diff options
| author | Mike McCormack <mj.mccormack@samsung.com> | 2011-04-12 11:41:00 +0900 |
|---|---|---|
| committer | Riku Voipio <riku.voipio@iki.fi> | 2011-05-02 10:00:01 +0300 |
| commit | e95d3bf04d8a54af43bb8db3b8eb64d68c9f6927 (patch) | |
| tree | ac22c3982946d90b895cc9f0fd0d63532a92b83c /linux-user | |
| parent | 6f11f013a5ef88c42ce2e9060bbaafb39676ca39 (diff) | |
Fix buffer overrun in sched_getaffinity
Zeroing of the cpu array should start from &cpus[kernel_ret]
not &cpus[num_zeros_to_fill].
This fixes a crash in EFL's edje_cc running under qemu-arm.
Signed-off-by: Mike McCormack <mj.mccormack@samsung.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
Diffstat (limited to 'linux-user')
| -rw-r--r-- | linux-user/syscall.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index e969d1b61d..5b7b8e2394 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -6505,7 +6505,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, unsigned long zero = arg2 - ret; p = alloca(zero); memset(p, 0, zero); - if (copy_to_user(arg3 + zero, p, zero)) { + if (copy_to_user(arg3 + ret, p, zero)) { goto efault; } arg2 = ret; |