diff options
| author | Klaus Jensen <k.jensen@samsung.com> | 2024-08-20 06:16:48 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2024-08-28 08:37:29 +0300 |
| commit | 4358fa333eafd588aca210cd5fa7b7effb0d7f0b (patch) | |
| tree | cad8c0293874fc025609579e36c7ef83c1136563 | |
| parent | f6f03df49f771a29ec6bd69fe098e8dbf5eebb03 (diff) | |
hw/nvme: fix leak of uninitialized memory in io_mgmt_recv
Yutaro Shimizu from the Cyber Defense Institute discovered a bug in the
NVMe emulation that leaks contents of an uninitialized heap buffer if
subsystem and FDP emulation are enabled.
Cc: qemu-stable@nongnu.org
Reported-by: Yutaro Shimizu <shimizu@cyberdefense.jp>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
(cherry picked from commit 6a22121c4f25b181e99479f65958ecde65da1c92)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/nvme/ctrl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 652116085e..659332db0a 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -4302,7 +4302,7 @@ static uint16_t nvme_io_mgmt_recv_ruhs(NvmeCtrl *n, NvmeRequest *req, nruhsd = ns->fdp.nphs * endgrp->fdp.nrg; trans_len = sizeof(NvmeRuhStatus) + nruhsd * sizeof(NvmeRuhStatusDescr); - buf = g_malloc(trans_len); + buf = g_malloc0(trans_len); trans_len = MIN(trans_len, len); |