mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-10-15 15:32:51 +00:00
aio-win32: avoid out-of-bounds access to the events array
If ret is WAIT_TIMEOUT and there was an event returned by select(), we can write to a location after the end of the array. But in that case we can retry the WaitForMultipleObjects call with the same set of events, so just move the event[ret - WAIT_OBJECT_0] assignment inside the existin conditional. Reported-by: TeLeMan <geleman@gmail.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: TeLeMan <geleman@gmail.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
parent
0722eba945
commit
a90d411e63
|
@ -335,6 +335,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
|
||||||
event = NULL;
|
event = NULL;
|
||||||
if ((DWORD) (ret - WAIT_OBJECT_0) < count) {
|
if ((DWORD) (ret - WAIT_OBJECT_0) < count) {
|
||||||
event = events[ret - WAIT_OBJECT_0];
|
event = events[ret - WAIT_OBJECT_0];
|
||||||
|
events[ret - WAIT_OBJECT_0] = events[--count];
|
||||||
} else if (!have_select_revents) {
|
} else if (!have_select_revents) {
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
@ -343,9 +344,6 @@ bool aio_poll(AioContext *ctx, bool blocking)
|
||||||
blocking = false;
|
blocking = false;
|
||||||
|
|
||||||
progress |= aio_dispatch_handlers(ctx, event);
|
progress |= aio_dispatch_handlers(ctx, event);
|
||||||
|
|
||||||
/* Try again, but only call each handler once. */
|
|
||||||
events[ret - WAIT_OBJECT_0] = events[--count];
|
|
||||||
}
|
}
|
||||||
|
|
||||||
progress |= timerlistgroup_run_timers(&ctx->tlg);
|
progress |= timerlistgroup_run_timers(&ctx->tlg);
|
||||||
|
|
Loading…
Reference in a new issue