From: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Tue, 23 Jun 2015 14:41:58 +0000 (+0200)
Subject: ivshmem-client: check the number of vectors
X-Git-Tag: Tizen_Studio_1.3_Release_p2.3.2~121^2~1^2~110^2~16
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=95204aa951ceb28eb6d4ce43bce09a58cbad83d8;p=sdk%2Femulator%2Fqemu.git

ivshmem-client: check the number of vectors

Check the number of vectors received from the server, to avoid
out of bound array access.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
---

diff --git a/contrib/ivshmem-client/ivshmem-client.c b/contrib/ivshmem-client/ivshmem-client.c
index fcc0930eb6..bfaf584ba7 100644
--- a/contrib/ivshmem-client/ivshmem-client.c
+++ b/contrib/ivshmem-client/ivshmem-client.c
@@ -128,6 +128,11 @@ ivshmem_client_handle_server_msg(IvshmemClient *client)
     /* new vector */
     IVSHMEM_CLIENT_DEBUG(client, "  new vector %d (fd=%d) for peer id %ld\n",
                          peer->vectors_count, fd, peer->id);
+    if (peer->vectors_count >= G_N_ELEMENTS(peer->vectors)) {
+        IVSHMEM_CLIENT_DEBUG(client, "Too many vectors received, failing");
+        return -1;
+    }
+
     peer->vectors[peer->vectors_count] = fd;
     peer->vectors_count++;