From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51542) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zc3LT-0003LP-63 for qemu-devel@nongnu.org; Tue, 15 Sep 2015 23:25:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Zc3LQ-0007dL-2N for qemu-devel@nongnu.org; Tue, 15 Sep 2015 23:25:19 -0400 Date: Wed, 16 Sep 2015 12:24:47 +1000 From: David Gibson Message-ID: <20150916022447.GW2547@voom.fritz.box> References: <1442345660-15603-1-git-send-email-thuth@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="Cf1qy2gtPj5yoBMh" Content-Disposition: inline In-Reply-To: <1442345660-15603-1-git-send-email-thuth@redhat.com> Subject: Re: [Qemu-devel] [PATCH] ppc/spapr: Fix buffer overflow in spapr_populate_drconf_memory() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Thomas Huth Cc: bharata@linux.vnet.ibm.com, qemu-ppc@nongnu.org, qemu-devel@nongnu.org, Alexander Graf --Cf1qy2gtPj5yoBMh Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Sep 15, 2015 at 09:34:20PM +0200, Thomas Huth wrote: > The buffer that is allocated in spapr_populate_drconf_memory() > is used for setting both, the "ibm,dynamic-memory" and the > "ibm,associativity-lookup-arrays" property. However, only the > size of the first one is taken into account when allocating the > memory. So if the length of the second property is larger than > the length of the first one, we run into a buffer overflow here! > Fix it by taking the length of the second property into account, > too. >=20 > Fixes: "spapr: Support ibm,dynamic-reconfiguration-memory" patch > Signed-off-by: Thomas Huth Merged to spapr-next, thanks. --=20 David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson --Cf1qy2gtPj5yoBMh Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJV+NLvAAoJEGw4ysog2bOSyvMP/iWwjP13tf16mhBoYUEkbzkY rw/jOPWiVWPs8qAMVDIE6S+2ZpDwd8oGx5mVF+TzO8FYYuPFZ6rS0OkzlFyLo3in 39ByQtgZvwuqLQoZWnhuXojjNX8zlKaupPC7U6MlVwLabYajQ1krNprgyIm3spPJ Y0Bx2+0ocyuT2se/cSgH1OQu5xnPzGx1Jitw/5lnmj5/j/UNGbH++NVSuP7XWI+P BrTC9BZ10m2ve1PxMNjJUWaR95KuBsLrbzYge2YJCVJAJmwyHB3Spjc8VwBhQhfj Xtpq5A96ajYMgurzEx+hxm6bCFcjuRyBiQvGBdaNGEEeC2XgYNAguml44ORI4zcH bdGagUN5jWck8Pw8y+defuGP1F0WAb95oQoiX6UDnhuXdV24y4XZKWmMPiXEkhzt 9rum/f1HqQFcWttY4KyRtEY7KrsZjrXi/uWx8P/4TAcep2ZU50duCfz0PlSb8Quf trsSSvMMfNKOF4yXOWJ+k5UtLE1JJO6Cl5N5W6a5g+tEnYMbWN7r1rGbRhvpCIaD s+YGo0S0yUUmTXWwdlmD/aN+F1dpaqOV5dvGqBNw1x7xjsc8xvZkSAtalAOYA7pX hQKqzL/h7DqTnDFTrtLit9ZyN2MjXFPKf5UJWsCvDclPCObPQHpozwFrBp5wkM8z dPyLO9bAOlqiskmTdkcm =uHKp -----END PGP SIGNATURE----- --Cf1qy2gtPj5yoBMh--