diff options
author | Philippe Mathieu-Daudé <philmd@redhat.com> | 2021-09-03 12:01:20 +0200 |
---|---|---|
committer | Philippe Mathieu-Daudé <philmd@linaro.org> | 2024-05-08 19:42:45 +0200 |
commit | 0572f01117c897bef5ece0b367bc6700d4fbd161 (patch) | |
tree | 029efa62b90af03ef8af23f978a5413dbcc78537 | |
parent | 40fed8c1d3a2bcef81c8de3f55d7e1abe1397347 (diff) | |
download | qemu-0572f01117c897bef5ece0b367bc6700d4fbd161.zip qemu-0572f01117c897bef5ece0b367bc6700d4fbd161.tar.gz qemu-0572f01117c897bef5ece0b367bc6700d4fbd161.tar.bz2 |
hw/hppa/machine: Replace g_memdup() by g_memdup2()
Per https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538
The old API took the size of the memory to duplicate as a guint,
whereas most memory functions take memory sizes as a gsize. This
made it easy to accidentally pass a gsize to g_memdup(). For large
values, that would lead to a silent truncation of the size from 64
to 32 bits, and result in a heap area being returned which is
significantly smaller than what the caller expects. This can likely
be exploited in various modules to cause a heap buffer overflow.
Replace g_memdup() by the safer g_memdup2() wrapper.
Trivially safe because the argument was directly from sizeof.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210903174510.751630-12-philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-rw-r--r-- | hw/hppa/machine.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c index 37ee638..5d0a873 100644 --- a/hw/hppa/machine.c +++ b/hw/hppa/machine.c @@ -207,37 +207,37 @@ static FWCfgState *create_fw_cfg(MachineState *ms, PCIBus *pci_bus, val = cpu_to_le64(MIN_SEABIOS_HPPA_VERSION); fw_cfg_add_file(fw_cfg, "/etc/firmware-min-version", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); val = cpu_to_le64(HPPA_TLB_ENTRIES - btlb_entries); fw_cfg_add_file(fw_cfg, "/etc/cpu/tlb_entries", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); val = cpu_to_le64(btlb_entries); fw_cfg_add_file(fw_cfg, "/etc/cpu/btlb_entries", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); len = strlen(mc->name) + 1; fw_cfg_add_file(fw_cfg, "/etc/hppa/machine", - g_memdup(mc->name, len), len); + g_memdup2(mc->name, len), len); val = cpu_to_le64(soft_power_reg); fw_cfg_add_file(fw_cfg, "/etc/hppa/power-button-addr", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); val = cpu_to_le64(CPU_HPA + 16); fw_cfg_add_file(fw_cfg, "/etc/hppa/rtc-addr", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); val = cpu_to_le64(CPU_HPA + 24); fw_cfg_add_file(fw_cfg, "/etc/hppa/DebugOutputPort", - g_memdup(&val, sizeof(val)), sizeof(val)); + g_memdup2(&val, sizeof(val)), sizeof(val)); fw_cfg_add_i16(fw_cfg, FW_CFG_BOOT_DEVICE, ms->boot_config.order[0]); qemu_register_boot_set(fw_cfg_boot_set, fw_cfg); fw_cfg_add_file(fw_cfg, "/etc/qemu-version", - g_memdup(qemu_version, sizeof(qemu_version)), + g_memdup2(qemu_version, sizeof(qemu_version)), sizeof(qemu_version)); fw_cfg_add_extra_pci_roots(pci_bus, fw_cfg); |