david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ivshmem: fix number of bytes to push to fifo

Browse Source 
If the fifo has 0 bytes, and the read is of size 1, the call to
fifo8_push_all() will copy off boundary data.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
This commit is contained in:
Marc-André Lureau 2015-06-23 17:53:46 +02:00
parent b8ab854b27
commit 951dada665
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hw/misc/ivshmem.c
View File

@ -455,7 +455,7 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
uint32_t num;
IVSHMEM_DPRINTF("short read of %d bytes\n", size);
num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
fifo8_push_all(&s->incoming_fifo, buf, num);
if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {
return;