From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56889) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z8UxH-00041j-72 for qemu-devel@nongnu.org; Fri, 26 Jun 2015 10:50:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z8UxC-0001bw-9O for qemu-devel@nongnu.org; Fri, 26 Jun 2015 10:50:11 -0400 Received: from mail-qg0-x236.google.com ([2607:f8b0:400d:c04::236]:34284) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z8UxC-0001bR-6U for qemu-devel@nongnu.org; Fri, 26 Jun 2015 10:50:06 -0400 Received: by qgev13 with SMTP id v13so35962534qge.1 for ; Fri, 26 Jun 2015 07:50:05 -0700 (PDT) From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Fri, 26 Jun 2015 16:49:09 +0200 Message-Id: <1435330185-23248-4-git-send-email-marcandre.lureau@gmail.com> In-Reply-To: <1435330185-23248-1-git-send-email-marcandre.lureau@gmail.com> References: <1435330185-23248-1-git-send-email-marcandre.lureau@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH 03/39] ivhsmem: read do not accept more than sizeof(long) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: cam@cs.ualberta.ca, =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= , stefanha@redhat.com ivshmem_read() only reads sizeof(long) from the input buffer. Accepting more could lead to fifo8 abort() on x86 if it's not empty. Signed-off-by: Marc-André Lureau --- hw/misc/ivshmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index cc76989..fb53b3f 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -272,7 +272,7 @@ static void ivshmem_receive(void *opaque, const uint8_t *buf, int size) static int ivshmem_can_receive(void * opaque) { - return 8; + return sizeof(long); } static void ivshmem_event(void *opaque, int event) -- 2.4.3