Correct buffer->size at the same time as buffer->capacity when shrinking down a

buffer that has grown beyond max_capacity.  This fixes a Xenconsoled segfault
that was caused by stomping around above the buffer's allocated region.  It
became possible to set the max_capacity with changeset 7431, and ever
since then we have been exposed to this bug.  It would most easily be triggered
by running a domain without a client attached to the console, so that the
max_capacity was reached more easily.

Closes bug #380.

Signed-off-by: Ewan Mellor <ewan@xensource.com>

diff --git a/tools/console/daemon/io.c b/tools/console/daemon/io.c
index 6a9de1b48f911fa1ac134bff5760dcd17bffbb3a..80e76c416efa7aaef21a708cc5c5222b1dcf9f1f 100644 (file)
--- a/tools/console/daemon/io.c
+++ b/tools/console/daemon/io.c
@@ -114,7 +114,7 @@ static void buffer_append(struct domain *dom)
                        buffer->data, buffer->max_capacity);
                buffer->data = realloc(buffer->data,
                                       buffer->max_capacity);
-               buffer->capacity = buffer->max_capacity;
+               buffer->size = buffer->capacity = buffer->max_capacity;
        }
 }