From: Peter Krempa <[email protected]> The 'names' has (guaranteed) size of 'maxnames' but when it's being filled the number of items is not checked against the size.
Reported by: Aisle Research Fixes: b9dfbf5723d23f953e0a611a39e83ab2b5ae378b Signed-off-by: Peter Krempa <[email protected]> --- src/esx/esx_interface_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/esx/esx_interface_driver.c b/src/esx/esx_interface_driver.c index 125155da99..bbb8baaeb8 100644 --- a/src/esx/esx_interface_driver.c +++ b/src/esx/esx_interface_driver.c @@ -75,6 +75,8 @@ esxConnectListInterfaces(virConnectPtr conn, char **const names, int maxnames) for (physicalNic = physicalNicList; physicalNic; physicalNic = physicalNic->_next) { + if (count >= maxnames) + break; names[count] = g_strdup(physicalNic->device); ++count; -- 2.55.0
