Page MenuHomeFreeBSD

bhyve: fix buffer overflow in QemuFwCfg
ClosedPublic

Authored by corvink on Oct 16 2023, 9:31 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Oct 16, 1:44 AM
Unknown Object (File)
Sat, Oct 11, 7:00 PM
Unknown Object (File)
Sat, Oct 11, 7:00 PM
Unknown Object (File)
Sat, Oct 11, 7:00 PM
Unknown Object (File)
Sat, Oct 11, 7:00 PM
Unknown Object (File)
Sat, Oct 11, 10:11 AM
Unknown Object (File)
Mon, Sep 29, 8:20 PM
Unknown Object (File)
Mon, Sep 29, 5:34 PM

Details

Summary

We're accessing one element of the newly allocated and the old directory
too much.

Reported by: andy@omniosce.org
Fixes: 6f9ebb3d0fed2b0ae604dd6daf17f1fe1d8df216 ("bhyve: add helper for adding fwcfg files")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

usr.sbin/bhyve/qemu_fwcfg.c
328

Why do you add + 1 here? The reason isn't obvious to me.

usr.sbin/bhyve/qemu_fwcfg.c
328

This function adds a new fwcfg file. Therefore, we have to increase the count of fwcfg files by one. The name might be a bit misleading. It's the new_count.

This revision is now accepted and ready to land.Oct 17 2023, 1:25 PM
This revision was automatically updated to reflect the committed changes.