mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

monitor: check return value of qemu_find_net_clients_except()

Browse Source 
qemu_find_net_clients_except() may return a value which is greater
than the size of array we provided. So we should check this value
before using it, otherwise this may cause unexpected memory access.

This patch fixes the net related command completion when we have a
virtio-net nic with more than 255 queues.

Cc: Luiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Jason Wang 2015-04-23 14:21:39 +08:00 committed by Michael S. Tsirkin
parent eaed483c1b
commit bcfa4d6014
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
monitor.c
View File

@ -4477,7 +4477,7 @@ void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
count = qemu_find_net_clients_except(NULL, ncs, count = qemu_find_net_clients_except(NULL, ncs,
NET_CLIENT_OPTIONS_KIND_NONE, NET_CLIENT_OPTIONS_KIND_NONE,
MAX_QUEUE_NUM); MAX_QUEUE_NUM);
for (i = 0; i < count; i++) { for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
const char *name = ncs[i]->name; const char *name = ncs[i]->name;
if (!strncmp(str, name, len)) { if (!strncmp(str, name, len)) {
readline_add_completion(rs, name); readline_add_completion(rs, name);
@ -4502,7 +4502,7 @@ void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
readline_set_completion_index(rs, len); readline_set_completion_index(rs, len);
count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC, count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_OPTIONS_KIND_NIC,
MAX_QUEUE_NUM); MAX_QUEUE_NUM);
for (i = 0; i < count; i++) { for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
QemuOpts *opts; QemuOpts *opts;
const char *name = ncs[i]->name; const char *name = ncs[i]->name;
if (strncmp(str, name, len)) { if (strncmp(str, name, len)) {
@ -4576,7 +4576,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str)
count = qemu_find_net_clients_except(NULL, ncs, count = qemu_find_net_clients_except(NULL, ncs,
NET_CLIENT_OPTIONS_KIND_NONE, NET_CLIENT_OPTIONS_KIND_NONE,
MAX_QUEUE_NUM); MAX_QUEUE_NUM);
for (i = 0; i < count; i++) { for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
int id; int id;
char name[16]; char name[16];
@ -4593,7 +4593,7 @@ void host_net_remove_completion(ReadLineState *rs, int nb_args, const char *str)
count = qemu_find_net_clients_except(NULL, ncs, count = qemu_find_net_clients_except(NULL, ncs,
NET_CLIENT_OPTIONS_KIND_NIC, NET_CLIENT_OPTIONS_KIND_NIC,
MAX_QUEUE_NUM); MAX_QUEUE_NUM);
for (i = 0; i < count; i++) { for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
int id; int id;
const char *name; const char *name;