The branch main has been updated by corvink: URL: https://cgit.FreeBSD.org/src/commit/?id=4a3810075fd307301d8b3f087efe7a61bc37199b
commit 4a3810075fd307301d8b3f087efe7a61bc37199b Author: Corvin Köhne <[email protected]> AuthorDate: 2023-10-16 08:52:21 +0000 Commit: Corvin Köhne <[email protected]> CommitDate: 2023-10-17 13:57:28 +0000 bhyve: fix buffer overflow in QemuFwCfg We're accessing one element of the newly allocated and the old directory too much. Reported by: [email protected] Reviewed by: markj Fixes: 6f9ebb3d0fed2b0ae604dd6daf17f1fe1d8df216 ("bhyve: add helper for adding fwcfg files") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D42220 --- usr.sbin/bhyve/qemu_fwcfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/usr.sbin/bhyve/qemu_fwcfg.c b/usr.sbin/bhyve/qemu_fwcfg.c index 830cee730dbd..5b33dfab037d 100644 --- a/usr.sbin/bhyve/qemu_fwcfg.c +++ b/usr.sbin/bhyve/qemu_fwcfg.c @@ -365,7 +365,7 @@ qemu_fwcfg_add_file(const char *name, const uint32_t size, void *const data) /* copy files above file_index to directory */ memcpy(&new_directory->files[file_index + 1], &fwcfg_sc.directory->files[file_index], - (count - file_index) * sizeof(struct qemu_fwcfg_file)); + (count - file_index - 1) * sizeof(struct qemu_fwcfg_file)); /* free old directory */ free(fwcfg_sc.directory);
