-
Markus Armbruster authored
qio_channel_rdma_readv() assigns the size_t value of qemu_rdma_fill() to an int variable before it adds it to @done / subtracts it from @want, both size_t. Truncation when qemu_rdma_fill() copies more than INT_MAX bytes. Seems vanishingly unlikely, but needs fixing all the same. Fixes: 6ddd2d76 (migration: convert RDMA to use QIOChannel interface) Signed-off-by:
Markus Armbruster <armbru@redhat.com>
Reviewed-by:
Fabiano Rosas <farosas@suse.de>
Reviewed-by:
Juan Quintela <quintela@redhat.com>
Signed-off-by:
Juan Quintela <quintela@redhat.com>
Message-ID: <20230928132019.2544702-7-armbru@redhat.com>Markus Armbruster authoredqio_channel_rdma_readv() assigns the size_t value of qemu_rdma_fill() to an int variable before it adds it to @done / subtracts it from @want, both size_t. Truncation when qemu_rdma_fill() copies more than INT_MAX bytes. Seems vanishingly unlikely, but needs fixing all the same. Fixes: 6ddd2d76 (migration: convert RDMA to use QIOChannel interface) Signed-off-by:
Markus Armbruster <armbru@redhat.com>
Reviewed-by:
Fabiano Rosas <farosas@suse.de>
Reviewed-by:
Juan Quintela <quintela@redhat.com>
Signed-off-by:
Juan Quintela <quintela@redhat.com>
Message-ID: <20230928132019.2544702-7-armbru@redhat.com>
Loading