From 95204aa951ceb28eb6d4ce43bce09a58cbad83d8 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 23 Jun 2015 16:41:58 +0200 Subject: [PATCH] ivshmem-client: check the number of vectors MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Check the number of vectors received from the server, to avoid out of bound array access. Signed-off-by: Marc-André Lureau Reviewed-by: Claudio Fontana --- contrib/ivshmem-client/ivshmem-client.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c index fcc0930eb6..bfaf584ba7 100644 --- a/contrib/ivshmem-client/ivshmem-client.c +++ b/contrib/ivshmem-client/ivshmem-client.c @@ -128,6 +128,11 @@ ivshmem_client_handle_server_msg(IvshmemClient *client) /* new vector */ IVSHMEM_CLIENT_DEBUG(client, " new vector %d (fd=%d) for peer id %ld\n", peer->vectors_count, fd, peer->id); + if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) { + IVSHMEM_CLIENT_DEBUG(client, "Too many vectors received, failing"); + return -1; + } + peer->vectors[peer->vectors_count] = fd; peer->vectors_count++; -- 2.11.0