Re: [Qemu-devel] [PATCH] virtio-gpu: fix information leak in capset get dispatch

2016-12-13 Thread Li Qiang
Ping! 2016-11-01 20:37 GMT+08:00 Li Qiang : > From: Li Qiang > > In virgl_cmd_get_capset function, it uses g_malloc to allocate > a response struct to the guest. As the 'resp'struct hasn't been full > initialized it will lead the 'resp->padding' field to the guest. > Use g_malloc0 to avoid this.

Re: [Qemu-devel] [PATCH] virtio-gpu: fix information leak in capset get dispatch

2016-11-01 Thread Marc-André Lureau
Hi On Tue, Nov 1, 2016 at 3:38 PM Li Qiang wrote: > From: Li Qiang > > In virgl_cmd_get_capset function, it uses g_malloc to allocate > a response struct to the guest. As the 'resp'struct hasn't been full > initialized it will lead the 'resp->padding' field to the guest. > Use g_malloc0 to avoi

[Qemu-devel] [PATCH] virtio-gpu: fix information leak in capset get dispatch

2016-11-01 Thread Li Qiang
From: Li Qiang In virgl_cmd_get_capset function, it uses g_malloc to allocate a response struct to the guest. As the 'resp'struct hasn't been full initialized it will lead the 'resp->padding' field to the guest. Use g_malloc0 to avoid this. Signed-off-by: Li Qiang --- hw/display/virtio-gpu-3d.