]>
Commit | Line | Data |
---|---|---|
879a1e11 WB |
1 | From 1419429813905c95e2648516a8a23ad43e2c7297 Mon Sep 17 00:00:00 2001 |
2 | From: Peter Lieven <pl@kamp.de> | |
3 | Date: Thu, 30 Jun 2016 11:49:40 +0200 | |
4 | Subject: [PATCH 09/10] net: limit allocation in nc_sendv_compat | |
5 | ||
6 | we only need to allocate enough memory to hold the packet. This might be | |
7 | less than NET_BUFSIZE. Additionally fail early if the packet is larger | |
8 | than NET_BUFSIZE. | |
9 | ||
10 | Signed-off-by: Peter Lieven <pl@kamp.de> | |
11 | --- | |
12 | net/net.c | 8 ++++++-- | |
13 | 1 file changed, 6 insertions(+), 2 deletions(-) | |
14 | ||
15 | diff --git a/net/net.c b/net/net.c | |
16 | index 2b9de86..af36a2a 100644 | |
17 | --- a/net/net.c | |
18 | +++ b/net/net.c | |
19 | @@ -692,9 +692,13 @@ static ssize_t nc_sendv_compat(NetClientState *nc, const struct iovec *iov, | |
20 | buffer = iov[0].iov_base; | |
21 | offset = iov[0].iov_len; | |
22 | } else { | |
23 | - buf = g_new(uint8_t, NET_BUFSIZE); | |
24 | + offset = iov_size(iov, iovcnt); | |
25 | + if (offset > NET_BUFSIZE) { | |
26 | + return -1; | |
27 | + } | |
28 | + buf = g_malloc(offset); | |
29 | buffer = buf; | |
30 | - offset = iov_to_buf(iov, iovcnt, 0, buf, NET_BUFSIZE); | |
31 | + offset = iov_to_buf(iov, iovcnt, 0, buf, offset); | |
32 | } | |
33 | ||
34 | if (flags & QEMU_NET_PACKET_FLAG_RAW && nc->info->receive_raw) { | |
35 | -- | |
36 | 2.1.4 | |
37 |