diff options
| author | Daniel P. Berrange <berrange@redhat.com> | 2016-09-06 14:56:02 +0100 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2016-09-13 19:09:42 +0200 |
| commit | b72981b910097b31f4d0b9c111a2d2cfd9ee585b (patch) | |
| tree | fd4b43d72ea6e6c55b2083e6ed4548ceb44f85aa /hw/char | |
| parent | e270d00afa58c8a2903ec85db51407abc4e3269d (diff) | |
| download | qemu-b72981b910097b31f4d0b9c111a2d2cfd9ee585b.zip qemu-b72981b910097b31f4d0b9c111a2d2cfd9ee585b.tar.gz qemu-b72981b910097b31f4d0b9c111a2d2cfd9ee585b.tar.bz2 | |
ipmi: check return of qemu_chr_fe_write() for errors
The continue_send() method in ipmi_bmc_extern.c directly
assigns the return value of qemu_chr_fe_write() to the
variable tracking the I/O buffer offset. This ignores the
possibility that the return value could be -1 and so will
cause I/O go backwards on EAGAIN. Fortunately 'outpos' is
unsigned, so can't go negative - it will become MAX_INT
which will cause the loop to stop, and avoid an accidental
out of bounds array access.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-Id: <1473170165-540-2-git-send-email-berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/char')
0 files changed, 0 insertions, 0 deletions