[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] aio-win32: avoid out-of-bounds access to the ev
From: |
TeLeMan |
Subject: |
Re: [Qemu-devel] [PATCH] aio-win32: avoid out-of-bounds access to the events array |
Date: |
Tue, 16 Sep 2014 10:21:10 +0800 |
On Mon, Sep 15, 2014 at 8:52 PM, Paolo Bonzini <address@hidden> wrote:
> If ret is WAIT_TIMEOUT and there was an event returned by select(),
> we can write to a location after the end of the array. But in
> that case we can retry the WaitForMultipleObjects call with the
> same set of events, so just move the event[ret - WAIT_OBJECT_0]
> assignment inside the existin conditional.
>
> Reported-by: TeLeMan <address@hidden>
> Signed-off-by: Paolo Bonzini <address@hidden>
> ---
> aio-win32.c | 4 +---
> 1 file changed, 1 insertion(+), 3 deletions(-)
>
> diff --git a/aio-win32.c b/aio-win32.c
> index 61e3d2d..89f9e1f 100644
> --- a/aio-win32.c
> +++ b/aio-win32.c
> @@ -335,6 +335,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
> event = NULL;
> if ((DWORD) (ret - WAIT_OBJECT_0) < count) {
> event = events[ret - WAIT_OBJECT_0];
> + events[ret - WAIT_OBJECT_0] = events[--count];
> } else if (!have_select_revents) {
> break;
> }
> @@ -343,9 +344,6 @@ bool aio_poll(AioContext *ctx, bool blocking)
> blocking = false;
>
> progress |= aio_dispatch_handlers(ctx, event);
> -
> - /* Try again, but only call each handler once. */
> - events[ret - WAIT_OBJECT_0] = events[--count];
> }
>
> progress |= timerlistgroup_run_timers(&ctx->tlg);
> --
> 2.1.0
>
Reviewed-by: TeLeMan <address@hidden>