git: 4a3810075fd3 - main - bhyve: fix buffer overflow in QemuFwCfg

The branch main has been updated by corvink:

URL: https://cgit.FreeBSD.org/src/commit/?id=4a3810075fd307301d8b3f087efe7a61bc37199b

commit 4a3810075fd307301d8b3f087efe7a61bc37199b
Author:     Corvin Köhne <corvink@FreeBSD.org>
AuthorDate: 2023-10-16 08:52:21 +0000
Commit:     Corvin Köhne <corvink@FreeBSD.org>
CommitDate: 2023-10-17 13:57:28 +0000

    bhyve: fix buffer overflow in QemuFwCfg
    
    We're accessing one element of the newly allocated and the old directory
    too much.
    
    Reported by:            andy@omniosce.org
    Reviewed by:            markj
    Fixes:                  6f9ebb3d0fed2b0ae604dd6daf17f1fe1d8df216 ("bhyve: add helper for adding fwcfg files")
    MFC after:              1 week
    Differential Revision:  https://reviews.freebsd.org/D42220
---
 usr.sbin/bhyve/qemu_fwcfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr.sbin/bhyve/qemu_fwcfg.c b/usr.sbin/bhyve/qemu_fwcfg.c
index 830cee730dbd..5b33dfab037d 100644
--- a/usr.sbin/bhyve/qemu_fwcfg.c
+++ b/usr.sbin/bhyve/qemu_fwcfg.c
@@ -365,7 +365,7 @@ qemu_fwcfg_add_file(const char *name, const uint32_t size, void *const data)
 		/* copy files above file_index to directory */
 		memcpy(&new_directory->files[file_index + 1],
 		    &fwcfg_sc.directory->files[file_index],
-		    (count - file_index) * sizeof(struct qemu_fwcfg_file));
+		    (count - file_index - 1) * sizeof(struct qemu_fwcfg_file));
 
 		/* free old directory */
 		free(fwcfg_sc.directory);