diff options
| author | Xi Wang <xi@mit.edu> | 2013-02-25 12:44:25 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-02-25 12:44:25 +0100 |
| commit | c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874 (patch) | |
| tree | ab8157ace3d8704a17c1e75371e8e79b49d16e57 | |
| parent | 4291b626cee8aff5d976c5829a79fceca9cff420 (diff) | |
| download | xen-c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874.tar.gz xen-c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874.tar.bz2 xen-c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874.zip | |
x86: fix null pointer dereference in intel_get_extended_msrs()
`memset(&mc_ext, 0, ...)' leads to a buffer overflow and a subsequent
null pointer dereference. Replace `&mc_ext' with `mc_ext'.
Signed-off-by: Xi Wang <xi@mit.edu>
| -rw-r--r-- | xen/arch/x86/cpu/mcheck/mce_intel.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c b/xen/arch/x86/cpu/mcheck/mce_intel.c index d80f692496..45dbff88a4 100644 --- a/xen/arch/x86/cpu/mcheck/mce_intel.c +++ b/xen/arch/x86/cpu/mcheck/mce_intel.c @@ -200,7 +200,7 @@ intel_get_extended_msrs(struct mcinfo_global *mig, struct mc_info *mi) } /* this function will called when CAP(9).MCG_EXT_P = 1 */ - memset(&mc_ext, 0, sizeof(struct mcinfo_extended)); + memset(mc_ext, 0, sizeof(*mc_ext)); mc_ext->common.type = MC_TYPE_EXTENDED; mc_ext->common.size = sizeof(struct mcinfo_extended); |