blkback: Sanity-check nr_segments parameter.

From: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Keir Fraser <keir.fraser@eu.citrix.com>

diff --git a/include/xen/blkif.h b/include/xen/blkif.h
index 4d6c6638e1b5cda9d17354774c3aaadca07ee8b5..aaec9baf7b235e71c7de92981ec7c7bab011ab61 100644 (file)
--- a/include/xen/blkif.h
+++ b/include/xen/blkif.h
@@ -72,25 +72,29 @@ enum blkif_protocol {
 
 static void inline blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_request_t *src)
 {
-       int i;
+       int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
        dst->operation = src->operation;
        dst->nr_segments = src->nr_segments;
        dst->handle = src->handle;
        dst->id = src->id;
        dst->sector_number = src->sector_number;
-       for (i = 0; i < src->nr_segments; i++)
+       if (n > src->nr_segments)
+               n = src->nr_segments;
+       for (i = 0; i < n; i++)
                dst->seg[i] = src->seg[i];
 }
 
 static void inline blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_request_t *src)
 {
-       int i;
+       int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
        dst->operation = src->operation;
        dst->nr_segments = src->nr_segments;
        dst->handle = src->handle;
        dst->id = src->id;
        dst->sector_number = src->sector_number;
-       for (i = 0; i < src->nr_segments; i++)
+       if (n > src->nr_segments)
+               n = src->nr_segments;
+       for (i = 0; i < n; i++)
                dst->seg[i] = src->seg[i];
 }