diff options
| author | Gonglei <arei.gonglei@huawei.com> | 2015-11-02 09:13:48 +0800 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2015-11-06 15:42:38 +0300 |
| commit | 258133bda9a6f22ba436ef9b63b7c086cc80190b (patch) | |
| tree | 107c9ad242888b543457db4bedf893b2b91f0ad8 | |
| parent | 6268520d7df9b3f183bb4397218c9287441bc04f (diff) | |
| download | hqemu-258133bda9a6f22ba436ef9b63b7c086cc80190b.zip hqemu-258133bda9a6f22ba436ef9b63b7c086cc80190b.tar.gz | |
ivshmem-server: fix possible OVERRUN
>>> CID 1337991: Memory - illegal accesses (OVERRUN)
>>> Decrementing "i". The value of "i" is now 65534.
218 while (i--) {
219 event_notifier_cleanup(&peer->vectors[i]);
220 }
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | contrib/ivshmem-server/ivshmem-server.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/contrib/ivshmem-server/ivshmem-server.c b/contrib/ivshmem-server/ivshmem-server.c index 5e5239c..d9e26b0 100644 --- a/contrib/ivshmem-server/ivshmem-server.c +++ b/contrib/ivshmem-server/ivshmem-server.c @@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server) } if (i == G_MAXUINT16) { IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n"); - goto fail; + close(newfd); + g_free(peer); + return -1; } peer->id = server->cur_id++; |
