From: Li Qiang <liqiang...@360.cn>
When vmxnet transport abstraction layer initialises pkt,
the maximum fragmentation count is not checked. This could lead
to an integer overflow causing a NULL pointer dereference.
Replace g_malloc() with g_new() to catch the multiplication
overflow.
Reported-by: Li Qiang <liqiang...@360.cn>
Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
Acked-by: Dmitry Fleytman <dmi...@daynix.com>
Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com>
---
hw/net/vmxnet_tx_pkt.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/hw/net/vmxnet_tx_pkt.c b/hw/net/vmxnet_tx_pkt.c
index 5ba2f5e..849826b 100644
--- a/hw/net/vmxnet_tx_pkt.c
+++ b/hw/net/vmxnet_tx_pkt.c
@@ -60,10 +60,9 @@ void vmxnet_tx_pkt_init(struct VmxnetTxPkt **pkt, uint32_t
max_frags,
{
struct VmxnetTxPkt *p = g_malloc0(sizeof *p);
- p->vec = g_malloc((sizeof *p->vec) *
- (max_frags + VMXNET_TX_PKT_PL_START_FRAG));
+ p->vec = g_new(struct iovec, max_frags + VMXNET_TX_PKT_PL_START_FRAG);
- p->raw = g_malloc((sizeof *p->raw) * max_frags);
+ p->raw = g_new(struct iovec, max_frags);
p->max_payload_frags = max_frags;
p->max_raw_frags = max_frags;
--
1.9.1
