[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 18/23] ssd0323: fix buffer overun on invalid sta
From: |
Peter Maydell |
Subject: |
Re: [Qemu-devel] [PATCH 18/23] ssd0323: fix buffer overun on invalid state load |
Date: |
Tue, 3 Dec 2013 19:30:38 +0000 |
On 3 December 2013 16:29, Michael S. Tsirkin <address@hidden> wrote:
> CVE-2013-4538
>
> s->cmd_len used as index in ssd0323_transfer() to store 32-bit field.
> Possible this field might then be supplied by guest to overwrite a
> return addr somewhere. Same for row/col fields, which are indicies into
> framebuffer array.
>
> To fix validate after load.
The commit message says it validates the row/col fields...
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
> hw/display/ssd0323.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c
> index c3231c6..2c82598 100644
> --- a/hw/display/ssd0323.c
> +++ b/hw/display/ssd0323.c
> @@ -312,6 +312,9 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int
> version_id)
> return -EINVAL;
>
> s->cmd_len = qemu_get_be32(f);
> + if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) {
> + return -EINVAL;
> + }
> s->cmd = qemu_get_be32(f);
> for (i = 0; i < 8; i++)
> s->cmd_data[i] = qemu_get_be32(f);
> --
...but the patch only checks the cmd_len ?
thanks
-- PMM
- Re: [Qemu-devel] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on incoming migration (part 3), (continued)
- [Qemu-devel] [PATCH 13/23] virtio: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 14/23] openpic: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 15/23] pxa2xx: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 16/23] virtio: validate num_sg when mapping, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 17/23] ssi-sd: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 18/23] ssd0323: fix buffer overun on invalid state load, Michael S. Tsirkin, 2013/12/03
- Re: [Qemu-devel] [PATCH 18/23] ssd0323: fix buffer overun on invalid state load,
Peter Maydell <=
- [Qemu-devel] [PATCH 19/23] tsc210x: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 20/23] zaurus: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 21/23] usb: sanity check setup_index+setup_len in post_load, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 11/23] stellaris_enet: avoid buffer overrun on incoming migration (part 2), Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 23/23] savevm: fix potential segfault on invalid state, Michael S. Tsirkin, 2013/12/03
- [Qemu-devel] [PATCH 22/23] virtio-scsi: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03