Skip to content
  • David Gibson's avatar
    qemu-char: BUGFIX, don't call FD_ISSET with negative fd · bbdd2ad0
    David Gibson authored
    
    
    tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does
    not check if the fd it is using is valid (>= 0) before passing it to
    qemu_set_fd_handler2().  If using e.g. a TCP serial port, which is not
    initially connected, this can result in -1 being passed to FD_ISSET, which
    has undefined behaviour.  On x86 it seems to harmlessly return 0, but on
    PowerPC, it causes a fortify buffer overflow error to be thrown.
    
    This patch fixes this by putting an extra test in tcp_chr_connect(), and
    also adds an assert qemu_set_fd_handler2() to catch other such errors on
    all platforms, rather than just some.
    
    Signed-off-by: default avatarDavid Gibson <david@gibson.dropbear.id.au>
    Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
    bbdd2ad0