* [Qemu-devel] [PATCH] gtk: avoid oob array access
@ 2016-12-07 10:55 Marc-André Lureau
2017-01-04 9:01 ` Gerd Hoffmann
0 siblings, 1 reply; 2+ messages in thread
From: Marc-André Lureau @ 2016-12-07 10:55 UTC (permalink / raw)
To: qemu-devel; +Cc: kraxel, Marc-André Lureau
When too many consoles are created, vcs[] may be write out-of-bounds.
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
ui/gtk.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/ui/gtk.c b/ui/gtk.c
index e81642876a..67c52179ee 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1696,6 +1696,11 @@ static CharDriverState *gd_vc_handler(ChardevVC *vc, Error **errp)
ChardevCommon *common = qapi_ChardevVC_base(vc);
CharDriverState *chr;
+ if (nb_vcs == MAX_VCS) {
+ error_setg(errp, "Maximum number of consoles reached");
+ return NULL;
+ }
+
chr = qemu_chr_alloc(common, errp);
if (!chr) {
return NULL;
--
2.11.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [Qemu-devel] [PATCH] gtk: avoid oob array access
2016-12-07 10:55 [Qemu-devel] [PATCH] gtk: avoid oob array access Marc-André Lureau
@ 2017-01-04 9:01 ` Gerd Hoffmann
0 siblings, 0 replies; 2+ messages in thread
From: Gerd Hoffmann @ 2017-01-04 9:01 UTC (permalink / raw)
To: Marc-André Lureau; +Cc: qemu-devel
On Mi, 2016-12-07 at 13:55 +0300, Marc-André Lureau wrote:
> When too many consoles are created, vcs[] may be write out-of-bounds.
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
> ui/gtk.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/ui/gtk.c b/ui/gtk.c
> index e81642876a..67c52179ee 100644
> --- a/ui/gtk.c
> +++ b/ui/gtk.c
> @@ -1696,6 +1696,11 @@ static CharDriverState *gd_vc_handler(ChardevVC *vc, Error **errp)
> ChardevCommon *common = qapi_ChardevVC_base(vc);
> CharDriverState *chr;
>
> + if (nb_vcs == MAX_VCS) {
> + error_setg(errp, "Maximum number of consoles reached");
> + return NULL;
> + }
> +
> chr = qemu_chr_alloc(common, errp);
> if (!chr) {
> return NULL;
added to ui queue.
thanks,
Gerd
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-01-04 9:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-12-07 10:55 [Qemu-devel] [PATCH] gtk: avoid oob array access Marc-André Lureau
2017-01-04 9:01 ` Gerd Hoffmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).