proxmox-mirrors/qemu
1
0
Fork 0
mirror of https://git.proxmox.com/git/qemu synced 2025-06-15 12:44:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

arm-semi: don't leak 1KB user string lock buffer upon TARGET_SYS_OPEN

Browse Source 
Always call unlock_user before returning.

Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
This commit is contained in:
Jim Meyering 2012-08-22 13:55:55 +02:00 committed by Anthony Liguori
parent a7e47d4bfc
commit 396bef4b38
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
target-arm/arm-semi.c
View File

@ -194,18 +194,19 @@ uint32_t do_arm_semihosting(CPUARMState *env)
if (!(s = lock_user_string(ARG(0)))) if (!(s = lock_user_string(ARG(0))))
/* FIXME - should this error code be -TARGET_EFAULT ? */ /* FIXME - should this error code be -TARGET_EFAULT ? */
return (uint32_t)-1; return (uint32_t)-1;
if (ARG(1) >= 12) if (ARG(1) >= 12) {
unlock_user(s, ARG(0), 0);
return (uint32_t)-1; return (uint32_t)-1;
}
if (strcmp(s, ":tt") == 0) { if (strcmp(s, ":tt") == 0) {
if (ARG(1) < 4) int result_fileno = ARG(1) < 4 ? STDIN_FILENO : STDOUT_FILENO;
return STDIN_FILENO; unlock_user(s, ARG(0), 0);
else return result_fileno;
return STDOUT_FILENO;
} }
if (use_gdb_syscalls()) { if (use_gdb_syscalls()) {
gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0), gdb_do_syscall(arm_semi_cb, "open,%s,%x,1a4", ARG(0),
(int)ARG(2)+1, gdb_open_modeflags[ARG(1)]); (int)ARG(2)+1, gdb_open_modeflags[ARG(1)]);
return env->regs[0]; ret = env->regs[0];
} else { } else {
ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644)); ret = set_swi_errno(ts, open(s, open_modeflags[ARG(1)], 0644));
} }