[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] usb: fix up post load checks
From: |
Michael S. Tsirkin |
Subject: |
[Qemu-devel] [PATCH] usb: fix up post load checks |
Date: |
Mon, 12 May 2014 15:16:07 +0300 |
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
First of the issues was reported by dgilbert.
Reported-by: "Dr. David Alan Gilbert" <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
---
hw/usb/bus.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index e48b19f..2721719 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -51,8 +51,9 @@ static int usb_device_post_load(void *opaque, int version_id)
}
if (dev->setup_index < 0 ||
dev->setup_len < 0 ||
- dev->setup_index >= sizeof(dev->data_buf) ||
- dev->setup_len >= sizeof(dev->data_buf)) {
+ (dev->setup_state == SETUP_STATE_DATA &&
+ dev->setup_index > dev->setup_len) ||
+ dev->setup_len > sizeof(dev->data_buf)) {
return -EINVAL;
}
return 0;
--
MST
- [Qemu-devel] [PATCH] usb: fix up post load checks,
Michael S. Tsirkin <=
Re: [Qemu-devel] [PATCH] usb: fix up post load checks, Michael S. Tsirkin, 2014/05/14