|
 |
bf143f |
From e1870dec813fa6f8482f4f27b7a9bef8c1584b6b Mon Sep 17 00:00:00 2001
|
|
|
bf143f |
From: Thomas Huth <thuth@redhat.com>
|
|
|
bf143f |
Date: Tue, 14 Feb 2023 14:48:37 +0100
|
|
|
bf143f |
Subject: [PATCH 3/3] target/s390x/arch_dump: Fix memory corruption in
|
|
|
bf143f |
s390x_write_elf64_notes()
|
|
|
bf143f |
MIME-Version: 1.0
|
|
|
bf143f |
Content-Type: text/plain; charset=UTF-8
|
|
|
bf143f |
Content-Transfer-Encoding: 8bit
|
|
|
bf143f |
|
|
|
bf143f |
RH-Author: Thomas Huth <thuth@redhat.com>
|
|
|
bf143f |
RH-MergeRequest: 260: target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()
|
|
|
bf143f |
RH-Bugzilla: 2168187
|
|
|
bf143f |
RH-Acked-by: David Hildenbrand <david@redhat.com>
|
|
|
bf143f |
RH-Acked-by: Cédric Le Goater <clg@redhat.com>
|
|
|
bf143f |
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
|
|
|
bf143f |
RH-Commit: [1/1] 67b71ed720a1f03d5bda9119969ea95fc4a6106d
|
|
|
bf143f |
|
|
|
bf143f |
Bugzilla: https://bugzilla.redhat.com/2168187
|
|
|
bf143f |
Upstream-Status: Posted (and reviewed, but not merged yet)
|
|
|
bf143f |
|
|
|
bf143f |
"note_size" can be smaller than sizeof(note), so unconditionally calling
|
|
|
bf143f |
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
|
|
|
bf143f |
case notep has been allocated dynamically, thus let's use note_size as
|
|
|
bf143f |
length argument for memset() instead.
|
|
|
bf143f |
|
|
|
bf143f |
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
|
|
|
bf143f |
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
|
|
|
bf143f |
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
|
|
|
bf143f |
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
|
bf143f |
Signed-off-by: Thomas Huth <thuth@redhat.com>
|
|
|
bf143f |
---
|
|
|
bf143f |
target/s390x/arch_dump.c | 2 +-
|
|
|
bf143f |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
bf143f |
|
|
|
bf143f |
diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c
|
|
|
bf143f |
index a2329141e8..a7c44ba49d 100644
|
|
|
bf143f |
--- a/target/s390x/arch_dump.c
|
|
|
bf143f |
+++ b/target/s390x/arch_dump.c
|
|
|
bf143f |
@@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name,
|
|
|
bf143f |
notep = g_malloc(note_size);
|
|
|
bf143f |
}
|
|
|
bf143f |
|
|
|
bf143f |
- memset(notep, 0, sizeof(note));
|
|
|
bf143f |
+ memset(notep, 0, note_size);
|
|
|
bf143f |
|
|
|
bf143f |
/* Setup note header data */
|
|
|
bf143f |
notep->hdr.n_descsz = cpu_to_be32(content_size);
|
|
|
bf143f |
--
|
|
|
bf143f |
2.37.3
|
|
|
bf143f |
|