From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47475) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XW222-0005xB-Kj for qemu-devel@nongnu.org; Mon, 22 Sep 2014 07:43:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XW21w-0007sB-EO for qemu-devel@nongnu.org; Mon, 22 Sep 2014 07:43:50 -0400 Received: from mx1.redhat.com ([209.132.183.28]:3319) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XW21w-0007qi-3s for qemu-devel@nongnu.org; Mon, 22 Sep 2014 07:43:44 -0400 From: Stefan Hajnoczi Date: Mon, 22 Sep 2014 12:41:58 +0100 Message-Id: <1411386150-24003-28-git-send-email-stefanha@redhat.com> In-Reply-To: <1411386150-24003-1-git-send-email-stefanha@redhat.com> References: <1411386150-24003-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL v2 27/59] aio-win32: avoid out-of-bounds access to the events array List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Paolo Bonzini From: Paolo Bonzini If ret is WAIT_TIMEOUT and there was an event returned by select(), we can write to a location after the end of the array. But in that case we can retry the WaitForMultipleObjects call with the same set of events, so just move the event[ret - WAIT_OBJECT_0] assignment inside the existin conditional. Reported-by: TeLeMan Signed-off-by: Paolo Bonzini Reviewed-by: TeLeMan Signed-off-by: Stefan Hajnoczi --- aio-win32.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/aio-win32.c b/aio-win32.c index 7daeae1..d81313b 100644 --- a/aio-win32.c +++ b/aio-win32.c @@ -335,6 +335,7 @@ bool aio_poll(AioContext *ctx, bool blocking) event = NULL; if ((DWORD) (ret - WAIT_OBJECT_0) < count) { event = events[ret - WAIT_OBJECT_0]; + events[ret - WAIT_OBJECT_0] = events[--count]; } else if (!have_select_revents) { break; } @@ -343,9 +344,6 @@ bool aio_poll(AioContext *ctx, bool blocking) blocking = false; progress |= aio_dispatch_handlers(ctx, event); - - /* Try again, but only call each handler once. */ - events[ret - WAIT_OBJECT_0] = events[--count]; } progress |= timerlistgroup_run_timers(&ctx->tlg); -- 1.9.3