ia64/linux-2.6.18-xen.hg

changeset 309:cf8b6cafa2f0

blkback: Sanity-check nr_segments parameter.
From: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Keir Fraser <keir.fraser@eu.citrix.com>
author Keir Fraser <keir@xensource.com>
date Thu Nov 08 18:26:08 2007 +0000 (2007-11-08)
parents f539cd7c9331
children fced90d566f1
files include/xen/blkif.h
line diff
     1.1 --- a/include/xen/blkif.h	Wed Nov 07 15:19:39 2007 -0700
     1.2 +++ b/include/xen/blkif.h	Thu Nov 08 18:26:08 2007 +0000
     1.3 @@ -72,25 +72,29 @@ enum blkif_protocol {
     1.4  
     1.5  static void inline blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_request_t *src)
     1.6  {
     1.7 -	int i;
     1.8 +	int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
     1.9  	dst->operation = src->operation;
    1.10  	dst->nr_segments = src->nr_segments;
    1.11  	dst->handle = src->handle;
    1.12  	dst->id = src->id;
    1.13  	dst->sector_number = src->sector_number;
    1.14 -	for (i = 0; i < src->nr_segments; i++)
    1.15 +	if (n > src->nr_segments)
    1.16 +		n = src->nr_segments;
    1.17 +	for (i = 0; i < n; i++)
    1.18  		dst->seg[i] = src->seg[i];
    1.19  }
    1.20  
    1.21  static void inline blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_request_t *src)
    1.22  {
    1.23 -	int i;
    1.24 +	int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
    1.25  	dst->operation = src->operation;
    1.26  	dst->nr_segments = src->nr_segments;
    1.27  	dst->handle = src->handle;
    1.28  	dst->id = src->id;
    1.29  	dst->sector_number = src->sector_number;
    1.30 -	for (i = 0; i < src->nr_segments; i++)
    1.31 +	if (n > src->nr_segments)
    1.32 +		n = src->nr_segments;
    1.33 +	for (i = 0; i < n; i++)
    1.34  		dst->seg[i] = src->seg[i];
    1.35  }
    1.36