File eab7ae6b-fix-array-access.patch of Package libvirt.20357

Overview Repositories Revisions Requests Users Attributes Meta

File eab7ae6b-fix-array-access.patch of Package libvirt.20357

commit eab7ae6bfe13503ea705e70e32edaa60357cbaa1
Author: Peter Krempa <pkrempa@redhat.com>
Date:   Fri Mar 12 10:16:11 2021 +0100

virLockSpaceNewPostExecRestart: Fix out-of-bounds array access
    
    'res->owners' is allocated to 'res->nOwners' elements, but unfortunately
    'res->nOwners' doesn't contain the proper value until after the
    allocation so 0 elements are allocated. The following loop which assumes
    that the array has the right number of elements then accesses the
    pointer out of bounds. The bug was also faithfully converted from
    VIR_ALLOC_N to g_new0.
    
    Fixes: 4a3d6ed5ee0
    Signed-off-by: Peter Krempa <pkrempa@redhat.com>
    Reviewed-by: Michal Privoznik <mprivozn@redhat.com>

Index: libvirt-6.0.0/src/util/virlockspace.c
===================================================================
--- libvirt-6.0.0.orig/src/util/virlockspace.c
+++ libvirt-6.0.0/src/util/virlockspace.c
@@ -332,7 +332,6 @@ virLockSpacePtr virLockSpaceNewPostExecR
         const char *tmp;
         virJSONValuePtr owners;
         size_t j;
-        size_t m;
 
         if (VIR_ALLOC(res) < 0)
             goto error;
@@ -393,12 +392,11 @@ virLockSpacePtr virLockSpaceNewPostExecR
             goto error;
         }
 
-        m = virJSONValueArraySize(owners);
+        res->nOwners = virJSONValueArraySize(owners);
         if (VIR_ALLOC_N(res->owners, res->nOwners) < 0) {
             virLockSpaceResourceFree(res);
             goto error;
         }
-        res->nOwners = m;
 
         for (j = 0; j < res->nOwners; j++) {
             unsigned long long int owner;

Places

File eab7ae6b-fix-array-access.patch of Package libvirt.20357

Places