[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN
From: |
arei.gonglei |
Subject: |
[Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN |
Date: |
Mon, 2 Nov 2015 09:13:48 +0800 |
From: Gonglei <address@hidden>
>>> CID 1337991: Memory - illegal accesses (OVERRUN)
>>> Decrementing "i". The value of "i" is now 65534.
218 while (i--) {
219 event_notifier_cleanup(&peer->vectors[i]);
220 }
Signed-off-by: Gonglei <address@hidden>
---
contrib/ivshmem-server/ivshmem-server.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/contrib/ivshmem-server/ivshmem-server.c
b/contrib/ivshmem-server/ivshmem-server.c
index 5e5239c..d9e26b0 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -168,7 +168,9 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
}
if (i == G_MAXUINT16) {
IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
- goto fail;
+ close(newfd);
+ g_free(peer);
+ return -1;
}
peer->id = server->cur_id++;
--
1.7.12.4
- [Qemu-devel] [PATCH] ivshmem-server: fix possible OVERRUN,
arei.gonglei <=