From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35170) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZgvTL-0002fo-KQ for qemu-devel@nongnu.org; Tue, 29 Sep 2015 10:01:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZgvTG-0003Xu-2b for qemu-devel@nongnu.org; Tue, 29 Sep 2015 10:01:35 -0400 Received: from mx6-phx2.redhat.com ([209.132.183.39]:56121) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZgvTF-0003Xj-R3 for qemu-devel@nongnu.org; Tue, 29 Sep 2015 10:01:30 -0400 Date: Tue, 29 Sep 2015 10:01:19 -0400 (EDT) From: =?utf-8?Q?Marc-Andr=C3=A9?= Lureau Message-ID: <1354861209.19834077.1443535279478.JavaMail.zimbra@redhat.com> In-Reply-To: <560A967C.1080602@huawei.com> References: <1443094669-4144-1-git-send-email-marcandre.lureau@redhat.com> <1443094669-4144-33-git-send-email-marcandre.lureau@redhat.com> <560A967C.1080602@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH v4 32/47] ivshmem-client: check the number of vectors List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Claudio Fontana Cc: drjones@redhat.com, qemu-devel@nongnu.org, stefanha@redhat.com, pbonzini@redhat.com, marcandre lureau , cam@cs.ualberta.ca ----- Original Message ----- > On 24.09.2015 13:37, marcandre.lureau@redhat.com wrote: > > From: Marc-Andr=C3=A9 Lureau > >=20 > > Check the number of vectors received from the server, to avoid > > out of bound array access. > >=20 > > Signed-off-by: Marc-Andr=C3=A9 Lureau > > --- > > contrib/ivshmem-client/ivshmem-client.c | 4 ++++ > > 1 file changed, 4 insertions(+) > >=20 > > diff --git a/contrib/ivshmem-client/ivshmem-client.c > > b/contrib/ivshmem-client/ivshmem-client.c > > index 11c805c..01e24a7 100644 > > --- a/contrib/ivshmem-client/ivshmem-client.c > > +++ b/contrib/ivshmem-client/ivshmem-client.c > > @@ -128,6 +128,10 @@ ivshmem_client_handle_server_msg(IvshmemClient > > *client) > > /* new vector */ > > IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=3D%d) for peer i= d > > %ld\n", > > peer->vectors_count, fd, peer->id); > > + if (peer->vectors_count >=3D G_N_ELEMENTS(peer->vectors)) { > > + return -1; > > + } >=20 > Anything we want to print with IVSHMEM_CLIENT_DEBUG ? > The caller will only spew a "ivshmem_client_handle_server_msg() failed\n"= in > this case. It could be deduced looking at the above new vector debug and the error, bu= t better be more explicit:=20 "Too many vector received, failing" ? >=20 > > + > > peer->vectors[peer->vectors_count] =3D fd; > > peer->vectors_count++; > > =20 > >=20 >=20 >=20 >=20