[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Stable-7.2.9 09/20] load_elf: fix iterator's type for elf file processi
From: |
Michael Tokarev |
Subject: |
[Stable-7.2.9 09/20] load_elf: fix iterator's type for elf file processing |
Date: |
Tue, 23 Jan 2024 11:48:19 +0300 |
From: Anastasia Belova <abelova@astralinux.ru>
j is used while loading an ELF file to byteswap segments'
data. If data is larger than 2GB an overflow may happen.
So j should be elf_word.
This commit fixes a minor bug: it's unlikely anybody is trying to
load ELF files with 2GB+ segments for wrong-endianness targets,
but if they did, it wouldn't work correctly.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Cc: qemu-stable@nongnu.org
Fixes: 7ef295ea5b ("loader: Add data swap option to load-elf")
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 410c2a4d75f52f6a2fe978eda5a9b6f854afe5ea)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
index fbe0b1e956..78f45c8115 100644
--- a/include/hw/elf_ops.h
+++ b/include/hw/elf_ops.h
@@ -499,7 +499,7 @@ static ssize_t glue(load_elf, SZ)(const char *name, int fd,
}
if (data_swab) {
- int j;
+ elf_word j;
for (j = 0; j < file_size; j += (1 << data_swab)) {
uint8_t *dp = data + j;
switch (data_swab) {
--
2.39.2
- [Stable-7.2.9 00/20] Patch Round-up for stable 7.2.9, freeze on 2024-01-27, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 09/20] load_elf: fix iterator's type for elf file processing,
Michael Tokarev <=
- [Stable-7.2.9 11/20] target/i386: Do not re-compute new pc with CF_PCREL, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 10/20] target/i386: Fix 32-bit wrapping of pc/eip computation, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 12/20] target/i386: fix incorrect EIP in PC-relative translation blocks, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 13/20] target/i386: pcrel: store low bits of physical address in data[0], Michael Tokarev, 2024/01/23
- [Stable-7.2.9 14/20] hw/pflash: refactor pflash_data_write(), Michael Tokarev, 2024/01/23
- [Stable-7.2.9 15/20] hw/pflash: use ldn_{be,le}_p and stn_{be,le}_p, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 16/20] hw/pflash: implement update buffer for block writes, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 17/20] hw/scsi/esp-pci: use correct address register for PCI DMA transfers, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 18/20] hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sources, Michael Tokarev, 2024/01/23
- [Stable-7.2.9 19/20] hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion interrupt, Michael Tokarev, 2024/01/23