Commit 637f7a6a authored by Avi Kivity's avatar Avi Kivity
Browse files

vhost: fix mem_sections memory corruption 



A memset() used to delete an entry in an array did not take into account
the array element's size.

Signed-off-by: default avatarAvi Kivity <avi@redhat.com>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent d743c382

hw/vhost.c

+1 −1
Original line number Diff line number Diff line
@@ -456,7 +456,7 @@ static void vhost_region_del(MemoryListener *listener, 
            == section->offset_within_address_space) {

            --dev->n_mem_sections;

            memmove(&dev->mem_sections[i], &dev->mem_sections[i+1],

                    dev->n_mem_sections - i);

                    (dev->n_mem_sections - i) * sizeof(*dev->mem_sections));

            break;

        }

    }