[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 31/35] ivshmem: validate incoming_posn value from ser
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 31/35] ivshmem: validate incoming_posn value from server |
Date: |
Fri, 31 Oct 2014 18:26:09 +0100 |
From: Stefan Hajnoczi <address@hidden>
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem
server on the host sends invalid values.
Cc: Cam Macdonell <address@hidden>
Reported-by: Sebastian Krahmer <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
[AF: Tighten upper bound check for posn in close_guest_eventfds()]
Cc: address@hidden
Signed-off-by: Andreas Färber <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/misc/ivshmem.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c
index caeee1e..24f74f6 100644
--- a/hw/misc/ivshmem.c
+++ b/hw/misc/ivshmem.c
@@ -389,6 +389,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn)
if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) {
return;
}
+ if (posn < 0 || posn >= s->nb_peers) {
+ return;
+ }
guest_curr_max = s->peers[posn].nb_eventfds;
@@ -455,6 +458,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf,
int size)
}
}
+ if (incoming_posn < -1) {
+ IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn);
+ return;
+ }
+
/* pick off s->server_chr->msgfd and store it, posn should accompany msg */
tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr);
IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd);
--
1.8.3.1
- [Qemu-devel] [PULL 25/35] kvm_stat: Fix the non-x86 exit reasons, (continued)
- [Qemu-devel] [PULL 25/35] kvm_stat: Fix the non-x86 exit reasons, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 26/35] kvm_stat: Rework platform detection, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 27/35] kvm_stat: Abstract ioctl numbers, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 28/35] kvm_stat: Add powerpc support, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 29/35] i386: fix breakpoints handling in icount mode, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 32/35] ivshmem: Fix potential OOB r/w access, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 33/35] ivshmem: Fix fd leak on error, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 30/35] ivshmem: Check ivshmem_read() size argument, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 34/35] ivshmem: use error_report, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 35/35] virtio-scsi: fix dataplane, Paolo Bonzini, 2014/10/31
- [Qemu-devel] [PULL 31/35] ivshmem: validate incoming_posn value from server,
Paolo Bonzini <=