Commit ec5fd402 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Michael Tokarev
Browse files

pc: check for underflow in load_linux 



If (setup_size+1)*512 is small enough, kernel_size -= setup_size can allocate
a huge amount of memory.  Avoid that.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarMichael Tokarev <mjt@tls.msk.ru>
parent 16033ba5

hw/i386/pc.c

+4 −0
Original line number Diff line number Diff line
@@ -985,6 +985,10 @@ static void load_linux(PCMachineState *pcms, 
        setup_size = 4;

    }

    setup_size = (setup_size+1)*512;

    if (setup_size > kernel_size) {

        fprintf(stderr, "qemu: invalid kernel header\n");

        exit(1);

    }

    kernel_size -= setup_size;



    setup  = g_malloc(setup_size);