Re: [libvirt] [PATCH 01/10] uml: fix logic bug in checking reply length

2010/8/19 Eric Blake <eblake(a)redhat.com&gt;: > * src/uml/uml_driver.c (umlMonitorCommand): Validate that enough > bytes were read to dereference both res.length, and that many > bytes from res.data. > Reported by Soren Hansen. > --- > - if (nbytes < sizeof res) { > + if (nbytes < offsetof(struct monitor_request, data) || > + nbytes < res.length + offsetof(struct monitor_request, data)) { You could reverse the order to nbytes < offsetof(struct monitor_request, data) + res.length to be in line with the layout of the data, but that's just me nit-picking here.

ACK.