Commit d6b6abc5 authored by Marcel Apfelbaum's avatar Marcel Apfelbaum Committed by Eduardo Habkost
Browse files

fw_cfg: fix memory corruption when all fw_cfg slots are used 



When all the fw_cfg slots are used, a write is made outside the
bounds of the fw_cfg files array as part of the sort algorithm.

Fix it by avoiding an unnecessary array element move.
Fix also an assert while at it.

Signed-off-by: default avatarMarcel Apfelbaum <marcel@redhat.com>
Message-Id: <20180108215007.46471-1-marcel@redhat.com>
Reviewed-by: default avatarLaszlo Ersek <lersek@redhat.com>
Signed-off-by: default avatarEduardo Habkost <ehabkost@redhat.com>
parent d342eb76

hw/nvram/fw_cfg.c

+4 −2
Original line number Diff line number Diff line
@@ -784,7 +784,7 @@ void fw_cfg_add_file_callback(FWCfgState *s, const char *filename, 
     * index and "i - 1" is the one being copied from, thus the

     * unusual start and end in the for statement.

     */

    for (i = count + 1; i > index; i--) {

    for (i = count; i > index; i--) {

        s->files->f[i] = s->files->f[i - 1];

        s->files->f[i].select = cpu_to_be16(FW_CFG_FILE_FIRST + i);

        s->entries[0][FW_CFG_FILE_FIRST + i] =
@@ -833,7 +833,6 @@ void *fw_cfg_modify_file(FWCfgState *s, const char *filename, 
    assert(s->files);



    index = be32_to_cpu(s->files->count);

    assert(index < fw_cfg_file_slots(s));



    for (i = 0; i < index; i++) {

        if (strcmp(filename, s->files->f[i].name) == 0) {
@@ -843,6 +842,9 @@ void *fw_cfg_modify_file(FWCfgState *s, const char *filename, 
            return ptr;

        }

    }



    assert(index < fw_cfg_file_slots(s));



    /* add new one */

    fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);

    return NULL;