From: Anastasia Belova Date: Mon, 15 Jan 2024 09:22:16 +0000 (+0300) Subject: load_elf: fix iterator's type for elf file processing X-Git-Tag: v8.1.5~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=357b5990284107dfa36d234e3dcbf77e0e1367e0;p=thirdparty%2Fqemu.git load_elf: fix iterator's type for elf file processing j is used while loading an ELF file to byteswap segments' data. If data is larger than 2GB an overflow may happen. So j should be elf_word. This commit fixes a minor bug: it's unlikely anybody is trying to load ELF files with 2GB+ segments for wrong-endianness targets, but if they did, it wouldn't work correctly. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: qemu-stable@nongnu.org Fixes: 7ef295ea5b ("loader: Add data swap option to load-elf") Signed-off-by: Anastasia Belova Reviewed-by: Peter Maydell Signed-off-by: Peter Maydell (cherry picked from commit 410c2a4d75f52f6a2fe978eda5a9b6f854afe5ea) Signed-off-by: Michael Tokarev --- diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h index dffb0e73d2a..52776e8010d 100644 --- a/include/hw/elf_ops.h +++ b/include/hw/elf_ops.h @@ -499,7 +499,7 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd, } if (data_swab) { - int j; + elf_word j; for (j = 0; j < file_size; j += (1 << data_swab)) { uint8_t *dp = data + j; switch (data_swab) {