diff options
| author | Bin Meng | 2022-10-19 12:20:15 +0200 |
|---|---|---|
| committer | Paolo Bonzini | 2022-11-06 09:48:26 +0100 |
| commit | e0d034bb243cf0bac2416e00af810c4ca7821762 (patch) | |
| tree | 058494b5be6c7992a65f3f3a86b41b6a089ea014 /util | |
| parent | util/main-loop: Avoid adding the same HANDLE twice (diff) | |
| download | qemu-e0d034bb243cf0bac2416e00af810c4ca7821762.tar.gz qemu-e0d034bb243cf0bac2416e00af810c4ca7821762.tar.xz qemu-e0d034bb243cf0bac2416e00af810c4ca7821762.zip | |
util/aio-win32: Correct the event array size in aio_poll()
WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS
object handles. Correct the event array size in aio_poll() and
add a assert() to ensure it does not cause out of bound access.
Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20221019102015.2441622-3-bmeng.cn@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'util')
| -rw-r--r-- | util/aio-win32.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/util/aio-win32.c b/util/aio-win32.c index 44003d645e..80cfe012ad 100644 --- a/util/aio-win32.c +++ b/util/aio-win32.c @@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx) bool aio_poll(AioContext *ctx, bool blocking) { AioHandler *node; - HANDLE events[MAXIMUM_WAIT_OBJECTS + 1]; + HANDLE events[MAXIMUM_WAIT_OBJECTS]; bool progress, have_select_revents, first; - int count; + unsigned count; int timeout; /* @@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking) QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { if (!node->deleted && node->io_notify && aio_node_check(ctx, node->is_external)) { + assert(count < MAXIMUM_WAIT_OBJECTS); events[count++] = event_notifier_get_handle(node->e); } } |