[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 03/41] virtio-crypto: fix possible integer and heap o
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 03/41] virtio-crypto: fix possible integer and heap overflow |
Date: |
Tue, 10 Jan 2017 07:39:24 +0200 |
From: Gonglei <address@hidden>
Because the 'size_t' type is 4 bytes in 32-bit platform, which
is the same with 'int'. It's easy to make 'max_len' to zero when
integer overflow and then cause heap overflow if 'max_len' is zero.
Using uint_64 instead of size_t to avoid the integer overflow.
Cc: address@hidden
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Gonglei <address@hidden>
Tested-by: Li Qiang <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/virtio/virtio-crypto.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 2f2467e..c23e1ad 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -416,7 +416,7 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev,
uint32_t hash_start_src_offset = 0, len_to_hash = 0;
uint32_t cipher_start_src_offset = 0, len_to_cipher = 0;
- size_t max_len, curr_size = 0;
+ uint64_t max_len, curr_size = 0;
size_t s;
/* Plain cipher */
@@ -441,7 +441,7 @@ virtio_crypto_sym_op_helper(VirtIODevice *vdev,
return NULL;
}
- max_len = iv_len + aad_len + src_len + dst_len + hash_result_len;
+ max_len = (uint64_t)iv_len + aad_len + src_len + dst_len + hash_result_len;
if (unlikely(max_len > vcrypto->conf.max_size)) {
virtio_error(vdev, "virtio-crypto too big length");
return NULL;
--
MST
- [Qemu-devel] [PULL 00/41] virtio, vhost, pc: fixes, features, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 01/41] migration: allow to prioritize save state entries, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 02/41] intel_iommu: allow migration, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 03/41] virtio-crypto: fix possible integer and heap overflow,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 05/41] intel_iommu: name vtd address space with devfn, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 06/41] intel_iommu: allocate new key when creating new address space, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 04/41] virtio: convert to use DMA api, Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 07/41] exec: introduce address_space_get_iotlb_entry(), Michael S. Tsirkin, 2017/01/10
- [Qemu-devel] [PULL 08/41] intel_iommu: support device iotlb descriptor, Michael S. Tsirkin, 2017/01/10