48 lines
1.6 KiB
Diff
48 lines
1.6 KiB
Diff
|
From d9f1221c0f4ff778e5e11d71519dfe1fe2f37e28 Mon Sep 17 00:00:00 2001
|
||
|
|
From: tangbinzy <tangbin_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Thu, 21 Mar 2024 03:16:54 +0000
|
||
|
|
Subject: [PATCH] ipmi:smbus: Add a check around a memcpy mainline inclusion
|
||
|
|
commit 3fde641e7286f9b968bdb3b4b922c6465f2a9abc category: bugfix
|
||
|
|
|
||
|
|
---------------------------------------------------------------
|
||
|
|
|
||
|
|
In one case:
|
||
|
|
|
||
|
|
memcpy(sid->inmsg + sid->inlen, buf, len);
|
||
|
|
|
||
|
|
if len == 0 then sid->inmsg + sig->inlen can point to one past the inmsg
|
||
|
|
array if the array is full. We have to allow len == 0 due to some
|
||
|
|
vagueness in the spec, but we don't have to call memcpy.
|
||
|
|
|
||
|
|
Found by Coverity. This is not a problem in practice, but the results
|
||
|
|
are technically (maybe) undefined. So make Coverity happy.
|
||
|
|
|
||
|
|
Reported-by: Peter Maydell <peter.maydell@linaro.org>
|
||
|
|
Signed-off-by: Corey Minyard <cminyard@mvista.com>
|
||
|
|
Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|
|
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
||
|
|
|
||
|
|
Signed-off-by: tangbinzy <tangbin_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/ipmi/smbus_ipmi.c | 4 +++-
|
||
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/hw/ipmi/smbus_ipmi.c b/hw/ipmi/smbus_ipmi.c
|
||
|
|
index 1fdf0a66b6..1591211a86 100644
|
||
|
|
--- a/hw/ipmi/smbus_ipmi.c
|
||
|
|
+++ b/hw/ipmi/smbus_ipmi.c
|
||
|
|
@@ -280,7 +280,9 @@ static int ipmi_write_data(SMBusDevice *dev, uint8_t *buf, uint8_t len)
|
||
|
|
*/
|
||
|
|
send = true;
|
||
|
|
}
|
||
|
|
- memcpy(sid->inmsg + sid->inlen, buf, len);
|
||
|
|
+ if (len > 0) {
|
||
|
|
+ memcpy(sid->inmsg + sid->inlen, buf, len);
|
||
|
|
+ }
|
||
|
|
sid->inlen += len;
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|