diff options
| author |   Stefan Hajnoczi <stefanha@redhat.com> | 2014-09-15 18:40:05 +0200 |
|---|---|---|
| committer |   Paolo Bonzini <pbonzini@redhat.com> | 2014-10-31 17:01:44 +0100 |
| commit | a2e9011b4164894594bf0b2a2a59e9c55c58c17b (patch) | |
| tree | 944ce67af7f759c6fa731e9d15c85385ef8e2c0d /scripts/switch-timer-api | |
| parent | i386: fix breakpoints handling in icount mode (diff) | |
| download | qemu-a2e9011b4164894594bf0b2a2a59e9c55c58c17b.tar.xz qemu-a2e9011b4164894594bf0b2a2a59e9c55c58c17b.zip | |
ivshmem: Check ivshmem_read() size argument
The third argument to the fd_read() callback implemented by
ivshmem_read() is the number of bytes, not a flags field. Fix this and
check we received enough bytes before accessing the buffer pointer.
Cc: Cam Macdonell <cam@cs.ualberta.ca>
Reported-by: Sebastian Krahmer <krahmer@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
[AF: Handle partial reads via FIFO]
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'scripts/switch-timer-api')
0 files changed, 0 insertions, 0 deletions