From d09acb9b5ef0bb4fa94d3d459919a6ebaf8804bc Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 23 Jan 2013 18:25:08 +0100 Subject: fw_cfg: Splash image loader can overrun a stack variable, fix read_splashfile() passes the address of an int variable as size_t * parameter to g_file_get_contents(), with a cast to gag the compiler. No problem on machines where sizeof(size_t) == sizeof(int). Happens to work on my x86_64 box (64 bit little endian): the least significant 32 bits of the file size end up in the right place (caller's variable file_size), and the most significant 32 bits clobber a place that gets assigned to before its next use (caller's variable file_type). I'd expect it to break on a 64 bit big-endian box. Fix up the variable types and drop the problematic cast. Signed-off-by: Markus Armbruster Reviewed-by: Laszlo Ersek Signed-off-by: Blue Swirl --- include/sysemu/sysemu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'include') diff --git a/include/sysemu/sysemu.h b/include/sysemu/sysemu.h index 337ce7d..1d9599e 100644 --- a/include/sysemu/sysemu.h +++ b/include/sysemu/sysemu.h @@ -122,7 +122,7 @@ extern int semihosting_enabled; extern int old_param; extern int boot_menu; extern uint8_t *boot_splash_filedata; -extern int boot_splash_filedata_size; +extern size_t boot_splash_filedata_size; extern uint8_t qemu_extra_params_fw[2]; extern QEMUClock *rtc_clock; -- cgit v1.1