diff options
| author | Thomas Huth <thuth@redhat.com> | 2023-02-14 15:10:56 +0100 |
|---|---|---|
| committer | Thomas Huth <thuth@redhat.com> | 2023-02-27 09:15:38 +0100 |
| commit | eb60026120081430d554c9cabaa36c4ac271fce0 (patch) | |
| tree | e52a6e5393cd45c43968d5aa74159eaee2c8a41e /target/s390x/arch_dump.c | |
| parent | ecba64689596614112b662d0579d097fa5cfd5d5 (diff) | |
target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()
"note_size" can be smaller than sizeof(note), so unconditionally calling
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
case notep has been allocated dynamically, thus let's use note_size as
length argument for memset() instead.
Reported-by: Sebastian Mitterle <smitterl@redhat.com>
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Diffstat (limited to 'target/s390x/arch_dump.c')
| -rw-r--r-- | target/s390x/arch_dump.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c index a2329141e8..a7c44ba49d 100644 --- a/target/s390x/arch_dump.c +++ b/target/s390x/arch_dump.c @@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name, notep = g_malloc(note_size); } - memset(notep, 0, sizeof(note)); + memset(notep, 0, note_size); /* Setup note header data */ notep->hdr.n_descsz = cpu_to_be32(content_size); |