| commit | cc941111a5bc5f498185fa3824c3b6579c7d45ad | |
| author | Fabiano Rosas <farosas@linux.ibm.com> | |
| Wed, 13 Feb 2019 17:29:26 +0000 (13 15:29 -0200) | ||
| committer | David Gibson <david@gibson.dropbear.id.au> | |
| Sun, 17 Feb 2019 10:54:02 +0000 (17 21:54 +1100) | ||
| tree | 3d12f6a598c5bcb51a88ceeff4119590a615ee11 | treesnapshot (tar.gz zip) |
| parent | 316aed64827ee51267adcf187e867747f29b9a6e | commitdiff |
spapr: fix out of bounds write in spapr_populate_drmem_v2
buf_len is uint8_t which is not large enough to hold the result of:
nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);
for a nr_entries greater than 10.
This causes the allocated buffer 'int_buf' to be smaller than expected
and we eventually overwrite some of glibc's control structures (see
"chunk" in https://sourceware.org/glibc/wiki/MallocInternals)
The following error is seen while trying to free int_buf:
"free(): invalid next size (fast)"
Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property"
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
buf_len is uint8_t which is not large enough to hold the result of:
nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);
for a nr_entries greater than 10.
This causes the allocated buffer 'int_buf' to be smaller than expected
and we eventually overwrite some of glibc's control structures (see
"chunk" in https://sourceware.org/glibc/wiki/MallocInternals)
The following error is seen while trying to free int_buf:
"free(): invalid next size (fast)"
Fixes: a324d6f166 "spapr: Support ibm,dynamic-memory-v2 property"
Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
Message-Id: <20190213172926.21740-1-farosas@linux.ibm.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
| hw/ppc/spapr.c | diffblobblamehistory |