Google Git
Sign in
qemu / qemu / ef001f069e0f175a036929782c5c63053df9569a
commitef001f069e0f175a036929782c5c63053df9569a[log] [tgz]
authorThomas Huth <thuth@redhat.com>Tue Sep 15 21:34:20 2015 +0200
committerDavid Gibson <david@gibson.dropbear.id.au>Wed Sep 23 10:51:11 2015 +1000
tree2bf211642512ebec996b2cc8c4dad7e6b786552e
parent20bb648dca6d7fe8cdd1941194e7851950b25dc5 [diff]
ppc/spapr: Fix buffer overflow in spapr_populate_drconf_memory()

The buffer that is allocated in spapr_populate_drconf_memory()
is used for setting both, the "ibm,dynamic-memory" and the
"ibm,associativity-lookup-arrays" property. However, only the
size of the first one is taken into account when allocating the
memory. So if the length of the second property is larger than
the length of the first one, we run into a buffer overflow here!
Fix it by taking the length of the second property into account,
too.

Fixes: "spapr: Support ibm,dynamic-reconfiguration-memory" patch
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
1 file changed
tree: 2bf211642512ebec996b2cc8c4dad7e6b786552e
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. crypto/
  6. default-configs/
  7. disas/
  8. docs/
  9. fpu/
  10. fsdev/
  11. gdb-xml/
  12. hw/
  13. include/
  14. libcacard/
  15. libdecnumber/
  16. linux-headers/
  17. linux-user/
  18. migration/
  19. net/
  20. pc-bios/
  21. po/
  22. qapi/
  23. qga/
  24. qobject/
  25. qom/
  26. roms/
  27. scripts/
  28. slirp/
  29. stubs/
  30. target-alpha/
  31. target-arm/
  32. target-cris/
  33. target-i386/
  34. target-lm32/
  35. target-m68k/
  36. target-microblaze/
  37. target-mips/
  38. target-moxie/
  39. target-openrisc/
  40. target-ppc/
  41. target-s390x/
  42. target-sh4/
  43. target-sparc/
  44. target-tilegx/
  45. target-tricore/
  46. target-unicore32/
  47. target-xtensa/
  48. tcg/
  49. tests/
  50. trace/
  51. ui/
  52. util/
  53. dtc
  54. pixman
  55. .exrc
  56. .gitignore
  57. .gitmodules
  58. .mailmap
  59. .travis.yml
  60. accel.c
  61. aio-posix.c
  62. aio-win32.c
  63. arch_init.c
  64. async.c
  65. balloon.c
  66. block.c
  67. blockdev-nbd.c
  68. blockdev.c
  69. blockjob.c
  70. bootdevice.c
  71. bt-host.c
  72. bt-vhci.c
  73. Changelog
  74. CODING_STYLE
  75. configure
  76. COPYING
  77. COPYING.LIB
  78. coroutine-gthread.c
  79. coroutine-sigaltstack.c
  80. coroutine-ucontext.c
  81. coroutine-win32.c
  82. cpu-exec-common.c
  83. cpu-exec.c
  84. cpus.c
  85. cputlb.c
  86. device-hotplug.c
  87. device_tree.c
  88. disas.c
  89. dma-helpers.c
  90. dump.c
  91. exec.c
  92. gdbstub.c
  93. HACKING
  94. hmp-commands-info.hx
  95. hmp-commands.hx
  96. hmp.c
  97. hmp.h
  98. iohandler.c
  99. ioport.c
  100. iothread.c
  101. kvm-all.c
  102. kvm-stub.c
  103. LICENSE
  104. main-loop.c
  105. MAINTAINERS
  106. Makefile
  107. Makefile.objs
  108. Makefile.target
  109. memory.c
  110. memory_mapping.c
  111. module-common.c
  112. monitor.c
  113. nbd.c
  114. numa.c
  115. os-posix.c
  116. os-win32.c
  117. page_cache.c
  118. qapi-schema.json
  119. qdev-monitor.c
  120. qdict-test-data.txt
  121. qemu-bridge-helper.c
  122. qemu-char.c
  123. qemu-coroutine-io.c
  124. qemu-coroutine-lock.c
  125. qemu-coroutine-sleep.c
  126. qemu-coroutine.c
  127. qemu-doc.texi
  128. qemu-ga.texi
  129. qemu-img-cmds.hx
  130. qemu-img.c
  131. qemu-img.texi
  132. qemu-io-cmds.c
  133. qemu-io.c
  134. qemu-log.c
  135. qemu-nbd.c
  136. qemu-nbd.texi
  137. qemu-options-wrapper.h
  138. qemu-options.h
  139. qemu-options.hx
  140. qemu-seccomp.c
  141. qemu-tech.texi
  142. qemu-timer.c
  143. qemu.nsi
  144. qemu.sasl
  145. qjson.c
  146. qmp-commands.hx
  147. qmp.c
  148. qtest.c
  149. README
  150. rules.mak
  151. softmmu_template.h
  152. spice-qemu-char.c
  153. tcg-runtime.c
  154. tci.c
  155. thread-pool.c
  156. thunk.c
  157. tpm.c
  158. trace-events
  159. translate-all.c
  160. translate-all.h
  161. translate-common.c
  162. user-exec.c
  163. VERSION
  164. version.rc
  165. vl.c
  166. xen-common-stub.c
  167. xen-common.c
  168. xen-hvm-stub.c
  169. xen-hvm.c
  170. xen-mapcache.c