[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-stable] [PATCH 15/23] pxa2xx: avoid buffer overrun on incoming
From: |
Peter Maydell |
Subject: |
Re: [Qemu-stable] [PATCH 15/23] pxa2xx: avoid buffer overrun on incoming migration |
Date: |
Tue, 3 Dec 2013 19:48:43 +0000 |
On 3 December 2013 16:29, Michael S. Tsirkin <address@hidden> wrote:
> From: Michael Roth <address@hidden>
>
> CVE-2013-4533
>
> s->rx_level is read from the wire and used to determine how many bytes
> to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the
> length of s->rx_fifo[] the buffer can be overrun with arbitrary data
> from the wire.
>
> Fix this by introducing a constant, RX_FIFO_SZ, that defines the length
> of s->rx_fifo[], and taking the wire value modulo RX_FIFO_SZ (as is done
> elsewhere in the emulation code when s->rx_level exceeds RX_FIFO_SZ).
>
> Signed-off-by: Michael Roth <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> ---
> hw/arm/pxa2xx.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
> index 02b7016..41d3c39 100644
> --- a/hw/arm/pxa2xx.c
> +++ b/hw/arm/pxa2xx.c
> @@ -457,6 +457,8 @@ static const VMStateDescription vmstate_pxa2xx_mm = {
> }
> };
>
> +#define RX_FIFO_SZ 16
> +
> #define TYPE_PXA2XX_SSP "pxa2xx-ssp"
> #define PXA2XX_SSP(obj) \
> OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
> @@ -481,7 +483,7 @@ typedef struct {
> uint8_t ssrsa;
> uint8_t ssacd;
>
> - uint32_t rx_fifo[16];
> + uint32_t rx_fifo[RX_FIFO_SZ];
> int rx_level;
> int rx_start;
> } PXA2xxSSPState;
> @@ -756,7 +758,7 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int
> version_id)
> qemu_get_8s(f, &s->ssrsa);
> qemu_get_8s(f, &s->ssacd);
>
> - s->rx_level = qemu_get_byte(f);
> + s->rx_level = qemu_get_byte(f) % RX_FIFO_SZ;
> s->rx_start = 0;
> for (i = 0; i < s->rx_level; i ++)
> s->rx_fifo[i] = qemu_get_byte(f);
An rx_level of 16 is OK, but this change will incorrectly read
it as zero, won't it?
thanks
-- PMM
- [Qemu-stable] [PATCH 10/23] stellaris_enet: avoid buffer overrun on incoming migration, (continued)
- [Qemu-stable] [PATCH 10/23] stellaris_enet: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 12/23] stellaris_enet: avoid buffer orerrun on incoming migration (part 3), Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 13/23] virtio: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 14/23] openpic: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 16/23] virtio: validate num_sg when mapping, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 15/23] pxa2xx: avoid buffer overrun on incoming migration, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 17/23] ssi-sd: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 18/23] ssd0323: fix buffer overun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 20/23] zaurus: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 19/23] tsc210x: fix buffer overrun on invalid state load, Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 11/23] stellaris_enet: avoid buffer overrun on incoming migration (part 2), Michael S. Tsirkin, 2013/12/03
- [Qemu-stable] [PATCH 21/23] usb: sanity check setup_index+setup_len in post_load, Michael S. Tsirkin, 2013/12/03