From: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Tue, 23 Jun 2015 15:53:46 +0000 (+0200)
Subject: ivshmem: fix number of bytes to push to fifo
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=951dada665041e8199e8c572d2981773fa2f0d8c;p=qemu.git

ivshmem: fix number of bytes to push to fifo

If the fifo has 0 bytes, and the read is of size 1, the call to
fifo8_push_all() will copy off boundary data.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Claudio Fontana <claudio.fontana@huawei.com>
---

diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index fb53b3ff33..2162d025a5 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -455,7 +455,7 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size)
         uint32_t num;
 
         IVSHMEM_DPRINTF("short read of %d bytes\n", size);
-        num = MAX(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
+        num = MIN(size, sizeof(long) - fifo8_num_used(&s->incoming_fifo));
         fifo8_push_all(&s->incoming_fifo, buf, num);
         if (fifo8_num_used(&s->incoming_fifo) < sizeof(incoming_posn)) {
             return;