From d09acb9b5ef0bb4fa94d3d459919a6ebaf8804bc Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Wed, 23 Jan 2013 18:25:08 +0100 Subject: fw_cfg: Splash image loader can overrun a stack variable, fix read_splashfile() passes the address of an int variable as size_t * parameter to g_file_get_contents(), with a cast to gag the compiler. No problem on machines where sizeof(size_t) == sizeof(int). Happens to work on my x86_64 box (64 bit little endian): the least significant 32 bits of the file size end up in the right place (caller's variable file_size), and the most significant 32 bits clobber a place that gets assigned to before its next use (caller's variable file_type). I'd expect it to break on a 64 bit big-endian box. Fix up the variable types and drop the problematic cast. Signed-off-by: Markus Armbruster Reviewed-by: Laszlo Ersek Signed-off-by: Blue Swirl --- hw/fw_cfg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'hw/fw_cfg.c') diff --git a/hw/fw_cfg.c b/hw/fw_cfg.c index e4dc7c3c31..b7da5c768e 100644 --- a/hw/fw_cfg.c +++ b/hw/fw_cfg.c @@ -54,7 +54,8 @@ struct FWCfgState { #define JPG_FILE 0 #define BMP_FILE 1 -static char *read_splashfile(char *filename, int *file_sizep, int *file_typep) +static char *read_splashfile(char *filename, size_t *file_sizep, + int *file_typep) { GError *err = NULL; gboolean res; @@ -63,7 +64,7 @@ static char *read_splashfile(char *filename, int *file_sizep, int *file_typep) unsigned int filehead = 0; int bmp_bpp; - res = g_file_get_contents(filename, &content, (gsize *)file_sizep, &err); + res = g_file_get_contents(filename, &content, file_sizep, &err); if (res == FALSE) { error_report("failed to read splash file '%s'", filename); g_error_free(err); @@ -111,7 +112,7 @@ static void fw_cfg_bootsplash(FWCfgState *s) const char *boot_splash_filename = NULL; char *p; char *filename, *file_data; - int file_size; + size_t file_size; int file_type = -1; const char *temp; -- cgit v1.2.1