From: Thomas Huth <[email protected]>

The b64write code has a sanity check that the given lengths matches
the real length of the given data, and calculates the minimum of the
two values to be on the safe side. However, the address_space_write()
then uses the original value and ignores the calculated minimum. Use
out_len here to fix the problem.

Fixes: 70da30483e7 ("qtest: Use cpu address space instead of system memory")
Signed-off-by: Thomas Huth <[email protected]>
---
 system/qtest.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/system/qtest.c b/system/qtest.c
index a79d10d1361..d6db057b0a2 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -698,7 +698,7 @@ static void qtest_process_command(CharFrontend *chr, gchar 
**words)
         }
 
         address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
-                            len);
+                            out_len);
 
         qtest_send(chr, "OK\n");
     } else if (strcmp(words[0], "endianness") == 0) {
-- 
2.54.0


Reply via email to