[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 08/33] target/s390x/arch_dump: Fix memory corruption in s390x_writ
From: |
Thomas Huth |
Subject: |
[PULL 08/33] target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes() |
Date: |
Mon, 27 Feb 2023 12:35:56 +0100 |
"note_size" can be smaller than sizeof(note), so unconditionally calling
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
case notep has been allocated dynamically, thus let's use note_size as
length argument for memset() instead.
Reported-by: Sebastian Mitterle <smitterl@redhat.com>
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
target/s390x/arch_dump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c
index a2329141e8..a7c44ba49d 100644
--- a/target/s390x/arch_dump.c
+++ b/target/s390x/arch_dump.c
@@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name,
notep = g_malloc(note_size);
}
- memset(notep, 0, sizeof(note));
+ memset(notep, 0, note_size);
/* Setup note header data */
notep->hdr.n_descsz = cpu_to_be32(content_size);
--
2.31.1
- [PULL 00/33] s390x and testing related patches, Thomas Huth, 2023/02/27
- [PULL 03/33] hw/vfio/ccw: Simplify using DEVICE() macro, Thomas Huth, 2023/02/27
- [PULL 02/33] Do not include hw/hw.h if it is not necessary, Thomas Huth, 2023/02/27
- [PULL 05/33] hw/vfio/ccw: Replace DO_UPCAST(S390CCWDevice) by S390_CCW_DEVICE(), Thomas Huth, 2023/02/27
- [PULL 06/33] hw/vfio/ccw: Remove pointless S390CCWDevice variable, Thomas Huth, 2023/02/27
- [PULL 04/33] hw/vfio/ccw: Use intermediate S390CCWDevice variable, Thomas Huth, 2023/02/27
- [PULL 01/33] tests/qtest/rtl8139-test: Make the test less verbose by default, Thomas Huth, 2023/02/27
- [PULL 07/33] hw/vfio/ccw: Replace DO_UPCAST(VFIOCCWDevice) by VFIO_CCW(), Thomas Huth, 2023/02/27
- [PULL 08/33] target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes(),
Thomas Huth <=
- [PULL 09/33] target/s390x/arch_dump: Simplify memory allocation in s390x_write_elf64_notes(), Thomas Huth, 2023/02/27
- [PULL 12/33] target/s390x: Use void* for haddr in S390Access, Thomas Huth, 2023/02/27
- [PULL 14/33] target/s390x: Remove TLB_NOTDIRTY workarounds, Thomas Huth, 2023/02/27
- [PULL 13/33] target/s390x: Tidy access_prepare_nf, Thomas Huth, 2023/02/27
- [PULL 10/33] target/s390x: Fix s390_probe_access for user-only, Thomas Huth, 2023/02/27
- [PULL 11/33] target/s390x: Pass S390Access pointer into access_prepare, Thomas Huth, 2023/02/27
- [PULL 15/33] target/s390x: Inline do_access_{get,set}_byte, Thomas Huth, 2023/02/27
- [PULL 16/33] target/s390x: Hoist some computation in access_memmove, Thomas Huth, 2023/02/27
- [PULL 22/33] tests/tcg/s390x: Add bal.S, Thomas Huth, 2023/02/27
- [PULL 29/33] gitlab-ci.d/buildtest: Disintegrate the build-coroutine-sigaltstack job, Thomas Huth, 2023/02/27