[Xen-devel] [PATCH] x86: fix null pointer dereference in intel_get_extended_msrs()

[Xi Wang <xi@xxxxxxx>]

`memset(&mc_ext, 0, ...)' leads to a buffer overflow and a subsequent
null pointer dereference.  Replace `&mc_ext' with `mc_ext'.

Signed-off-by: Xi Wang <xi@xxxxxxx>
---
 xen/arch/x86/cpu/mcheck/mce_intel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c 
b/xen/arch/x86/cpu/mcheck/mce_intel.c
index d80f692..57e93d4 100644
--- a/xen/arch/x86/cpu/mcheck/mce_intel.c
+++ b/xen/arch/x86/cpu/mcheck/mce_intel.c
@@ -200,7 +200,7 @@ intel_get_extended_msrs(struct mcinfo_global *mig, struct 
mc_info *mi)
     }
 
     /* this function will called when CAP(9).MCG_EXT_P = 1 */
-    memset(&mc_ext, 0, sizeof(struct mcinfo_extended));
+    memset(mc_ext, 0, sizeof(struct mcinfo_extended));
     mc_ext->common.type = MC_TYPE_EXTENDED;
     mc_ext->common.size = sizeof(struct mcinfo_extended);
 
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel