Commit 11fc4758 authored by Pavel Emelyanov's avatar Pavel Emelyanov

signals: Sanitize j loop control variable

Signed-off-by: 's avatarPavel Emelyanov <xemul@parallels.com>
parent f9ebd183
...@@ -1162,7 +1162,7 @@ err: ...@@ -1162,7 +1162,7 @@ err:
static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group) static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group)
{ {
struct ptrace_peeksiginfo_args arg; struct ptrace_peeksiginfo_args arg;
int ret, j; int ret;
SignalQueueEntry *queue = NULL; SignalQueueEntry *queue = NULL;
pr_debug("Dump %s signals of %d\n", group ? "shared" : "private", tid); pr_debug("Dump %s signals of %d\n", group ? "shared" : "private", tid);
...@@ -1180,7 +1180,7 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group) ...@@ -1180,7 +1180,7 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group)
signal_queue_entry__init(queue); signal_queue_entry__init(queue);
for (; ; ) { for (; ; ) {
int nr; int nr, si_pos;
siginfo_t *si; siginfo_t *si;
si = xmalloc(SI_BATCH * sizeof(*si)); si = xmalloc(SI_BATCH * sizeof(*si));
...@@ -1209,7 +1209,8 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group) ...@@ -1209,7 +1209,8 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group)
break; break;
} }
for (j = queue->n_signals - nr; j < queue->n_signals; j++) { for (si_pos = queue->n_signals - nr;
si_pos < queue->n_signals; si_pos++) {
SiginfoEntry *se; SiginfoEntry *se;
se = xmalloc(sizeof(*se)); se = xmalloc(sizeof(*se));
...@@ -1223,7 +1224,7 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group) ...@@ -1223,7 +1224,7 @@ static int dump_signal_queue(pid_t tid, SignalQueueEntry **sqe, bool group)
se->siginfo.data = (void *)si++; /* XXX we don't free cores, but when se->siginfo.data = (void *)si++; /* XXX we don't free cores, but when
* we will, this would cause problems * we will, this would cause problems
*/ */
queue->signals[j] = se; queue->signals[si_pos] = se;
} }
if (ret < 0) if (ret < 0)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment