From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Feb 2023 14:10:56 +0000 (+0100)
Subject: target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()
X-Git-Tag: v7.2.2~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a3c6cd83e32d7729889b3eab2a9b6b4650c56ea9;p=thirdparty%2Fqemu.git

target/s390x/arch_dump: Fix memory corruption in s390x_write_elf64_notes()

"note_size" can be smaller than sizeof(note), so unconditionally calling
memset(notep, 0, sizeof(note)) could cause a memory corruption here in
case notep has been allocated dynamically, thus let's use note_size as
length argument for memset() instead.

Reported-by: Sebastian Mitterle <smitterl@redhat.com>
Fixes: 113d8f4e95 ("s390x: pv: Add dump support")
Message-Id: <20230214141056.680969-1-thuth@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit eb60026120081430d554c9cabaa36c4ac271fce0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---

diff --git a/target/s390x/arch_dump.c b/target/s390x/arch_dump.c
index a2329141e8a..a7c44ba49d3 100644
--- a/target/s390x/arch_dump.c
+++ b/target/s390x/arch_dump.c
@@ -248,7 +248,7 @@ static int s390x_write_elf64_notes(const char *note_name,
             notep = g_malloc(note_size);
         }
 
-        memset(notep, 0, sizeof(note));
+        memset(notep, 0, note_size);
 
         /* Setup note header data */
         notep->hdr.n_descsz = cpu_to_be32(content_size);