summaryrefslogtreecommitdiffstats
path: root/src/svm/message_queue.c
diff options
context:
space:
mode:
authorLijian.Zhang <Lijian.Zhang@arm.com>2019-05-22 18:33:52 +0800
committerFlorin Coras <florin.coras@gmail.com>2019-06-18 14:34:13 +0000
commitb6d61e347a64e2263067c8c44415c3ad4d3cea70 (patch)
tree3608fbfeef64fb451e57e35e55d73f7dfaf9dad8 /src/svm/message_queue.c
parentbadf38a2b7559a313fda01811f86a9c25f4c00db (diff)
session: fix memory out of bound issue
Ring data space is following ring vec_header_t and ring elements immediately. Add verification code in session_test. Type: fix Change-Id: I0bfa096a9f459128a588821d99b5cdb4f10ede38 Signed-off-by: Lijian Zhang <Lijian.Zhang@arm.com> Reviewed-by: Sirshak Das <Sirshak.Das@arm.com>
Diffstat (limited to 'src/svm/message_queue.c')
-rw-r--r--src/svm/message_queue.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/svm/message_queue.c b/src/svm/message_queue.c
index 13d089a97cc..630442064f8 100644
--- a/src/svm/message_queue.c
+++ b/src/svm/message_queue.c
@@ -72,7 +72,7 @@ svm_msg_q_alloc (svm_msg_q_cfg_t * cfg)
vh = (vec_header_t *) ((u8 *) mq->q + q_sz);
vh->len = cfg->n_rings;
mq->rings = (svm_msg_q_ring_t *) (vh + 1);
- rings_ptr = (u8 *) mq->rings + vec_sz;
+ rings_ptr = (u8 *) mq->rings + sizeof (svm_msg_q_ring_t) * cfg->n_rings;
for (i = 0; i < cfg->n_rings; i++)
{
ring = &mq->rings[i];