From: Paolo Bonzini Date: Mon, 15 Sep 2014 12:52:58 +0000 (+0200) Subject: aio-win32: avoid out-of-bounds access to the events array X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=a90d411e63ef29bb99b984e0fdb7796aeee1c724;p=qemu.git aio-win32: avoid out-of-bounds access to the events array If ret is WAIT_TIMEOUT and there was an event returned by select(), we can write to a location after the end of the array. But in that case we can retry the WaitForMultipleObjects call with the same set of events, so just move the event[ret - WAIT_OBJECT_0] assignment inside the existin conditional. Reported-by: TeLeMan Signed-off-by: Paolo Bonzini Reviewed-by: TeLeMan Signed-off-by: Stefan Hajnoczi --- diff --git a/aio-win32.c b/aio-win32.c index 7daeae18f1..d81313b00b 100644 --- a/aio-win32.c +++ b/aio-win32.c @@ -335,6 +335,7 @@ bool aio_poll(AioContext *ctx, bool blocking) event = NULL; if ((DWORD) (ret - WAIT_OBJECT_0) < count) { event = events[ret - WAIT_OBJECT_0]; + events[ret - WAIT_OBJECT_0] = events[--count]; } else if (!have_select_revents) { break; } @@ -343,9 +344,6 @@ bool aio_poll(AioContext *ctx, bool blocking) blocking = false; progress |= aio_dispatch_handlers(ctx, event); - - /* Try again, but only call each handler once. */ - events[ret - WAIT_OBJECT_0] = events[--count]; } progress |= timerlistgroup_run_timers(&ctx->tlg);