diff options
| author | w00506750 <hogan.wang@huawei.com> | 2021-04-29 15:58:59 +0800 |
|---|---|---|
| committer | Daniel P. Berrangé <dan-gitlab@berrange.com> | 2021-05-27 13:23:16 +0000 |
| commit | b47727460edc1bd5094a7fbfff8977d5f07cabae (patch) | |
| tree | 35ddcc0bb5699795ec6782d175f232d6b43fcbb2 /libvirt-override.c | |
| parent | 23ea62992f1382e7a2702d73cd63d48d2788b4a1 (diff) | |
| download | libvirt-python-b47727460edc1bd5094a7fbfff8977d5f07cabae.tar.gz | |
iothread: fix memory access out of boundsv7.4.0
When the 'pcpu' is larger then the last 'iothr->cpumap' bits,
set the list element to False to avoid out of bounds access
'iothr->cpumap'.
Signed-off-by: suruifeng <suruifeng@huawei.com>
Reviewed-by: Hogan Wang <hogan.wang@huawei.com>
Diffstat (limited to 'libvirt-override.c')
| -rw-r--r-- | libvirt-override.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/libvirt-override.c b/libvirt-override.c index 3c55e7e..ee0c4eb 100644 --- a/libvirt-override.c +++ b/libvirt-override.c @@ -1625,10 +1625,14 @@ libvirt_virDomainGetIOThreadInfo(PyObject *self ATTRIBUTE_UNUSED, VIR_PY_TUPLE_SET_GOTO(iothrtpl, 1, iothrmap, cleanup); for (pcpu = 0; pcpu < cpunum; pcpu++) - VIR_PY_LIST_SET_GOTO(iothrmap, pcpu, - PyBool_FromLong(VIR_CPU_USED(iothr->cpumap, - pcpu)), - cleanup); + if (VIR_CPU_MAPLEN(pcpu + 1) > iothr->cpumaplen) { + VIR_PY_LIST_SET_GOTO(iothrmap, pcpu, PyBool_FromLong(0), cleanup); + } else { + VIR_PY_LIST_SET_GOTO(iothrmap, pcpu, + PyBool_FromLong(VIR_CPU_USED(iothr->cpumap, + pcpu)), + cleanup); + } } py_retval = py_iothrinfo; |