diff options
| author | Thomas Huth <thuth@redhat.com> | 2023-02-14 15:10:56 +0100 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-03-30 12:19:04 +0300 |
| commit | a3c6cd83e32d7729889b3eab2a9b6b4650c56ea9 (patch) | |
| tree | a41699c76247556213f0ed537ac1b593939ad6a7 /io/channel-tls.c | |
| parent | a2efa1fac49b7d7d10564ef0007b2ed02e69fdf5 (diff) | |
target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()
"note_size" can be smaller than sizeof(note), so unconditionally calling
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
case notep has been allocated dynamically, thus let's use note_size as
length argument for memset() instead.
Reported-by: Sebastian Mitterle <smitterl@redhat.com>
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit eb60026120081430d554c9cabaa36c4ac271fce0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'io/channel-tls.c')
0 files changed, 0 insertions, 0 deletions