[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 16/36] tsc210x: fix buffer overrun on invalid state
From: |
Juan Quintela |
Subject: |
[Qemu-devel] [PATCH 16/36] tsc210x: fix buffer overrun on invalid state load |
Date: |
Mon, 5 May 2014 22:30:14 +0200 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4539
s->precision, nextprecision, function and nextfunction
come from wire and are used
as idx into resolution[] in TSC_CUT_RESOLUTION.
Validate after load to avoid buffer overrun.
Cc: Andreas Färber <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
---
hw/input/tsc210x.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c
index 485c9e5..aa5b688 100644
--- a/hw/input/tsc210x.c
+++ b/hw/input/tsc210x.c
@@ -1070,9 +1070,21 @@ static int tsc210x_load(QEMUFile *f, void *opaque, int
version_id)
s->enabled = qemu_get_byte(f);
s->host_mode = qemu_get_byte(f);
s->function = qemu_get_byte(f);
+ if (s->function < 0 || s->function >= ARRAY_SIZE(mode_regs)) {
+ return -EINVAL;
+ }
s->nextfunction = qemu_get_byte(f);
+ if (s->nextfunction < 0 || s->nextfunction >= ARRAY_SIZE(mode_regs)) {
+ return -EINVAL;
+ }
s->precision = qemu_get_byte(f);
+ if (s->precision < 0 || s->precision >= ARRAY_SIZE(resolution)) {
+ return -EINVAL;
+ }
s->nextprecision = qemu_get_byte(f);
+ if (s->nextprecision < 0 || s->nextprecision >= ARRAY_SIZE(resolution)) {
+ return -EINVAL;
+ }
s->filter = qemu_get_byte(f);
s->pin_func = qemu_get_byte(f);
s->ref = qemu_get_byte(f);
--
1.9.0
- [Qemu-devel] [PATCH 03/36] vmstate: add VMSTATE_VALIDATE, (continued)
- [Qemu-devel] [PATCH 03/36] vmstate: add VMSTATE_VALIDATE, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 01/36] vmstate: reduce code duplication, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 06/36] virtio: out-of-bounds buffer write on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 08/36] hpet: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 09/36] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 10/36] pl022: fix buffer overun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 11/36] vmstate: fix buffer overflow in target-arm/machine.c, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 12/36] virtio: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 14/36] pxa2xx: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 13/36] virtio: validate num_sg when mapping, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 16/36] tsc210x: fix buffer overrun on invalid state load,
Juan Quintela <=
- [Qemu-devel] [PATCH 15/36] ssd0323: fix buffer overun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 18/36] virtio-scsi: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 17/36] zaurus: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 21/36] savevm: Ignore minimum_version_id_old if there is no load_state_old, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 22/36] ssi-sd: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 19/36] vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 23/36] openpic: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 20/36] usb: sanity check setup_index+setup_len in post_load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 24/36] virtio-net: out-of-bounds buffer write on load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 27/36] Make qemu_peek_buffer loop until it gets it's data, Juan Quintela, 2014/05/05