[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/5] virtio-serial: fix heap-over-flow
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PULL 5/5] virtio-serial: fix heap-over-flow |
Date: |
Mon, 9 Apr 2018 17:42:09 +0300 |
From: linzhecheng <address@hidden>
Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before
get config->emerg_wr. It is neccessary because sizeof(virtio_console_config)
is 8 byte if VirtIOSerial doesn't have the feature of
VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize),
read/write emerg_wr will lead to heap-over-flow.
Signed-off-by: linzhecheng <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/char/virtio-serial-bus.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 9470bd7..d2dd8ab 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -580,13 +580,16 @@ static void set_config(VirtIODevice *vdev, const uint8_t
*config_data)
VirtIOSerial *vser = VIRTIO_SERIAL(vdev);
struct virtio_console_config *config =
(struct virtio_console_config *)config_data;
- uint8_t emerg_wr_lo = le32_to_cpu(config->emerg_wr);
VirtIOSerialPort *port = find_first_connected_console(vser);
VirtIOSerialPortClass *vsc;
+ uint8_t emerg_wr_lo;
- if (!config->emerg_wr) {
+ if (!virtio_has_feature(vser->host_features,
+ VIRTIO_CONSOLE_F_EMERG_WRITE) || !config->emerg_wr) {
return;
}
+
+ emerg_wr_lo = le32_to_cpu(config->emerg_wr);
/* Make sure we don't misdetect an emergency write when the guest
* does a short config write after an emergency write. */
config->emerg_wr = 0;
--
MST
- [Qemu-devel] [PULL 0/5] virtio,vhost: fixes, Michael S. Tsirkin, 2018/04/09
- [Qemu-devel] [PULL 3/5] contrib/libvhost-user: add the protocol feature used for SET/GET message, Michael S. Tsirkin, 2018/04/09
- [Qemu-devel] [PULL 4/5] vhost: Allow adjoining regions, Michael S. Tsirkin, 2018/04/09
- [Qemu-devel] [PULL 5/5] virtio-serial: fix heap-over-flow,
Michael S. Tsirkin <=
- [Qemu-devel] [PULL 2/5] vhost-user: back SET/GET_CONFIG requests with a protocol feature, Michael S. Tsirkin, 2018/04/09
- [Qemu-devel] [PULL 1/5] vhost-user-blk: set config ops before vhost-user init, Michael S. Tsirkin, 2018/04/09
- Re: [Qemu-devel] [PULL 0/5] virtio,vhost: fixes, Peter Maydell, 2018/04/09