[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/2] ivshmem: check ivshmem_read() size argument
From: |
Peter Maydell |
Subject: |
Re: [Qemu-devel] [PATCH 1/2] ivshmem: check ivshmem_read() size argument |
Date: |
Mon, 14 Apr 2014 16:33:52 +0100 |
On 31 March 2014 08:08, Stefan Hajnoczi <address@hidden> wrote:
> The third argument to the fd_read() callback implemented by
> ivshmem_read() is the number of bytes, not a flags field. Fix this and
> check we received enough bytes before accessing the buffer pointer.
>
> Cc: Cam Macdonell <address@hidden>
> Reported-by: Sebastian Krahmer <address@hidden>
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> ---
> hw/misc/ivshmem.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
> index 8d144ba..78363ce 100644
> --- a/hw/misc/ivshmem.c
> +++ b/hw/misc/ivshmem.c
> @@ -420,13 +420,18 @@ static void increase_dynamic_storage(IVShmemState *s,
> int new_min_size) {
> }
> }
>
> -static void ivshmem_read(void *opaque, const uint8_t * buf, int flags)
> +static void ivshmem_read(void *opaque, const uint8_t * buf, int size)
> {
> IVShmemState *s = opaque;
> int incoming_fd, tmp_fd;
> int guest_max_eventfd;
> long incoming_posn;
>
> + if (size < sizeof(incoming_posn)) {
> + IVSHMEM_DPRINTF("short read of %d bytes\n", size);
> + return;
> + }
> +
Looking at the qemu-chr API I'm not sure this is correct:
aren't we going to throw away data here? My guess is that we
need to save the half-a-word so we can use it when the
other half arrives in a subsequent call.
thanks
-- PMM
- Re: [Qemu-devel] [PATCH 1/2] ivshmem: check ivshmem_read() size argument,
Peter Maydell <=