]>
Commit | Line | Data |
---|---|---|
68a30562 | 1 | From 2705772316ff905f3ed08871c602fca1c636f332 Mon Sep 17 00:00:00 2001 |
879a1e11 WB |
2 | From: Peter Lieven <pl@kamp.de> |
3 | Date: Thu, 30 Jun 2016 11:49:40 +0200 | |
68a30562 | 4 | Subject: [PATCH 3/3] net: limit allocation in nc_sendv_compat |
879a1e11 WB |
5 | |
6 | we only need to allocate enough memory to hold the packet. This might be | |
7 | less than NET_BUFSIZE. Additionally fail early if the packet is larger | |
8 | than NET_BUFSIZE. | |
9 | ||
10 | Signed-off-by: Peter Lieven <pl@kamp.de> | |
11 | --- | |
12 | net/net.c | 8 ++++++-- | |
13 | 1 file changed, 6 insertions(+), 2 deletions(-) | |
14 | ||
15 | diff --git a/net/net.c b/net/net.c | |
68a30562 | 16 | index c94d93d..2ac46a6 100644 |
879a1e11 WB |
17 | --- a/net/net.c |
18 | +++ b/net/net.c | |
68a30562 | 19 | @@ -690,9 +690,13 @@ static ssize_t nc_sendv_compat(NetClientState *nc, const struct iovec *iov, |
879a1e11 WB |
20 | buffer = iov[0].iov_base; |
21 | offset = iov[0].iov_len; | |
22 | } else { | |
23 | - buf = g_new(uint8_t, NET_BUFSIZE); | |
24 | + offset = iov_size(iov, iovcnt); | |
25 | + if (offset > NET_BUFSIZE) { | |
26 | + return -1; | |
27 | + } | |
28 | + buf = g_malloc(offset); | |
29 | buffer = buf; | |
30 | - offset = iov_to_buf(iov, iovcnt, 0, buf, NET_BUFSIZE); | |
31 | + offset = iov_to_buf(iov, iovcnt, 0, buf, offset); | |
32 | } | |
33 | ||
34 | if (flags & QEMU_NET_PACKET_FLAG_RAW && nc->info->receive_raw) { | |
35 | -- | |
36 | 2.1.4 | |
37 |