On Tue, Aug 9, 2022 at 8:43 PM Bin Meng <bmeng...@gmail.com> wrote: > From: Bin Meng <bin.m...@windriver.com> > > WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS > object handles. Correct the event array size in aio_poll() and > add a assert() to ensure it does not cause out of bound access. > > Signed-off-by: Bin Meng <bin.m...@windriver.com> > Reviewed-by: Stefan Weil <s...@weilnetz.de> >
lgtm Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com> > --- > > Changes in v2: > - change 'count' to unsigned > > util/aio-win32.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/util/aio-win32.c b/util/aio-win32.c > index 44003d645e..80cfe012ad 100644 > --- a/util/aio-win32.c > +++ b/util/aio-win32.c > @@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx) > bool aio_poll(AioContext *ctx, bool blocking) > { > AioHandler *node; > - HANDLE events[MAXIMUM_WAIT_OBJECTS + 1]; > + HANDLE events[MAXIMUM_WAIT_OBJECTS]; > bool progress, have_select_revents, first; > - int count; > + unsigned count; > int timeout; > > /* > @@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking) > QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) { > if (!node->deleted && node->io_notify > && aio_node_check(ctx, node->is_external)) { > + assert(count < MAXIMUM_WAIT_OBJECTS); > events[count++] = event_notifier_get_handle(node->e); > } > } > -- > 2.34.1 > > -- Marc-André Lureau