[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH v2 04/45] ivshmem: fix number of bytes to push to fi

From: Marc-André Lureau
Subject: [Qemu-devel] [PATCH v2 04/45] ivshmem: fix number of bytes to push to fifo
Date: Tue, 28 Jul 2015 02:32:16 +0200

From: Marc-André Lureau <address@hidden>

If the fifo has 0 bytes, and the read is of size 1, the call to
fifo8_push_all() will copy out of bounds data.

Signed-off-by: Marc-André Lureau <address@hidden>
 hw/misc/ivshmem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index fb53b3f..2162d02 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -455,7 +455,7 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, 
int size)
         uint32_t num;
         IVSHMEM_DPRINTF("short read of %d bytes\n", size);
-        num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
+        num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
         fifo8_push_all(&s->incoming_fifo, buf, num);
         if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {

reply via email to

[Prev in Thread] Current Thread [Next in Thread]