summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Gibson <david@gibson.dropbear.id.au>2012-09-10 12:30:56 +1000
committerDoug Goldstein <cardoe@cardoe.com>2012-10-24 02:03:04 -0500
commitbf2164613a3bca292fcbba17b9dfd935fd79da72 (patch)
treeac991833eeab849008a27fdf92b52878b3f2de4c
parenttcg/s390: fix ld/st with CONFIG_TCG_PASS_AREG0 (diff)
downloadqemu-kvm-bf2164613a3bca292fcbba17b9dfd935fd79da72.tar.gz
qemu-kvm-bf2164613a3bca292fcbba17b9dfd935fd79da72.tar.bz2
qemu-kvm-bf2164613a3bca292fcbba17b9dfd935fd79da72.zip
qemu-char: BUGFIX, don't call FD_ISSET with negative fd
tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does not check if the fd it is using is valid (>= 0) before passing it to qemu_set_fd_handler2(). If using e.g. a TCP serial port, which is not initially connected, this can result in -1 being passed to FD_ISSET, which has undefined behaviour. On x86 it seems to harmlessly return 0, but on PowerPC, it causes a fortify buffer overflow error to be thrown. This patch fixes this by putting an extra test in tcp_chr_connect(), and also adds an assert qemu_set_fd_handler2() to catch other such errors on all platforms, rather than just some. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit bbdd2ad0814ea0911076419ea21b7957505cf1cc)
-rw-r--r--iohandler.c2
-rw-r--r--qemu-char.c6
2 files changed, 6 insertions, 2 deletions
diff --git a/iohandler.c b/iohandler.c
index dea43552d..a2d871bb9 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -56,6 +56,8 @@ int qemu_set_fd_handler2(int fd,
{
IOHandlerRecord *ioh;
+ assert(fd >= 0);
+
if (!fd_read && !fd_write) {
QLIST_FOREACH(ioh, &io_handlers, next) {
if (ioh->fd == fd) {
diff --git a/qemu-char.c b/qemu-char.c
index fe1126fe8..3a684300b 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2321,8 +2321,10 @@ static void tcp_chr_connect(void *opaque)
TCPCharDriver *s = chr->opaque;
s->connected = 1;
- qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
- tcp_chr_read, NULL, chr);
+ if (s->fd >= 0) {
+ qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
+ tcp_chr_read, NULL, chr);
+ }
qemu_chr_generic_open(chr);
}