Date: Tue, 17 Oct 2023 13:58:07 GMT From: Corvin =?utf-8?Q?K=C3=B6hne?= <corvink@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 4a3810075fd3 - main - bhyve: fix buffer overflow in QemuFwCfg Message-ID: <202310171358.39HDw7kp029960@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by corvink: URL: https://cgit.FreeBSD.org/src/commit/?id=4a3810075fd307301d8b3f087efe7a61bc37199b commit 4a3810075fd307301d8b3f087efe7a61bc37199b Author: Corvin Köhne <corvink@FreeBSD.org> AuthorDate: 2023-10-16 08:52:21 +0000 Commit: Corvin Köhne <corvink@FreeBSD.org> CommitDate: 2023-10-17 13:57:28 +0000 bhyve: fix buffer overflow in QemuFwCfg We're accessing one element of the newly allocated and the old directory too much. Reported by: andy@omniosce.org Reviewed by: markj Fixes: 6f9ebb3d0fed2b0ae604dd6daf17f1fe1d8df216 ("bhyve: add helper for adding fwcfg files") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D42220 --- usr.sbin/bhyve/qemu_fwcfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr.sbin/bhyve/qemu_fwcfg.c b/usr.sbin/bhyve/qemu_fwcfg.c index 830cee730dbd..5b33dfab037d 100644 --- a/usr.sbin/bhyve/qemu_fwcfg.c +++ b/usr.sbin/bhyve/qemu_fwcfg.c @@ -365,7 +365,7 @@ qemu_fwcfg_add_file(const char *name, const uint32_t size, void *const data) /* copy files above file_index to directory */ memcpy(&new_directory->files[file_index + 1], &fwcfg_sc.directory->files[file_index], - (count - file_index) * sizeof(struct qemu_fwcfg_file)); + (count - file_index - 1) * sizeof(struct qemu_fwcfg_file)); /* free old directory */ free(fwcfg_sc.directory);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202310171358.39HDw7kp029960>