[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] virtio-serial: fix heap-over-flow
From: |
linzhecheng |
Subject: |
[Qemu-devel] [PATCH] virtio-serial: fix heap-over-flow |
Date: |
Tue, 27 Mar 2018 16:23:34 +0800 |
Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before
get config->emerg_wr. It is neccessary because sizeof(virtio_console_config)
is 8 byte if VirtIOSerial doesn't have the feature of
VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize),
read/write emerg_wr will lead to heap-over-flow.
Signed-off-by: linzhecheng <address@hidden>
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 9470bd7be7..3695172f37 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -580,11 +580,12 @@ static void set_config(VirtIODevice *vdev, const uint8_t
*config_data)
VirtIOSerial *vser = VIRTIO_SERIAL(vdev);
struct virtio_console_config *config =
(struct virtio_console_config *)config_data;
- uint8_t emerg_wr_lo = le32_to_cpu(config->emerg_wr);
VirtIOSerialPort *port = find_first_connected_console(vser);
VirtIOSerialPortClass *vsc;
+ uint8_t emerg_wr_lo;
- if (!config->emerg_wr) {
+ if (!virtio_has_feature(vser->host_features,
+ VIRTIO_CONSOLE_F_EMERG_WRITE) || !config->emerg_wr) {
return;
}
/* Make sure we don't misdetect an emergency write when the guest
@@ -594,6 +595,7 @@ static void set_config(VirtIODevice *vdev, const uint8_t
*config_data)
return;
}
vsc = VIRTIO_SERIAL_PORT_GET_CLASS(port);
+ emerg_wr_lo = le32_to_cpu(config->emerg_wr);
(void)vsc->have_data(port, &emerg_wr_lo, 1);
}
--
2.12.2.windows.2
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [Qemu-devel] [PATCH] virtio-serial: fix heap-over-flow,
linzhecheng <=