From 725b20685e3faf11198560a6d9035c394ef77594 Mon Sep 17 00:00:00 2001 From: Xiao Wang Date: Fri, 11 Jan 2019 07:58:59 +0000 Subject: [PATCH 04/11] net: ignore packet size greater than INT_MAX MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: Xiao Wang Message-id: <20190111075904.2030-5-jasowang@redhat.com> Patchwork-id: 83978 O-Subject: [RHEL8 qemu-kvm PATCH 4/9] net: ignore packet size greater than INT_MAX Bugzilla: 1636784 RH-Acked-by: Thomas Huth RH-Acked-by: Philippe Mathieu-Daudé RH-Acked-by: Jens Freimann RH-Acked-by: Maxime Coquelin RH-Acked-by: Michael S. Tsirkin There should not be a reason for passing a packet size greater than INT_MAX. It's usually a hint of bug somewhere, so ignore packet size greater than INT_MAX in qemu_deliver_packet_iov() CC: qemu-stable@nongnu.org Reported-by: Daniel Shapira Reviewed-by: Michael S. Tsirkin Signed-off-by: Jason Wang (cherry picked from commit 1592a9947036d60dde5404204a5d45975133caf5) Signed-off-by: Danilo C. L. de Paula --- net/net.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/net.c b/net/net.c index 29f8398..c991243 100644 --- a/net/net.c +++ b/net/net.c @@ -712,10 +712,15 @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender, void *opaque) { NetClientState *nc = opaque; + size_t size = iov_size(iov, iovcnt); int ret; + if (size > INT_MAX) { + return size; + } + if (nc->link_down) { - return iov_size(iov, iovcnt); + return size; } if (nc->receive_disabled) { -- 1.8.3.1