[dpdk-dev] [PATCH v2 1/3] vhost: fix malloc in rte_vhost_get_mem_table

Stojaczyk, DariuszX dariuszx.stojaczyk at intel.com
Thu May 11 14:32:38 CEST 2017


The size variable is still used a few lines later:
memcpy(m->regions, dev->mem->regions, size);
That line is ok. Only the amount of malloc'ed memory was too small.

-----Original Message-----
From: Jens Freimann [mailto:jfreiman at redhat.com] 
Sent: Thursday, May 11, 2017 1:42 PM
To: Stojaczyk, DariuszX <dariuszx.stojaczyk at intel.com>
Cc: dev at dpdk.org
Subject: Re: [dpdk-dev] [PATCH v2 1/3] vhost: fix malloc in rte_vhost_get_mem_table

On Thu, May 11, 2017 at 12:56:46PM +0200, Dariusz Stojaczyk wrote:
> Amount of allocated memory was too small, causing buffer overflow.
> 
> Signed-off-by: Dariusz Stojaczyk <dariuszx.stojaczyk at intel.com>
> ---
> Removed Gerrit Change-Id
>  lib/librte_vhost/vhost.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/librte_vhost/vhost.c b/lib/librte_vhost/vhost.c index 
> 0b19d2e..1f565fb 100644
> --- a/lib/librte_vhost/vhost.c
> +++ b/lib/librte_vhost/vhost.c
> @@ -369,7 +369,7 @@ rte_vhost_get_mem_table(int vid, struct rte_vhost_memory **mem)
>  		return -1;
>  
>  	size = dev->mem->nregions * sizeof(struct rte_vhost_mem_region);
> -	m = malloc(size);
> +	m = malloc(sizeof(struct rte_vhost_memory) + size);

Why not just add it to the line above where size is calculated?
With that changed,

Reviewed-by: Jens Freimann <jfreimann at redhat.com> 


regards,
Jens

--------------------------------------------------------------------

Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek
przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by
others is strictly prohibited.



More information about the dev mailing list