From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:55217) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RkE6D-000097-Iz for qemu-devel@nongnu.org; Mon, 09 Jan 2012 07:13:19 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RkE69-0005ug-Kp for qemu-devel@nongnu.org; Mon, 09 Jan 2012 07:13:13 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51068) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RkE69-0005ub-D0 for qemu-devel@nongnu.org; Mon, 09 Jan 2012 07:13:09 -0500 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q09CD89V027701 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 9 Jan 2012 07:13:08 -0500 Received: from cleopatra.tlv.redhat.com (cleopatra.tlv.redhat.com [10.35.255.11]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q09C5AeV030852 for ; Mon, 9 Jan 2012 07:05:10 -0500 From: Avi Kivity Date: Mon, 9 Jan 2012 14:04:53 +0200 Message-Id: <1326110694-5196-3-git-send-email-avi@redhat.com> In-Reply-To: <1326110694-5196-1-git-send-email-avi@redhat.com> References: <1326110694-5196-1-git-send-email-avi@redhat.com> Subject: [Qemu-devel] [PATCH 2/3] vhost: fix mem_sections memory corruption List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" Cc: qemu-devel@nongnu.org A memset() used to delete an entry in an array did not take into account the array element's size. Signed-off-by: Avi Kivity --- hw/vhost.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/hw/vhost.c b/hw/vhost.c index 541c716..d924fb0 100644 --- a/hw/vhost.c +++ b/hw/vhost.c @@ -456,7 +456,7 @@ static void vhost_region_del(MemoryListener *listener, == section->offset_within_address_space) { --dev->n_mem_sections; memmove(&dev->mem_sections[i], &dev->mem_sections[i+1], - dev->n_mem_sections - i); + (dev->n_mem_sections - i) * sizeof(*dev->mem_sections)); break; } } -- 1.7.7.1