From patchwork Tue Apr 12 03:48:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Fix buffer overrun in sched_getaffinity From: Mike McCormack X-Patchwork-Id: 90698 Message-Id: <4DA3CB84.5080503@samsung.com> To: qemu-devel@nongnu.org Date: Tue, 12 Apr 2011 12:48:20 +0900 Zeroing of the cpu array should start from &cpus[kernel_ret] not &cpus[num_zeros_to_fill]. This fixes a crash in EFL's edje_cc running under qemu-arm. Signed-off-by: Mike McCormack Reviewed-by: Stefan Hajnoczi Acked-by: Mike Frysinger --- linux-user/syscall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index bb0999d..1cda10a 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, unsigned long zero = arg2 - ret; p = alloca(zero); memset(p, 0, zero); - if (copy_to_user(arg3 + zero, p, zero)) { + if (copy_to_user(arg3 + ret, p, zero)) { goto efault; } arg2 = ret;