[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 20/23] zaurus: fix buffer overrun on invalid sta

From: Peter Maydell
Subject: Re: [Qemu-devel] [PATCH 20/23] zaurus: fix buffer overrun on invalid state load
Date: Tue, 3 Dec 2013 19:44:30 +0000

On 3 December 2013 16:29, Michael S. Tsirkin <address@hidden> wrote:
> CVE-2013-4540
> Within scoop_gpio_handler_update, if prev_level has a high bit set, then
> we get bit > 16 and that does a buffer overrun.
> Since prev_level comes from wire indirectly, this can
> happen on invalid state load.
> To fix, limit to 16 bit.

I feel like it would be more robust to sanitize on state load
rather than hoping that all future updates to the device continue
to work with bogus values in the state struct.

Alternatively we could make gpio_dir, gpio_level and prev_level
uint16_t in the state struct and vmstate (we don't care about
migration cross-version compat for this device).

-- PMM

reply via email to

[Prev in Thread] Current Thread [Next in Thread]