diff options
| author | Corvin Köhne <corvink@FreeBSD.org> | 2023-10-16 08:52:21 +0000 |
|---|---|---|
| committer | Corvin Köhne <corvink@FreeBSD.org> | 2023-10-17 13:57:28 +0000 |
| commit | 4a3810075fd307301d8b3f087efe7a61bc37199b (patch) | |
| tree | 685c98997b06cc939e14c66ef7355c86886c780d | |
| parent | d8735eb7acc0613fd19f74a49d3bdcb7ed0e9b0e (diff) | |
| download | src-4a3810075fd307301d8b3f087efe7a61bc37199b.tar.gz src-4a3810075fd307301d8b3f087efe7a61bc37199b.zip | |
bhyve: fix buffer overflow in QemuFwCfg
We're accessing one element of the newly allocated and the old directory
too much.
Reported by: andy@omniosce.org
Reviewed by: markj
Fixes: 6f9ebb3d0fed2b0ae604dd6daf17f1fe1d8df216 ("bhyve: add helper for adding fwcfg files")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D42220
| -rw-r--r-- | usr.sbin/bhyve/qemu_fwcfg.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/bhyve/qemu_fwcfg.c b/usr.sbin/bhyve/qemu_fwcfg.c index 830cee730dbd..5b33dfab037d 100644 --- a/usr.sbin/bhyve/qemu_fwcfg.c +++ b/usr.sbin/bhyve/qemu_fwcfg.c @@ -365,7 +365,7 @@ qemu_fwcfg_add_file(const char *name, const uint32_t size, void *const data) /* copy files above file_index to directory */ memcpy(&new_directory->files[file_index + 1], &fwcfg_sc.directory->files[file_index], - (count - file_index) * sizeof(struct qemu_fwcfg_file)); + (count - file_index - 1) * sizeof(struct qemu_fwcfg_file)); /* free old directory */ free(fwcfg_sc.directory); |