[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 016/108] openpic: avoid buffer overrun on incoming m
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 016/108] openpic: avoid buffer overrun on incoming migration |
Date: |
Wed, 6 Aug 2014 15:38:26 -0500 |
CVE-2013-4534
opp->nb_cpus is read from the wire and used to determine how many
IRQDest elements to read into opp->dst[]. If the value exceeds the
length of opp->dst[], MAX_CPU, opp->dst[] can be overrun with arbitrary
data from the wire.
Fix this by failing migration if the value read from the wire exceeds
MAX_CPU.
Signed-off-by: Michael Roth <address@hidden>
Reviewed-by: Alexander Graf <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit 73d963c0a75cb99c6aaa3f6f25e427aa0b35a02e)
Signed-off-by: Michael Roth <address@hidden>
---
hw/intc/openpic.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/hw/intc/openpic.c b/hw/intc/openpic.c
index be76fbd..17136c9 100644
--- a/hw/intc/openpic.c
+++ b/hw/intc/openpic.c
@@ -41,6 +41,7 @@
#include "hw/sysbus.h"
#include "hw/pci/msi.h"
#include "qemu/bitops.h"
+#include "qapi/qmp/qerror.h"
//#define DEBUG_OPENPIC
@@ -1416,7 +1417,7 @@ static void openpic_load_IRQ_queue(QEMUFile* f, IRQQueue
*q)
static int openpic_load(QEMUFile* f, void *opaque, int version_id)
{
OpenPICState *opp = (OpenPICState *)opaque;
- unsigned int i;
+ unsigned int i, nb_cpus;
if (version_id != 1) {
return -EINVAL;
@@ -1428,7 +1429,11 @@ static int openpic_load(QEMUFile* f, void *opaque, int
version_id)
qemu_get_be32s(f, &opp->spve);
qemu_get_be32s(f, &opp->tfrr);
- qemu_get_be32s(f, &opp->nb_cpus);
+ qemu_get_be32s(f, &nb_cpus);
+ if (opp->nb_cpus != nb_cpus) {
+ return -EINVAL;
+ }
+ assert(nb_cpus > 0 && nb_cpus <= MAX_CPU);
for (i = 0; i < opp->nb_cpus; i++) {
qemu_get_sbe32s(f, &opp->dst[i].ctpr);
@@ -1567,6 +1572,13 @@ static void openpic_realize(DeviceState *dev, Error
**errp)
{NULL}
};
+ if (opp->nb_cpus > MAX_CPU) {
+ error_set(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
+ TYPE_OPENPIC, "nb_cpus", (uint64_t)opp->nb_cpus,
+ (uint64_t)0, (uint64_t)MAX_CPU);
+ return;
+ }
+
switch (opp->model) {
case OPENPIC_MODEL_FSL_MPIC_20:
default:
--
1.9.1
- [Qemu-devel] [PATCH 024/108] target-arm: A64: fix unallocated test of scalar SQXTUN, (continued)
- [Qemu-devel] [PATCH 024/108] target-arm: A64: fix unallocated test of scalar SQXTUN, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 023/108] virtio-scsi: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 021/108] zaurus: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 025/108] megasas: Implement LD_LIST_QUERY, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 022/108] usb: sanity check setup_index+setup_len in post_load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 014/108] virtio: avoid buffer overrun on incoming migration, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 029/108] po/Makefile: fix $SRC_PATH reference, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 027/108] block: Prevent coroutine stack overflow when recursing in bdrv_open_backing_file., Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 028/108] s390x: empty function stubs in preparation for __KVM_HAVE_GUEST_DEBUG, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 030/108] acpi: fix tables for no-hpet configuration, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 016/108] openpic: avoid buffer overrun on incoming migration,
Michael Roth <=
- [Qemu-devel] [PATCH 033/108] target-i386: fix set of registers zeroed on reset, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 031/108] stellaris_enet: block migration, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 032/108] s390x/kvm: rework KVM synchronize to tracing for some ONEREGS, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 036/108] target-arm: Make vbar_write 64bit friendly on 32bit hosts, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 037/108] linux-user/elfload.c: Fix incorrect ARM HWCAP bits, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 040/108] spapr_pci: Fix number of returned vectors in ibm, change-msi, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 038/108] linux-user/elfload.c: Update ARM HWCAP bits, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 035/108] target-arm: A64: Handle blr lr, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 039/108] linux-user/elfload.c: Fix A64 code which was incorrectly acting like A32, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 026/108] arm: translate.c: Fix smlald Instruction, Michael Roth, 2014/08/06