From 2b6695f1222f68690ea230e4e37ded7e07188f06 Mon Sep 17 00:00:00 2001 From: Frediano Ziglio Date: Tue, 15 Sep 2015 16:38:23 +0100 Subject: Avoid race condition copying segments in red_get_path The guest can attempt to increase the number of segments while spice-server is reading them. Make sure we don't copy more then the allocated segments. Signed-off-by: Frediano Ziglio Acked-by: Christophe Fergeau --- server/red_parse_qxl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/red_parse_qxl.c b/server/red_parse_qxl.c index 281faad6..c7f8650a 100644 --- a/server/red_parse_qxl.c +++ b/server/red_parse_qxl.c @@ -272,7 +272,7 @@ static SpicePath *red_get_path(RedMemSlotInfo *slots, int group_id, seg = (SpicePathSeg*)&red->segments[n_segments]; n_segments = 0; mem_size2 = sizeof(*red); - while (start+1 < end) { + while (start+1 < end && n_segments < red->num_segments) { red->segments[n_segments++] = seg; count = start->count; -- cgit