aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaolo Bonzini <pbonzini@redhat.com>2014-09-15 14:52:58 +0200
committerStefan Hajnoczi <stefanha@redhat.com>2014-09-22 11:39:21 +0100
commita90d411e63ef29bb99b984e0fdb7796aeee1c724 (patch)
treed581f7df415e00711bb29d65438c6e76e849d941
parent0722eba9450cb8be9713fec1caa0772330739586 (diff)
aio-win32: avoid out-of-bounds access to the events array
If ret is WAIT_TIMEOUT and there was an event returned by select(), we can write to a location after the end of the array. But in that case we can retry the WaitForMultipleObjects call with the same set of events, so just move the event[ret - WAIT_OBJECT_0] assignment inside the existin conditional. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: TeLeMan <geleman@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-rw-r--r--aio-win32.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/aio-win32.c b/aio-win32.c
index 7daeae18f1..d81313b00b 100644
--- a/aio-win32.c
+++ b/aio-win32.c
@@ -335,6 +335,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
event = NULL;
if ((DWORD) (ret - WAIT_OBJECT_0) < count) {
event = events[ret - WAIT_OBJECT_0];
+ events[ret - WAIT_OBJECT_0] = events[--count];
} else if (!have_select_revents) {
break;
}
@@ -343,9 +344,6 @@ bool aio_poll(AioContext *ctx, bool blocking)
blocking = false;
progress |= aio_dispatch_handlers(ctx, event);
-
- /* Try again, but only call each handler once. */
- events[ret - WAIT_OBJECT_0] = events[--count];
}
progress |= timerlistgroup_run_timers(&ctx->tlg);