diff mbox

[2/3] Fix buffer overrun in sched_getaffinity

Message ID 1304327950-21422-3-git-send-email-riku.voipio@iki.fi
State New
Headers show

Commit Message

Riku Voipio May 2, 2011, 9:19 a.m. UTC 
From: Mike McCormack <mj.mccormack@samsung.com>

Zeroing of the cpu array should start from &cpus[kernel_ret]
not &cpus[num_zeros_to_fill].

This fixes a crash in EFL's edje_cc running under qemu-arm.

Signed-off-by: Mike McCormack <mj.mccormack@samsung.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Riku Voipio <riku.voipio@iki.fi>
---
 linux-user/syscall.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
diff mbox

Patch

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e969d1b..5b7b8e2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6505,7 +6505,7 @@  abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
                     unsigned long zero = arg2 - ret;
                     p = alloca(zero);
                     memset(p, 0, zero);
-                    if (copy_to_user(arg3 + zero, p, zero)) {
+                    if (copy_to_user(arg3 + ret, p, zero)) {
                         goto efault;
                     }
                     arg2 = ret;