Add array bounds checking in xendDaemonListDomains

diff --git a/ChangeLog b/ChangeLog
index 9b992997429f25e359721e746d693d245f440974..330e2a5ddc0ffe8f839ec5cc534e45efa4589dc9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,9 @@
-Mon Dec  6 17:46:03 EST 2006 Daniel Berrange <berrange@redhat.com>
+Thu Dec  7 12:28:03 EST 2006 Daniel Berrange <berrange@redhat.com>
+
+       * src/xend_internal.c: Add bounds checking in xenDaemonListDomains to
+       avoid overflowing the 'ids' array.
+
+Wed Dec  6 17:46:03 EST 2006 Daniel Berrange <berrange@redhat.com>
 
        * src/xend_internal.c: Support parsing of new paravirt framebuffer
        graphics configuration from xen 3.0.4 tree.
@@ -6,7 +11,7 @@ Mon Dec  6 17:46:03 EST 2006 Daniel Berrange <berrange@redhat.com>
        config parsing in paravirt & fullyvirt.
        * test/sexpr2xmldata/sexpr2xml-pv-vfb-*: New test data files
 
-Mon Dec  6 17:40:03 EST 2006 Daniel Berrange <berrange@redhat.com>
+Wed Dec  6 17:40:03 EST 2006 Daniel Berrange <berrange@redhat.com>
 
        * test/xml2sexprdata/xml2sexpr-curmem.xml, test/xml2sexprdata/xml2sexpr-curmem.sexpr:
        Fix test case to reflect recent change to bootloader/image handling

diff --git a/src/xend_internal.c b/src/xend_internal.c
index 3e73ef3493284908243f9ea2441ab1ed7a8615f4..e3f652c70ce5d7a3a53c9f307a2dcecc4d61a587 100644 (file)
--- a/src/xend_internal.c
+++ b/src/xend_internal.c
@@ -2625,7 +2625,9 @@ xenDaemonListDomains(virConnectPtr conn, int *ids, int maxids)
             continue;
         id = xenDaemonDomainLookupByName_ids(conn, node->value, NULL);
         if (id >= 0)
-           ids[ret++] = (int) id;
+            ids[ret++] = (int) id;
+        if (ret >= maxids)
+            break;
     }
 
 error: