Re: [PATCH v3 3/3] util/aio-win32: Correct the event array size in aio_poll()
On Wed, Aug 24, 2022 at 04:52:31PM +0800, Bin Meng wrote:
> From: Bin Meng
>
> WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS
> object handles. Correct the event array size in aio_poll() and
> add a assert() to ensure it does not cause out of bound access.
>
> Signed-off-by: Bin Meng
> Reviewed-by: Stefan Weil
> Reviewed-by: Marc-André Lureau
> ---
>
> (no changes since v2)
>
> Changes in v2:
> - change 'count' to unsigned
>
> util/aio-win32.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/util/aio-win32.c b/util/aio-win32.c
> index 44003d645e..80cfe012ad 100644
> --- a/util/aio-win32.c
> +++ b/util/aio-win32.c
> @@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx)
> bool aio_poll(AioContext *ctx, bool blocking)
> {
> AioHandler *node;
> -HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
> +HANDLE events[MAXIMUM_WAIT_OBJECTS];
Interestingly, the orignial + 1 was entirely pointless, since
the aio_poll impl has no bounds checking at all, until your
new assert.
> bool progress, have_select_revents, first;
> -int count;
> +unsigned count;
> int timeout;
>
> /*
> @@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
> QLIST_FOREACH_RCU(node, >aio_handlers, node) {
> if (!node->deleted && node->io_notify
> && aio_node_check(ctx, node->is_external)) {
> +assert(count < MAXIMUM_WAIT_OBJECTS);
> events[count++] = event_notifier_get_handle(node->e);
> }
> }
Reviewed-by: Daniel P. Berrangé
With regards,
Daniel
--
|: https://berrange.com -o-https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o-https://fstop138.berrange.com :|
|: https://entangle-photo.org-o-https://www.instagram.com/dberrange :|
Re: [PATCH v3 3/3] util/aio-win32: Correct the event array size in aio_poll()
On 24/8/22 10:52, Bin Meng wrote: From: Bin Meng WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS object handles. Correct the event array size in aio_poll() and add a assert() to ensure it does not cause out of bound access. Signed-off-by: Bin Meng Reviewed-by: Stefan Weil Reviewed-by: Marc-André Lureau --- (no changes since v2) Changes in v2: - change 'count' to unsigned util/aio-win32.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) Reviewed-by: Philippe Mathieu-Daudé
[PATCH v3 3/3] util/aio-win32: Correct the event array size in aio_poll()
From: Bin Meng
WaitForMultipleObjects() can only wait for MAXIMUM_WAIT_OBJECTS
object handles. Correct the event array size in aio_poll() and
add a assert() to ensure it does not cause out of bound access.
Signed-off-by: Bin Meng
Reviewed-by: Stefan Weil
Reviewed-by: Marc-André Lureau
---
(no changes since v2)
Changes in v2:
- change 'count' to unsigned
util/aio-win32.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/util/aio-win32.c b/util/aio-win32.c
index 44003d645e..80cfe012ad 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -326,9 +326,9 @@ void aio_dispatch(AioContext *ctx)
bool aio_poll(AioContext *ctx, bool blocking)
{
AioHandler *node;
-HANDLE events[MAXIMUM_WAIT_OBJECTS + 1];
+HANDLE events[MAXIMUM_WAIT_OBJECTS];
bool progress, have_select_revents, first;
-int count;
+unsigned count;
int timeout;
/*
@@ -369,6 +369,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
QLIST_FOREACH_RCU(node, >aio_handlers, node) {
if (!node->deleted && node->io_notify
&& aio_node_check(ctx, node->is_external)) {
+assert(count < MAXIMUM_WAIT_OBJECTS);
events[count++] = event_notifier_get_handle(node->e);
}
}
--
2.34.1
