OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

ipmi:smbus: Add a check around a memcpy

Browse Source 
In one case:

  memcpy(sid->inmsg + sid->inlen, buf, len);

if len == 0 then sid->inmsg + sig->inlen can point to one past the inmsg
array if the array is full.  We have to allow len == 0 due to some
vagueness in the spec, but we don't have to call memcpy.

Found by Coverity.  This is not a problem in practice, but the results
are technically (maybe) undefined.  So make Coverity happy.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Corey Minyard 2022-07-31 17:58:09 -05:00
parent cc42559ab1
commit 3fde641e72
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/ipmi/smbus_ipmi.c
View File

@ -281,7 +281,9 @@ static int ipmi_write_data(SMBusDevice *dev, uint8_t *buf, uint8_t len)
*/
send = true;
}
memcpy(sid->inmsg + sid->inlen, buf, len);
if (len > 0) {
memcpy(sid->inmsg + sid->inlen, buf, len);
}
sid->inlen += len;
break;
}