diff options
| author | Christian A. Ehrhardt | 2022-10-24 17:42:33 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin | 2022-11-07 20:08:17 +0100 |
| commit | defb70980f6bed36100b74e84220f1764c0dd544 (patch) | |
| tree | bf7c18cff94fcb596f2d13e80cd6409bb74466bd /include | |
| parent | tests: acpi: update expected blobs (diff) | |
| download | qemu-defb70980f6bed36100b74e84220f1764c0dd544.tar.gz qemu-defb70980f6bed36100b74e84220f1764c0dd544.tar.xz qemu-defb70980f6bed36100b74e84220f1764c0dd544.zip | |
hw/acpi/erst.c: Fix memory handling issues
- Fix memset argument order: The second argument is
the value, the length goes last.
- Fix an integer overflow reported by Alexander Bulekov.
Both issues allow the guest to overrun the host buffer
allocated for the ERST memory device.
Cc: Eric DeVolder <eric.devolder@oracle.com
Cc: Alexander Bulekov <alxndr@bu.edu>
Cc: qemu-stable@nongnu.org
Fixes: f7e26ffa590 ("ACPI ERST: support for ACPI ERST feature")
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Message-Id: <20221024154233.1043347-1-lk@c--e.de>
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/1268
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Eric DeVolder <eric.devolder@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions