From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 12 Mar 2012 14:23:13 +0000 (+0100)
Subject: nbd: avoid out of bounds access to recv_coroutine array
X-Git-Tag: v1.1-rc0~86^2~6
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dd3e8ac413a74a58d6a3ba16a26952f84370fcff;p=thirdparty%2Fqemu.git

nbd: avoid out of bounds access to recv_coroutine array

This can happen with a buggy or malicious server.

Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/block/nbd.c b/block/nbd.c
index 161b299855c..9972cdb6551 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -150,7 +150,7 @@ static int nbd_have_request(void *opaque)
 static void nbd_reply_ready(void *opaque)
 {
     BDRVNBDState *s = opaque;
-    int i;
+    uint64_t i;
 
     if (s->reply.handle == 0) {
         /* No reply already in flight.  Fetch a header.  */
@@ -164,6 +164,10 @@ static void nbd_reply_ready(void *opaque)
      * handler acts as a synchronization point and ensures that only
      * one coroutine is called until the reply finishes.  */
     i = HANDLE_TO_INDEX(s, s->reply.handle);
+    if (i >= MAX_NBD_REQUESTS) {
+        goto fail;
+    }
+
     if (s->recv_coroutine[i]) {
         qemu_coroutine_enter(s->recv_coroutine[i], NULL);
         return;