diff options
| author | Richard W.M. Jones <rjones@redhat.com> | 2010-09-27 10:51:38 +0100 |
|---|---|---|
| committer | Richard W.M. Jones <rjones@redhat.com> | 2010-09-27 10:51:38 +0100 |
| commit | e65f5213637e71f6f88763ce177fd23c65e1033d (patch) | |
| tree | 0e72e60661616d960c7883826a6141aa18f1308e | |
| parent | 533aff2879d85a4061b9d31e9b25996ce0af60f5 (diff) | |
| download | libguestfs-e65f5213637e71f6f88763ce177fd23c65e1033d.tar.gz libguestfs-e65f5213637e71f6f88763ce177fd23c65e1033d.tar.xz libguestfs-e65f5213637e71f6f88763ce177fd23c65e1033d.zip | |
pread: Check count and offset parameters are not negative.
| -rw-r--r-- | daemon/file.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/daemon/file.c b/daemon/file.c index 9403100d..5bc5f412 100644 --- a/daemon/file.c +++ b/daemon/file.c @@ -415,6 +415,16 @@ do_pread (const char *path, int count, int64_t offset, size_t *size_r) ssize_t r; char *buf; + if (count < 0) { + reply_with_error ("count is negative"); + return NULL; + } + + if (offset < 0) { + reply_with_error ("offset is negative"); + return NULL; + } + /* The actual limit on messages is smaller than this. This check * just limits the amount of memory we'll try and allocate in the * function. If the message is larger than the real limit, that |