don't overrun buffer when converting cpumapv2.5.0

If we pass large(more than cpunum) cpu mask to any libvirt_virDomainPin*
function, it could leads to crash. So we have to check tuple size in
virPyCpumapConvert and ignore extra tuple members.

Since we allocate a zeroed buffer, we don't need to bother with setting
the bits to zero.

Signed-off-by: Konstantin Neumoin <kneumoin@virtuozzo.com>

1 files changed, 1 insertions, 6 deletions

diff --git a/libvirt-utils.c b/libvirt-utils.c
index 09cc1c3..727397d 100644
--- a/libvirt-utils.c
+++ b/libvirt-utils.c
@@ -623,7 +623,7 @@ virPyCpumapConvert(int cpunum,
         return -1;
     }
 
-    for (i = 0; i < tuple_size; i++) {
+    for (i = 0; i < cpunum && i < tuple_size; i++) {
         PyObject *flag = PyTuple_GetItem(pycpumap, i);
         bool b;
 
@@ -634,12 +634,7 @@ virPyCpumapConvert(int cpunum,
 
         if (b)
             VIR_USE_CPU(*cpumapptr, i);
-        else
-            VIR_UNUSE_CPU(*cpumapptr, i);
     }
 
-    for (; i < cpunum; i++)
-        VIR_UNUSE_CPU(*cpumapptr, i);
-
     return 0;
 }