commit 258133bda9a6f22ba436ef9b63b7c086cc80190b
author Gonglei <arei.gonglei@huawei.com> Mon Nov 02 09:13:48 2015 +0800
committer Michael Tokarev <mjt@tls.msk.ru> Fri Nov 06 15:42:38 2015 +0300
tree 107c9ad242888b543457db4bedf893b2b91f0ad8
parent 6268520d7df9b3f183bb4397218c9287441bc04f

ivshmem-server: fix possible OVERRUN

>>>     CID 1337991:  Memory - illegal accesses  (OVERRUN)
>>>     Decrementing "i". The value of "i" is now 65534.
218         while (i--) {
219             event_notifier_cleanup(&peer->vectors[i]);
220         }

Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

contrib/ivshmem-server/ivshmem-server.c

diff --git a/contrib/ivshmem-server/ivshmem-server.c b/contrib/ivshmem-server/ivshmem-server.c
index 5e5239c..d9e26b0 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -168,7 +168,9 @@
     }
     if (i == G_MAXUINT16) {
         IVSHMEM_SERVER_DEBUG(server, "cannot allocate new client id\n");
-        goto fail;
+        close(newfd);
+        g_free(peer);
+        return -1;
     }
     peer->id = server->cur_id++;