From a3c6cd83e32d7729889b3eab2a9b6b4650c56ea9 Mon Sep 17 00:00:00 2001 From: Thomas Huth Date: Tue, 14 Feb 2023 15:10:56 +0100 Subject: [PATCH] target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "note_size" can be smaller than sizeof(note), so unconditionally calling memset(notep, 0, sizeof(note)) could cause a memory corruption here in case notep has been allocated dynamically, thus let's use note_size as length argument for memset() instead. Reported-by: Sebastian Mitterle Fixes: 113d8f4e95 ("s390x: pv: Add dump support") Message-Id: <20230214141056.680969-1-thuth@redhat.com> Reviewed-by: Janosch Frank Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Thomas Huth (cherry picked from commit eb60026120081430d554c9cabaa36c4ac271fce0) Signed-off-by: Michael Tokarev --- target/s390x/arch_dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c index a2329141e8..a7c44ba49d 100644 --- a/target/s390x/arch_dump.c +++ b/target/s390x/arch_dump.c @@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name, notep = g_malloc(note_size); } - memset(notep, 0, sizeof(note)); + memset(notep, 0, note_size); /* Setup note header data */ notep->hdr.n_descsz = cpu_to_be32(content_size);