[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 013/108] vmstate: fix buffer overflow in target-arm/
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 013/108] vmstate: fix buffer overflow in target-arm/machine.c |
Date: |
Wed, 6 Aug 2014 15:38:23 -0500 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4531
cpreg_vmstate_indexes is a VARRAY_INT32. A negative value for
cpreg_vmstate_array_len will cause a buffer overflow.
VMSTATE_INT32_LE was supposed to protect against this
but doesn't because it doesn't validate that input is
non-negative.
Fix this macro to valide the value appropriately.
The only other user of VMSTATE_INT32_LE doesn't
ever use negative numbers so it doesn't care.
Reported-by: Anthony Liguori <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
(cherry picked from commit d2ef4b61fe6d33d2a5dcf100a9b9440de341ad62)
Signed-off-by: Michael Roth <address@hidden>
---
vmstate.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/vmstate.c b/vmstate.c
index f019228..dbb7666 100644
--- a/vmstate.c
+++ b/vmstate.c
@@ -337,8 +337,9 @@ const VMStateInfo vmstate_info_int32_equal = {
.put = put_int32,
};
-/* 32 bit int. Check that the received value is less than or equal to
- the one in the field */
+/* 32 bit int. Check that the received value is non-negative
+ * and less than or equal to the one in the field.
+ */
static int get_int32_le(QEMUFile *f, void *pv, size_t size)
{
@@ -346,7 +347,7 @@ static int get_int32_le(QEMUFile *f, void *pv, size_t size)
int32_t loaded;
qemu_get_sbe32s(f, &loaded);
- if (loaded <= *cur) {
+ if (loaded >= 0 && loaded <= *cur) {
*cur = loaded;
return 0;
}
--
1.9.1
- [Qemu-devel] [PATCH 002/108] hw/net/stellaris_enet: Correct handling of packet padding, (continued)
- [Qemu-devel] [PATCH 002/108] hw/net/stellaris_enet: Correct handling of packet padding, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 004/108] vmstate: add VMS_MUST_EXIST, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 008/108] virtio-net: out-of-bounds buffer write on load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 005/108] vmstate: add VMSTATE_VALIDATE, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 009/108] ahci: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 006/108] virtio-net: fix buffer overflow on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 011/108] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 007/108] virtio-net: out-of-bounds buffer write on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 012/108] pl022: fix buffer overun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 010/108] hpet: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 013/108] vmstate: fix buffer overflow in target-arm/machine.c,
Michael Roth <=
- [Qemu-devel] [PATCH 015/108] virtio: validate num_sg when mapping, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 019/108] ssd0323: fix buffer overun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 017/108] pxa2xx: avoid buffer overrun on incoming migration, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 018/108] ssi-sd: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 020/108] tsc210x: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 024/108] target-arm: A64: fix unallocated test of scalar SQXTUN, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 023/108] virtio-scsi: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 021/108] zaurus: fix buffer overrun on invalid state load, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 025/108] megasas: Implement LD_LIST_QUERY, Michael Roth, 2014/08/06
- [Qemu-devel] [PATCH 022/108] usb: sanity check setup_index+setup_len in post_load, Michael Roth, 2014/08/06