Fix CVE-2017-15038: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15038 Patch copied from upstream source repository: https://git.qemu.org/?p=qemu.git;a=commitdiff;h=7bd92756303f2158a68d5166264dc30139b813b6 From 7bd92756303f2158a68d5166264dc30139b813b6 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Mon, 16 Oct 2017 14:21:59 +0200 Subject: [PATCH] 9pfs: use g_malloc0 to allocate space for xattr 9p back-end first queries the size of an extended attribute, allocates space for it via g_malloc() and then retrieves its value into allocated buffer. Race between querying attribute size and retrieving its could lead to memory bytes disclosure. Use g_malloc0() to avoid it. Reported-by: Tuomas Tynkkynen Signed-off-by: Prasad J Pandit Signed-off-by: Greg Kurz --- hw/9pfs/9p.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index 23ac7bb532..f8bbac251d 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3234,7 +3234,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type = P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid = true; if (size) { - xattr_fidp->fs.xattr.value = g_malloc(size); + xattr_fidp->fs.xattr.value = g_malloc0(size); err = v9fs_co_llistxattr(pdu, &xattr_fidp->path, xattr_fidp->fs.xattr.value, xattr_fidp->fs.xattr.len); @@ -3267,7 +3267,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque) xattr_fidp->fid_type = P9_FID_XATTR; xattr_fidp->fs.xattr.xattrwalk_fid = true; if (size) { - xattr_fidp->fs.xattr.value = g_malloc(size); + xattr_fidp->fs.xattr.value = g_malloc0(size); err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path, &name, xattr_fidp->fs.xattr.value, xattr_fidp->fs.xattr.len); -- 2.15.0 e866b551ac707bdc433a37'>etc/snippets
AgeCommit message (Expand)Author
2022-10-06snippets: Fix move....Liliana Marie Prikler
2022-10-06snippets: tempel: Reformat....Liliana Marie Prikler
2022-10-06snippets: tempel: Fix calls to mapconcat....Liliana Marie Prikler
2022-09-26etc: Add tempel snippet move....Nicolas Graves
2022-08-30etc: Update yasnippet build system list....Nicolas Graves
2022-08-30etc: Add tempel snippet for :phases....Nicolas Graves
2022-08-30etc: Add tempel snippets....Nicolas Graves
2022-05-12snippets: Add a 'remove' snippet....Maxim Cournoyer
2022-01-19etc: Match define-public only at line start....Liliana Marie Prikler
2021-06-26etc: snippets: Use ‘hg-file-name’ when origin uses ‘hg-fetch’...Xinglu Chen
2020-12-23etc: snippets: Add new build systems to package snippet....Morgan Smith
2020-12-04etc: snippets: Fix name extraction....Nicolas Goaziou
2020-12-04etc: snippets: Fix name extraction....Nicolas Goaziou
2020-11-25etc: snippets: Fix "gnu: Add ..." name when prefilling Common Lisp commits me......Pierre Neidhardt
2020-11-23etc: snippets: Prefill Common Lisp package names....Pierre Neidhardt
2020-11-23etc: snippets: Fix package name extraction....Pierre Neidhardt