.2015 13:37, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> Check the number of vectors received from the server, to avoid
> out of bound array access.
> 
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  contrib/ivshmem-client/ivshmem-client.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c
> index 11c805c..01e24a7 100644
> --- a/contrib/ivshmem-client/ivshmem-client.c
> +++ b/contrib/ivshmem-client/ivshmem-client.c
> @@ -128,6 +128,10 @@ ivshmem_client_handle_server_msg(IvshmemClient *client)
>      /* new vector */
>      IVSHMEM_CLIENT_DEBUG(client, "  new vector %d (fd=%d) for peer id %ld\n",
>                           peer->vectors_count, fd, peer->id);
> +    if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) {
> +        return -1;
> +    }

Anything we want to print with IVSHMEM_CLIENT_DEBUG ?
The caller will only spew a "ivshmem_client_handle_server_msg() failed\n" in this case.

> +
>      peer->vectors[peer->vectors_count] = fd;
>      peer->vectors_count++;
>  
>