[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH v4 23/30] zaurus: fix buffer overrun on invalid
From: |
Dr. David Alan Gilbert |
Subject: |
Re: [Qemu-devel] [PATCH v4 23/30] zaurus: fix buffer overrun on invalid state load |
Date: |
Tue, 1 Apr 2014 12:18:01 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
* Michael S. Tsirkin (address@hidden) wrote:
> CVE-2013-4540
>
> Within scoop_gpio_handler_update, if prev_level has a high bit set, then
> we get bit > 16 and that causes a buffer overrun.
>
> Since prev_level comes from wire indirectly, this can
> happen on invalid state load.
>
> Similarly for gpio_level and gpio_dir.
Reviewed-by: Dr. David Alan Gilbert <address@hidden>
(Without much understanding of the actual, apparently undocumented hardware)
> To fix, limit to 16 bit.
>
> Reported-by: Michael S. Tsirkin <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
> hw/gpio/zaurus.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
> index dc79a8b..8e2ce04 100644
> --- a/hw/gpio/zaurus.c
> +++ b/hw/gpio/zaurus.c
> @@ -203,6 +203,15 @@ static bool is_version_0 (void *opaque, int version_id)
> return version_id == 0;
> }
>
> +static bool vmstate_scoop_validate(void *opaque, int version_id)
> +{
> + ScoopInfo *s = opaque;
> +
> + return !(s->prev_level & 0xffff0000) &&
> + !(s->gpio_level & 0xffff0000) &&
> + !(s->gpio_dir & 0xffff0000);
> +}
> +
> static const VMStateDescription vmstate_scoop_regs = {
> .name = "scoop",
> .version_id = 1,
> @@ -215,6 +224,7 @@ static const VMStateDescription vmstate_scoop_regs = {
> VMSTATE_UINT32(gpio_level, ScoopInfo),
> VMSTATE_UINT32(gpio_dir, ScoopInfo),
> VMSTATE_UINT32(prev_level, ScoopInfo),
> + VMSTATE_VALIDATE("irq levels are 16 bit", vmstate_scoop_validate),
> VMSTATE_UINT16(mcr, ScoopInfo),
> VMSTATE_UINT16(cdr, ScoopInfo),
> VMSTATE_UINT16(ccr, ScoopInfo),
> --
> MST
>
>
--
Dr. David Alan Gilbert / address@hidden / Manchester, UK
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- Re: [Qemu-devel] [PATCH v4 23/30] zaurus: fix buffer overrun on invalid state load,
Dr. David Alan Gilbert <=