Re: [Qemu-devel] [PATCH v4 23/30] zaurus: fix buffer overrun on invalid state load

[Dr. David Alan Gilbert]

* Michael S. Tsirkin (address@hidden) wrote:
> CVE-2013-4540
> 
> Within scoop_gpio_handler_update, if prev_level has a high bit set, then
> we get bit > 16 and that causes a buffer overrun.
> 
> Since prev_level comes from wire indirectly, this can
> happen on invalid state load.
> 
> Similarly for gpio_level and gpio_dir.

Reviewed-by: Dr. David Alan Gilbert <address@hidden>

(Without much understanding of the actual, apparently undocumented hardware)

> To fix, limit to 16 bit.
> 
> Reported-by: Michael S. Tsirkin <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
>  hw/gpio/zaurus.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
> index dc79a8b..8e2ce04 100644
> --- a/hw/gpio/zaurus.c
> +++ b/hw/gpio/zaurus.c
> @@ -203,6 +203,15 @@ static bool is_version_0 (void *opaque, int version_id)
>      return version_id == 0;
>  }
>  
> +static bool vmstate_scoop_validate(void *opaque, int version_id)
> +{
> +    ScoopInfo *s = opaque;
> +
> +    return !(s->prev_level & 0xffff0000) &&
> +        !(s->gpio_level & 0xffff0000) &&
> +        !(s->gpio_dir & 0xffff0000);
> +}
> +
>  static const VMStateDescription vmstate_scoop_regs = {
>      .name = "scoop",
>      .version_id = 1,
> @@ -215,6 +224,7 @@ static const VMStateDescription vmstate_scoop_regs = {
>          VMSTATE_UINT32(gpio_level, ScoopInfo),
>          VMSTATE_UINT32(gpio_dir, ScoopInfo),
>          VMSTATE_UINT32(prev_level, ScoopInfo),
> +        VMSTATE_VALIDATE("irq levels are 16 bit", vmstate_scoop_validate),
>          VMSTATE_UINT16(mcr, ScoopInfo),
>          VMSTATE_UINT16(cdr, ScoopInfo),
>          VMSTATE_UINT16(ccr, ScoopInfo),
> -- 
> MST
> 
> 
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK