target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()
"note_size" can be smaller than sizeof(note), so unconditionally calling memset(notep, 0, sizeof(note)) could cause a memory corruption here in case notep has been allocated dynamically, thus let's use note_size as length argument for memset() instead. Reported-by: Sebastian Mitterle <smitterl@redhat.com> Fixes: 113d8f4e95 ("s390x: pv: Add dump support") Message-Id: <20230214141056.680969-1-thuth@redhat.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> (cherry picked from commit eb60026120081430d554c9cabaa36c4ac271fce0) Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
parent
a2efa1fac4
commit
a3c6cd83e3
@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name,
|
||||
notep = g_malloc(note_size);
|
||||
}
|
||||
|
||||
memset(notep, 0, sizeof(note));
|
||||
memset(notep, 0, note_size);
|
||||
|
||||
/* Setup note header data */
|
||||
notep->hdr.n_descsz = cpu_to_be32(content_size);
|
||||
|
Loading…
x
Reference in New Issue
Block a user