On Tue, Aug 9, 2022 at 8:43 PM Bin Meng <bmeng...@gmail.com> wrote:
> From: Bin Meng <bin.m...@windriver.com>
>
> WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS
> object handles. Correct the event array size in aio_poll() and
> add a assert() to ensure it does not cause out of bound access.
>
> Signed-off-by: Bin Meng <bin.m...@windriver.com>
> Reviewed-by: Stefan Weil <s...@weilnetz.de>
>
lgtm
Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
> ---
>
> Changes in v2:
> - change 'count' to unsigned
>
> util/aio-win32.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/util/aio-win32.c b/util/aio-win32.c
> index 44003d645e..80cfe012ad 100644
> --- a/util/aio-win32.c
> +++ b/util/aio-win32.c
> @@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx)
> bool aio_poll(AioContext *ctx, bool blocking)
> {
> AioHandler *node;
> - HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
> + HANDLE events[MAXIMUM_WAIT_OBJECTS];
> bool progress, have_select_revents, first;
> - int count;
> + unsigned count;
> int timeout;
>
> /*
> @@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
> QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
> if (!node->deleted && node->io_notify
> && aio_node_check(ctx, node->is_external)) {
> + assert(count < MAXIMUM_WAIT_OBJECTS);
> events[count++] = event_notifier_get_handle(node->e);
> }
> }
> --
> 2.34.1
>
>
--
Marc-André Lureau
