diff options
| author | Xi Wang <xi@mit.edu> | 2013-03-08 13:56:54 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-03-08 13:56:54 +0100 |
| commit | bbbeb7939e141c6cb29fd6f26beca68ffdfe9d46 (patch) | |
| tree | 3a5b087303db00c7cf7db056b2dd134ab9a86f90 | |
| parent | 7542d222893203037dc2ba431dfb5f723d791891 (diff) | |
| download | xen-bbbeb7939e141c6cb29fd6f26beca68ffdfe9d46.tar.gz xen-bbbeb7939e141c6cb29fd6f26beca68ffdfe9d46.tar.bz2 xen-bbbeb7939e141c6cb29fd6f26beca68ffdfe9d46.zip | |
x86: fix null pointer dereference in intel_get_extended_msrs()
`memset(&mc_ext, 0, ...)' leads to a buffer overflow and a subsequent
null pointer dereference. Replace `&mc_ext' with `mc_ext'.
Signed-off-by: Xi Wang <xi@mit.edu>
master changeset: c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874
master date: 2013-02-25 12:44:25 +0100
| -rw-r--r-- | xen/arch/x86/cpu/mcheck/mce_intel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index 603acf7a82..b321a3f1bd 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -512,7 +512,7 @@ intel_get_extended_msrs(struct mcinfo_global *mig, struct mc_info *mi) } /* this function will called when CAP(9).MCG_EXT_P = 1 */ - memset(&mc_ext, 0, sizeof(struct mcinfo_extended)); + memset(mc_ext, 0, sizeof(*mc_ext)); mc_ext->common.type = MC_TYPE_EXTENDED; mc_ext->common.size = sizeof(struct mcinfo_extended); |