diff options
| author | Xi Wang <xi@mit.edu> | 2013-03-07 17:59:21 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-03-07 17:59:21 +0100 |
| commit | bf739695ce8b18718e4bc80946f360488122e349 (patch) | |
| tree | 8bcacd586f23ea87d4535e259f8d0e06b9e6f563 | |
| parent | 1ae14344658bb3eaad1618d9ad29a57cedbd74ea (diff) | |
| download | xen-bf739695ce8b18718e4bc80946f360488122e349.tar.gz xen-bf739695ce8b18718e4bc80946f360488122e349.tar.bz2 xen-bf739695ce8b18718e4bc80946f360488122e349.zip | |
x86: fix null pointer dereference in intel_get_extended_msrs()
`memset(&mc_ext, 0, ...)' leads to a buffer overflow and a subsequent
null pointer dereference. Replace `&mc_ext' with `mc_ext'.
Signed-off-by: Xi Wang <xi@mit.edu>
master changeset: c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874
master date: 2013-02-25 12:44:25 +0100
| -rw-r--r-- | xen/arch/x86/cpu/mcheck/mce_intel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index 2d6c2f5307..a5f0130be7 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -534,7 +534,7 @@ intel_get_extended_msrs(struct mcinfo_global *mig, struct mc_info *mi) } /* this function will called when CAP(9).MCG_EXT_P = 1 */ - memset(&mc_ext, 0, sizeof(struct mcinfo_extended)); + memset(mc_ext, 0, sizeof(*mc_ext)); mc_ext->common.type = MC_TYPE_EXTENDED; mc_ext->common.size = sizeof(struct mcinfo_extended); |