aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2016-05-20 19:00:57 +0100
committerRiku Voipio <riku.voipio@linaro.org>2016-05-27 14:50:39 +0300
commit415d847110e3f8cd176160b92a5fdc56d8a20792 (patch)
tree863bda57c9db1d342ff1812e348464549e3e76bf
parent99874f65526ed7827202c6e17c62f30d47652bdd (diff)
downloadqemu-arm-415d847110e3f8cd176160b92a5fdc56d8a20792.tar.gz
linux-user: Use g_try_malloc() in do_msgrcv()
In do_msgrcv() we want to allocate a message buffer, whose size is passed to us by the guest. That means we could legitimately fail, so use g_try_malloc() and handle the error case, in the same way that do_msgsnd() does. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Riku Voipio <riku.voipio@linaro.org>
-rw-r--r--linux-user/syscall.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index cec5b80331..40e8742924 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3167,7 +3167,11 @@ static inline abi_long do_msgrcv(int msqid, abi_long msgp,
if (!lock_user_struct(VERIFY_WRITE, target_mb, msgp, 0))
return -TARGET_EFAULT;
- host_mb = g_malloc(msgsz+sizeof(long));
+ host_mb = g_try_malloc(msgsz + sizeof(long));
+ if (!host_mb) {
+ ret = -TARGET_ENOMEM;
+ goto end;
+ }
ret = get_errno(msgrcv(msqid, host_mb, msgsz, msgtyp, msgflg));
if (ret > 0) {