Re: [Qemu-devel] [PATCH 20/23] zaurus: fix buffer overrun on invalid state load

[Peter Maydell]

On 3 December 2013 16:29, Michael S. Tsirkin <address@hidden> wrote:
> CVE-2013-4540
>
> Within scoop_gpio_handler_update, if prev_level has a high bit set, then
> we get bit > 16 and that does a buffer overrun.
>
> Since prev_level comes from wire indirectly, this can
> happen on invalid state load.
>
> To fix, limit to 16 bit.

I feel like it would be more robust to sanitize on state load
rather than hoping that all future updates to the device continue
to work with bogus values in the state struct.

Alternatively we could make gpio_dir, gpio_level and prev_level
uint16_t in the state struct and vmstate (we don't care about
migration cross-version compat for this device).

thanks
-- PMM