aboutsummaryrefslogtreecommitdiff
path: root/bt-host.c
diff options
context:
space:
mode:
authorMarkus Armbruster <armbru@redhat.com>2013-01-23 18:25:08 +0100
committerBlue Swirl <blauwirbel@gmail.com>2013-01-26 13:23:33 +0000
commitd09acb9b5ef0bb4fa94d3d459919a6ebaf8804bc (patch)
tree3ab5a8bc33f0856f130c055b1c1eba2e7585ce9a /bt-host.c
parenta6e7c18476f5383720b3f57ef4f467b2e7c2565e (diff)
fw_cfg: Splash image loader can overrun a stack variable, fix
read_splashfile() passes the address of an int variable as size_t * parameter to g_file_get_contents(), with a cast to gag the compiler. No problem on machines where sizeof(size_t) == sizeof(int). Happens to work on my x86_64 box (64 bit little endian): the least significant 32 bits of the file size end up in the right place (caller's variable file_size), and the most significant 32 bits clobber a place that gets assigned to before its next use (caller's variable file_type). I'd expect it to break on a 64 bit big-endian box. Fix up the variable types and drop the problematic cast. Signed-off-by: Markus Armbruster <armbru@redhat.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com> Signed-off-by: Blue Swirl <blauwirbel@gmail.com>
Diffstat (limited to 'bt-host.c')
0 files changed, 0 insertions, 0 deletions