| Message ID | 20170724182751.18261-15-f4bug@amsat.org |
|---|---|
| State | New |
| Headers | show |
On Mon, 24 Jul 2017 15:27:30 -0300 Philippe Mathieu-Daudé <f4bug@amsat.org> wrote: > Since sizeof(struct vfio_irq_info) < sizeof(struct vfio_irq_set) a heap overflow > never occured. Still, let's use the correct size. > > hw/vfio/ccw.c:170:16: warning: Cast a region whose size is not a multiple of the destination type size > irq_info = g_malloc0(sizeof(*irq_set)); > ^~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Reported-by: Clang Static Analyzer > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> > --- > hw/vfio/ccw.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c > index 12d0262336..8d97b53e77 100644 > --- a/hw/vfio/ccw.c > +++ b/hw/vfio/ccw.c > @@ -168,7 +168,7 @@ static void vfio_ccw_register_io_notifier(VFIOCCWDevice *vcdev, Error **errp) > return; > } > > - argsz = sizeof(*irq_set); > + argsz = sizeof(*irq_info); > irq_info = g_malloc0(argsz); > irq_info->index = VFIO_CCW_IO_IRQ_INDEX; > irq_info->argsz = argsz; Thanks for the patch, but I already have "vfio/ccw: allocate irq info with the right size" queued in my s390-next branch (for which I plan to send a pull req today).
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c index 12d0262336..8d97b53e77 100644 --- a/hw/vfio/ccw.c +++ b/hw/vfio/ccw.c @@ -168,7 +168,7 @@ static void vfio_ccw_register_io_notifier(VFIOCCWDevice *vcdev, Error **errp) return; } - argsz = sizeof(*irq_set); + argsz = sizeof(*irq_info); irq_info = g_malloc0(argsz); irq_info->index = VFIO_CCW_IO_IRQ_INDEX; irq_info->argsz = argsz;
Since sizeof(struct vfio_irq_info) < sizeof(struct vfio_irq_set) a heap overflow never occured. Still, let's use the correct size. hw/vfio/ccw.c:170:16: warning: Cast a region whose size is not a multiple of the destination type size irq_info = g_malloc0(sizeof(*irq_set)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Clang Static Analyzer Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- hw/vfio/ccw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)