From: Michal Privoznik <mprivozn@redhat.com>
Date: Tue, 27 Aug 2019 09:05:21 +0000 (+0200)
Subject: remote_daemon_dispatch: Check for limit properly in remoteDispatchConnectGetAllDomain... 
X-Git-Tag: v5.7.0-rc1~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6763f42eee2e1bfd12c596777d25c9345042fba0;p=thirdparty%2Flibvirt.git

remote_daemon_dispatch: Check for limit properly in remoteDispatchConnectGetAllDomainStats

The return structure is a bit complicated and that's why it is
very easy to check for RPC limits incorrectly. The structure is
an array of remote_domain_stats_record structures with the limit
of REMOTE_DOMAIN_LIST_MAX. The latter structure then poses a
different limit on typed params:
REMOTE_CONNECT_GET_ALL_DOMAIN_STATS_MAX (which is what we are
checking for mistakenly).

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Erik Skultety <eskultet@redhat.com>
Reviewed-by: Jonathon Jongsma <jjongsma@redhat.com>
---

diff --git a/src/remote/remote_daemon_dispatch.c b/src/remote/remote_daemon_dispatch.c
index fb8b95f315..1a002957ef 100644
--- a/src/remote/remote_daemon_dispatch.c
+++ b/src/remote/remote_daemon_dispatch.c
@@ -6996,15 +6996,15 @@ remoteDispatchConnectGetAllDomainStats(virNetServerPtr server ATTRIBUTE_UNUSED,
             goto cleanup;
     }
 
-    if (nrecords > REMOTE_CONNECT_GET_ALL_DOMAIN_STATS_MAX) {
-        virReportError(VIR_ERR_INTERNAL_ERROR,
-                       _("Number of domain stats records is %d, "
-                         "which exceeds max limit: %d"),
-                       nrecords, REMOTE_CONNECT_GET_ALL_DOMAIN_STATS_MAX);
-        goto cleanup;
-    }
-
     if (nrecords) {
+        if (nrecords > REMOTE_DOMAIN_LIST_MAX) {
+            virReportError(VIR_ERR_INTERNAL_ERROR,
+                           _("Number of domain stats records is %d, "
+                             "which exceeds max limit: %d"),
+                           nrecords, REMOTE_DOMAIN_LIST_MAX);
+            goto cleanup;
+        }
+
         if (VIR_ALLOC_N(ret->retStats.retStats_val, nrecords) < 0)
             goto cleanup;