X-Git-Url: http://git.annexia.org/?p=libguestfs.git;a=blobdiff_plain;f=daemon%2Ffile.c;h=5bc5f412dd4b975766141a79f5554bf683203be4;hp=9403100df8289111aad49c97826c273ebd86ab5e;hb=e65f5213637e71f6f88763ce177fd23c65e1033d;hpb=533aff2879d85a4061b9d31e9b25996ce0af60f5

diff --git a/daemon/file.c b/daemon/file.c
index 9403100..5bc5f41 100644
--- a/daemon/file.c
+++ b/daemon/file.c
@@ -415,6 +415,16 @@ do_pread (const char *path, int count, int64_t offset, size_t *size_r)
   ssize_t r;
   char *buf;
 
+  if (count < 0) {
+    reply_with_error ("count is negative");
+    return NULL;
+  }
+
+  if (offset < 0) {
+    reply_with_error ("offset is negative");
+    return NULL;
+  }
+
   /* The actual limit on messages is smaller than this.  This check
    * just limits the amount of memory we'll try and allocate in the
    * function.  If the message is larger than the real limit, that