From f7e943f7ec8f51817da57ea4b9d2b31418e62a95 Mon Sep 17 00:00:00 2001 From: Vincent Penquerc'h Date: Mon, 20 Jan 2014 13:22:49 -0500 Subject: [PATCH] txrx-vchan: guard against invalid buffer sizes from libvchan These APIs can now return -1 when invalid indices are detected. --- qrexec-lib/txrx-vchan.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/qrexec-lib/txrx-vchan.c b/qrexec-lib/txrx-vchan.c index a1324b8..d5ae038 100644 --- a/qrexec-lib/txrx-vchan.c +++ b/qrexec-lib/txrx-vchan.c @@ -73,12 +73,22 @@ int read_all_vchan_ext(void *buf, int size) int read_ready_vchan_ext() { - return libvchan_data_ready(ctrl); + int ready = libvchan_data_ready(ctrl); + if (ready < 0) { + fprintf(stderr, "libvchan_data_ready returned invalid size\n"); + exit(1); + } + return ready; } int buffer_space_vchan_ext() { - return libvchan_buffer_space(ctrl); + int space = libvchan_buffer_space(ctrl); + if (space < 0) { + fprintf(stderr, "libvchan_buffer_space returned invalid size\n"); + exit(1); + } + return space; } // if the remote domain is destroyed, we get no notification