[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 2/6] util/filemonitor-inotify: qemu_file_monitor_watch(): asse
From: |
Vladimir Sementsov-Ogievskiy |
Subject: |
[PATCH v3 2/6] util/filemonitor-inotify: qemu_file_monitor_watch(): assert no overflow |
Date: |
Tue, 17 Oct 2023 15:59:37 +0300 |
Prefer clear assertions instead of [im]possible array overflow.
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Maksim Davydov <davydov-max@yandex-team.ru>
---
util/filemonitor-inotify.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/util/filemonitor-inotify.c b/util/filemonitor-inotify.c
index 2c45f7f176..2121111f38 100644
--- a/util/filemonitor-inotify.c
+++ b/util/filemonitor-inotify.c
@@ -81,16 +81,25 @@ static void qemu_file_monitor_watch(void *arg)
/* Loop over all events in the buffer */
while (used < len) {
- struct inotify_event *ev =
- (struct inotify_event *)(buf + used);
- const char *name = ev->len ? ev->name : "";
- QFileMonitorDir *dir = g_hash_table_lookup(mon->idmap,
- GINT_TO_POINTER(ev->wd));
- uint32_t iev = ev->mask &
- (IN_CREATE | IN_MODIFY | IN_DELETE | IN_IGNORED |
- IN_MOVED_TO | IN_MOVED_FROM | IN_ATTRIB);
+ const char *name;
+ QFileMonitorDir *dir;
+ uint32_t iev;
int qev;
gsize i;
+ struct inotify_event *ev = (struct inotify_event *)(buf + used);
+
+ /*
+ * We trust the kenel to provide valid buffer with complete event
+ * records.
+ */
+ assert(len - used >= sizeof(struct inotify_event));
+ assert(len - used - sizeof(struct inotify_event) >= ev->len);
+
+ name = ev->len ? ev->name : "";
+ dir = g_hash_table_lookup(mon->idmap, GINT_TO_POINTER(ev->wd));
+ iev = ev->mask &
+ (IN_CREATE | IN_MODIFY | IN_DELETE | IN_IGNORED |
+ IN_MOVED_TO | IN_MOVED_FROM | IN_ATTRIB);
used += sizeof(struct inotify_event) + ev->len;
--
2.34.1
- [PATCH v3 0/6] coverity fixes, Vladimir Sementsov-Ogievskiy, 2023/10/17
- [PATCH v3 3/6] mc146818rtc: rtc_set_time(): initialize tm to zeroes, Vladimir Sementsov-Ogievskiy, 2023/10/17
- [PATCH v3 1/6] hw/i386/intel_iommu: vtd_slpte_nonzero_rsvd(): assert no overflow, Vladimir Sementsov-Ogievskiy, 2023/10/17
- [PATCH v3 6/6] io/channel-socket: qio_channel_socket_flush(): improve msg validation, Vladimir Sementsov-Ogievskiy, 2023/10/17
- [PATCH v3 2/6] util/filemonitor-inotify: qemu_file_monitor_watch(): assert no overflow,
Vladimir Sementsov-Ogievskiy <=
- [PATCH v3 5/6] hw/core/loader: gunzip(): initialize z_stream, Vladimir Sementsov-Ogievskiy, 2023/10/17
- [PATCH v3 4/6] block/nvme: nvme_process_completion() fix bound for cid, Vladimir Sementsov-Ogievskiy, 2023/10/17