ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

v9fs_walk: As per 9p2000 RFC, MAXWELEM >= nwnames >= 0. 

The nwnames field in TWALK message is assumed to be >=0 and <= MAXWELEM
which is defined as macro P9_MAXWELEM (16) in virtio-9p.h as per 9p2000
RFC. Appropriate changes are required in V9fsWalkState and v9fs_walk.

Signed-off-by: Harsh Prateek Bora <harsh@linux.vnet.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com>
This commit is contained in:
Harsh Prateek Bora 2011-04-14 14:54:40 +05:30 committed by Venkateswararao Jujjuri
parent f35bde2f8f
commit 4f8dee2dec
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hw/9pfs/virtio-9p.c
View File

@ -1482,7 +1482,7 @@ static void v9fs_walk_complete(V9fsState *s, V9fsWalkState *vs, int err)
{ {
complete_pdu(s, vs->pdu, err); complete_pdu(s, vs->pdu, err);
if (vs->nwnames) { if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
for (vs->name_idx = 0; vs->name_idx < vs->nwnames; vs->name_idx++) { for (vs->name_idx = 0; vs->name_idx < vs->nwnames; vs->name_idx++) {
v9fs_string_free(&vs->wnames[vs->name_idx]); v9fs_string_free(&vs->wnames[vs->name_idx]);
} }
@ -1578,7 +1578,7 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "ddw", &fid, vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "ddw", &fid,
&newfid, &vs->nwnames); &newfid, &vs->nwnames);
if (vs->nwnames) { if (vs->nwnames && vs->nwnames <= P9_MAXWELEM) {
vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames); vs->wnames = qemu_mallocz(sizeof(vs->wnames[0]) * vs->nwnames);
vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames); vs->qids = qemu_mallocz(sizeof(vs->qids[0]) * vs->nwnames);
@ -1587,6 +1587,9 @@ static void v9fs_walk(V9fsState *s, V9fsPDU *pdu)
vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s", vs->offset += pdu_unmarshal(vs->pdu, vs->offset, "s",
&vs->wnames[i]); &vs->wnames[i]);
} }
} else if (vs->nwnames > P9_MAXWELEM) {
err = -EINVAL;
goto out;
} }
vs->fidp = lookup_fid(s, fid); vs->fidp = lookup_fid(s, fid);

2
hw/9pfs/virtio-9p.h
View File

@ -282,7 +282,7 @@ typedef struct V9fsStatStateDotl {
typedef struct V9fsWalkState { typedef struct V9fsWalkState {
V9fsPDU *pdu; V9fsPDU *pdu;
size_t offset; size_t offset;
int16_t nwnames; uint16_t nwnames;
int name_idx; int name_idx;
V9fsQID *qids; V9fsQID *qids;
V9fsFidState *fidp; V9fsFidState *fidp;