[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 02/96] bios linker: validate pointer within table
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 02/96] bios linker: validate pointer within table |
Date: |
Wed, 18 Feb 2015 22:44:09 +0100 |
buios linker assumes pointer parameter it gets
is within table, validate this.
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/acpi/bios-linker-loader.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/acpi/bios-linker-loader.c b/hw/acpi/bios-linker-loader.c
index 5cc4d90..d9382f8 100644
--- a/hw/acpi/bios-linker-loader.c
+++ b/hw/acpi/bios-linker-loader.c
@@ -141,6 +141,7 @@ void bios_linker_loader_add_pointer(GArray *linker,
uint8_t pointer_size)
{
BiosLinkerLoaderEntry entry;
+ size_t offset = (gchar *)pointer - table->data;
memset(&entry, 0, sizeof entry);
strncpy(entry.pointer.dest_file, dest_file,
@@ -148,7 +149,8 @@ void bios_linker_loader_add_pointer(GArray *linker,
strncpy(entry.pointer.src_file, src_file,
sizeof entry.pointer.src_file - 1);
entry.command = cpu_to_le32(BIOS_LINKER_LOADER_COMMAND_ADD_POINTER);
- entry.pointer.offset = cpu_to_le32((gchar *)pointer - table->data);
+ assert(table->len >= offset + pointer_size);
+ entry.pointer.offset = cpu_to_le32(offset);
entry.pointer.size = pointer_size;
assert(pointer_size == 1 || pointer_size == 2 ||
pointer_size == 4 || pointer_size == 8);
--
MST
- [Qemu-devel] [PULL 00/96] pci, pc, virtio fixes and cleanups, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 02/96] bios linker: validate pointer within table,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 01/96] acpi-build: fix memory leak with bridge hp off, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 03/96] acpi: move generic aml building helpers into dedictated file, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 04/96] acpi: add build_append_namestring() helper, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 05/96] acpi: drop min-bytes in build_package(), Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 06/96] pci: Convert core to realize, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 07/96] pci: Permit incremental conversion of device models to realize, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 08/96] pci: Trivial device model conversions to realize, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 09/96] pcnet: pcnet_common_init() always returns 0, change to void, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 10/96] pcnet: Convert to realize, Michael S. Tsirkin, 2015/02/18
- [Qemu-devel] [PULL 11/96] serial-pci: Convert to realize, Michael S. Tsirkin, 2015/02/18