[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH v1 1/1] sdhci.c: Limit the maximum block size
From: |
Alistair Francis |
Subject: |
[Qemu-devel] [PATCH v1 1/1] sdhci.c: Limit the maximum block size |
Date: |
Tue, 6 Oct 2015 10:40:41 -0700 |
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <address@hidden>
Suggested-by: Igor Mitsyanko <address@hidden>
Reported-by: Intel Security ATR <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
---
hw/sd/sdhci.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 65304cf..1d47f5c 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1006,6 +1006,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val,
unsigned size)
MASKED_WRITE(s->blksize, mask, value);
MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
}
+
+ /* Limit block size to the maximum buffer size */
+ if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \
+ "the maximum buffer 0x%x", __func__, s->blksize,
+ s->buf_maxsz);
+
+ s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
+ }
+
break;
case SDHC_ARGUMENT:
MASKED_WRITE(s->argument, mask, value);
--
2.1.4
- [Qemu-devel] [PATCH v1 1/1] sdhci.c: Limit the maximum block size,
Alistair Francis <=