OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
cc941111a5
qemu-e2k/hw
History
Fabiano Rosas cc941111a5 spapr: fix out of bounds write in spapr_populate_drmem_v2 
buf_len is uint8_t which is not large enough to hold the result of:

  nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);

for a nr_entries greater than 10.

This causes the allocated buffer 'int_buf' to be smaller than expected
and we eventually overwrite some of glibc's control structures (see
"chunk" in https://sourceware.org/glibc/wiki/MallocInternals)

The following error is seen while trying to free int_buf:

  "free(): invalid next size (fast)"

Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property"
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
2019-02-17 21:54:02 +11:00
..
9pfs
acpi qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
adc
alpha hw/alpha/Makefile.objs: Create CONFIG_* for alpha 2019-02-05 16:50:20 +01:00
arm hw/arm/armsse: Fix miswiring of expansion IRQs 2019-02-15 09:56:39 +00:00
audio audio: fix pc speaker init 2019-01-24 13:10:19 +01:00
block virtio-blk: set correct config size for the host driver 2019-02-13 16:18:17 +08:00
bt char: allow specifying a GMainContext at opening time 2019-02-13 14:23:39 +01:00
char qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
core qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
cpu hw/cpu/cluster: Mark the cpu-cluster device with user_creatable = false 2019-02-06 15:55:56 +01:00
cris hw/cris/Makefile.objs: Create CONFIG_* for cris 2019-02-05 16:50:20 +01:00
display hw/display/milkymist-tmu2: Move inlined code from header to source 2019-02-01 11:58:50 +01:00
dma hw/dma/i8257: Use qemu_log_mask(UNIMP) instead of fprintf 2019-02-14 11:46:30 +01:00
gpio trace: enforce that every trace-events file has a final newline 2019-01-24 14:16:56 +00:00
hppa hw/hppa: forward requests to CPU HPA 2019-02-12 08:59:21 -08:00
hyperv
i2c hw/i2c/Makefile.objs: Create new CONFIG_* variables for EEPROM and ACPI controller 2019-02-05 16:50:21 +01:00
i386 * cpu-exec fixes (Emilio, Laurent) 2019-02-05 19:39:22 +00:00
ide ide: split ioport registration to a separate file 2019-02-05 16:50:19 +01:00
input pckbd: Convert DPRINTF->trace 2019-02-14 11:46:30 +01:00
intc xive: Only set source type for LSIs 2019-02-17 21:54:02 +11:00
ipack
ipmi
isa char: allow specifying a GMainContext at opening time 2019-02-13 14:23:39 +01:00
lm32 hw/lm32/Makefile.objs: Conditionally build lm32 and milkmyst 2019-02-05 16:50:20 +01:00
m68k hw/m68k/Makefile.objs: Conditionally build boards 2019-02-05 16:50:19 +01:00
mem memory-device: rewrite address assignment using ranges 2019-01-09 22:09:31 -02:00
microblaze hw/microblaze/Makefile.objs: Create configs for petalogix and xilinx boards 2019-02-05 16:50:19 +01:00
mips hw/mips_int: hold BQL for all interrupt requests 2019-02-14 17:47:28 +01:00
misc cuda: decrease time delay before raising VIA SR interrupt and remove fast path 2019-02-17 21:54:02 +11:00
moxie hw/moxie/Makefile.objs: Conditionally build moxie 2019-02-05 16:50:20 +01:00
net hw/pci-host/Makefile.objs: make CONFIGS clear for PCI EXPRESS 2019-02-05 16:50:19 +01:00
nios2 hw/nios2/Makefile.objs: Conditionally build nios2 2019-02-05 16:50:20 +01:00
nvram fw_cfg: fix the life cycle and the name of "qemu_extra_params_fw" 2019-02-05 10:58:33 -05:00
openrisc hw/openrisc/Makefile.objs: Create CONFIG_* for openrisc 2019-02-05 16:50:21 +01:00
pci qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
pci-bridge
pci-host build: actually use CONFIG_PAM 2019-02-05 16:50:19 +01:00
pcmcia
ppc spapr: fix out of bounds write in spapr_populate_drmem_v2 2019-02-17 21:54:02 +11:00
rdma hw/rdma: modify struct initialization 2019-01-19 11:01:33 +02:00
riscv riscv: Ensure the kernel start address is correctly cast 2019-02-11 15:56:22 -08:00
s390x qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
scsi qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
sd hw: sd: set category of the sd memory card 2019-01-30 10:24:20 +01:00
sh4 * cpu-exec fixes (Emilio, Laurent) 2019-02-05 19:39:22 +00:00
smbios
sparc qemu-sparc queue 2019-02-07 16:49:30 +00:00
sparc64 hw/sparc64: Explicitly set default_display = "std" 2019-02-14 11:46:30 +01:00
ssi aspeed/smc: snoop SPI transfers to fake dummy cycles 2019-01-29 11:46:05 +00:00
timer
tpm
tricore hw/tricore/Makefile.objs: Create CONFIG_* for tricore 2019-02-05 16:50:21 +01:00
unicore32 hw/unicore32/puv3: Drop useless inclusion of "hw/i386/pc.h" 2019-02-06 15:54:12 +01:00
usb qdev: pass an Object * to qbus_set_hotplug_handler() 2019-02-17 21:54:02 +11:00
vfio hw/vfio/Makefile.objs: Create new CONFIG_* variables for VFIO core and PCI 2019-02-05 16:50:21 +01:00
virtio hw/virtio: Use CONFIG_VIRTIO_PCI switch instead of CONFIG_PCI 2019-02-05 10:58:33 -05:00
watchdog
xen xen: fix xen-bus state model to allow frontend re-connection 2019-02-04 11:04:49 +00:00
xenpv
xtensa hw/xtensa/Makefile.objs: Build xtensa_sim and xtensa_fpga conditionally 2019-02-05 16:50:20 +01:00
Makefile.objs hw/vfio/Makefile.objs: Create new CONFIG_* variables for VFIO core and PCI 2019-02-05 16:50:21 +01:00