From: Ján Tomko <jtomko@redhat.com>
Date: Wed, 28 Nov 2012 13:34:47 +0000 (+0100)
Subject: cgroup: fix impossible overrun in virCgroupAddTaskController
X-Git-Tag: CVE-2012-3411~31
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=28a6fd9396706d327624022f0ee03e01d92b0a45;p=thirdparty%2Flibvirt.git

cgroup: fix impossible overrun in virCgroupAddTaskController

The size of the controllers array is VIR_CGROUP_CONTROLLER_LAST, however
we only call it with values less than VIR_CGROUP_CONTROLLER_LAST.
---

diff --git a/src/util/cgroup.c b/src/util/cgroup.c
index 9e78314331..490f1de43f 100644
--- a/src/util/cgroup.c
+++ b/src/util/cgroup.c
@@ -814,7 +814,7 @@ int virCgroupAddTask(virCgroupPtr group, pid_t pid)
  */
 int virCgroupAddTaskController(virCgroupPtr group, pid_t pid, int controller)
 {
-    if (controller < 0 || controller > VIR_CGROUP_CONTROLLER_LAST)
+    if (controller < 0 || controller >= VIR_CGROUP_CONTROLLER_LAST)
         return -EINVAL;
 
     if (!group->controllers[controller].mountPoint)