aboutsummaryrefslogtreecommitdiff
path: root/migration-rdma.c
diff options
context:
space:
mode:
authorIsaku Yamahata <yamahata@private.email.ne.jp>2013-08-09 16:05:41 -0400
committerAnthony Liguori <aliguori@us.ibm.com>2013-08-12 09:31:15 -0500
commit6f1484edadba57f2800dc04ae3527ee4b6dac7ef (patch)
tree497872b07998058fcb806b97a885e3e6fe05389a /migration-rdma.c
parent885e8f984ea846e79a39ddc4f066f4dd3d04b264 (diff)
downloadqemu-6f1484edadba57f2800dc04ae3527ee4b6dac7ef.zip
qemu-6f1484edadba57f2800dc04ae3527ee4b6dac7ef.tar.gz
qemu-6f1484edadba57f2800dc04ae3527ee4b6dac7ef.tar.bz2
rdma: validate RDMAControlHeader::len
RMDAControlHeader::len is provided from remote, so validate it. Reviewed-by: Orit Wasserman <owasserm@redhat.com> Reviewed-by: Michael R. Hines <mrhines@us.ibm.com> Signed-off-by: Isaku Yamahata <yamahata@private.email.ne.jp> Signed-off-by: Michael R. Hines <mrhines@us.ibm.com> Message-id: 1376078746-24948-3-git-send-email-mrhines@linux.vnet.ibm.com Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'migration-rdma.c')
-rw-r--r--migration-rdma.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/migration-rdma.c b/migration-rdma.c
index 6721266..ebe1f55 100644
--- a/migration-rdma.c
+++ b/migration-rdma.c
@@ -1424,6 +1424,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
* The copy makes the RDMAControlHeader simpler to manipulate
* for the time being.
*/
+ assert(head->len <= RDMA_CONTROL_MAX_BUFFER - sizeof(*head));
memcpy(wr->control, head, sizeof(RDMAControlHeader));
control_to_network((void *) wr->control);
@@ -1504,6 +1505,10 @@ static int qemu_rdma_exchange_get_response(RDMAContext *rdma,
control_desc[head->type], head->type, head->len);
return -EIO;
}
+ if (head->len > RDMA_CONTROL_MAX_BUFFER - sizeof(*head)) {
+ fprintf(stderr, "too long length: %d\n", head->len);
+ return -EINVAL;
+ }
return 0;
}