[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL v2 5/5] sdhci.c: Limit the maximum block size
From: |
Stefan Hajnoczi |
Subject: |
[Qemu-devel] [PULL v2 5/5] sdhci.c: Limit the maximum block size |
Date: |
Mon, 12 Oct 2015 11:23:05 +0100 |
From: Alistair Francis <address@hidden>
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <address@hidden>
Reported-by: Intel Security ATR <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Peter Crosthwaite <address@hidden>
Message-id: address@hidden
Suggested-by: Igor Mitsyanko <address@hidden>
Reported-by: Intel Security ATR <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
---
hw/sd/sdhci.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 7f9d814..7f73527 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1009,6 +1009,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val,
unsigned size)
MASKED_WRITE(s->blksize, mask, value);
MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16);
}
+
+ /* Limit block size to the maximum buffer size */
+ if (extract32(s->blksize, 0, 12) > s->buf_maxsz) {
+ qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \
+ "the maximum buffer 0x%x", __func__, s->blksize,
+ s->buf_maxsz);
+
+ s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz);
+ }
+
break;
case SDHC_ARGUMENT:
MASKED_WRITE(s->argument, mask, value);
--
2.4.3
- [Qemu-devel] [PULL v2 0/5] Block patches, Stefan Hajnoczi, 2015/10/12
- [Qemu-devel] [PULL v2 1/5] sdhci: Pass drive parameter to sdhci-pci via qdev property, Stefan Hajnoczi, 2015/10/12
- [Qemu-devel] [PULL v2 4/5] block: switch from g_slice allocator to malloc, Stefan Hajnoczi, 2015/10/12
- Re: [Qemu-devel] [PULL v2 0/5] Block patches, Peter Maydell, 2015/10/12
- [Qemu-devel] [PULL v2 2/5] virtio-blk: use blk_io_plug/unplug for Linux AIO batching, Stefan Hajnoczi, 2015/10/15
- [Qemu-devel] [PULL v2 5/5] sdhci.c: Limit the maximum block size,
Stefan Hajnoczi <=
- [Qemu-devel] [PULL v2 3/5] virtio dataplane: adapt dataplane for virtio Version 1, Stefan Hajnoczi, 2015/10/15