diff options
| author | Paolo Bonzini | 2014-09-15 14:52:58 +0200 |
|---|---|---|
| committer | Stefan Hajnoczi | 2014-09-22 12:39:21 +0200 |
| commit | a90d411e63ef29bb99b984e0fdb7796aeee1c724 (patch) | |
| tree | d581f7df415e00711bb29d65438c6e76e849d941 /block | |
| parent | qdev-monitor: fix segmentation fault on qdev_device_help() (diff) | |
| download | qemu-a90d411e63ef29bb99b984e0fdb7796aeee1c724.tar.gz qemu-a90d411e63ef29bb99b984e0fdb7796aeee1c724.tar.xz qemu-a90d411e63ef29bb99b984e0fdb7796aeee1c724.zip | |
aio-win32: avoid out-of-bounds access to the events array
If ret is WAIT_TIMEOUT and there was an event returned by select(),
we can write to a location after the end of the array. But in
that case we can retry the WaitForMultipleObjects call with the
same set of events, so just move the event[ret - WAIT_OBJECT_0]
assignment inside the existin conditional.
Reported-by: TeLeMan <geleman@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: TeLeMan <geleman@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions