[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] usb: fix up post load checks
From: |
Gerd Hoffmann |
Subject: |
Re: [Qemu-devel] [PATCH] usb: fix up post load checks |
Date: |
Tue, 13 May 2014 08:49:02 +0200 |
On Di, 2014-05-13 at 03:02 +0000, Gonglei (Arei) wrote:
> Hi,
>
> > -----Original Message-----
> > From: address@hidden
> > [mailto:address@hidden On
> > Behalf Of Michael S. Tsirkin
> > Sent: Monday, May 12, 2014 8:16 PM
> > To: address@hidden
> > Cc: Gerd Hoffmann; address@hidden
> > Subject: [Qemu-devel] [PATCH] usb: fix up post load checks
> >
> > Correct post load checks:
> > 1. dev->setup_len == sizeof(dev->data_buf)
> > seems fine, no need to fail migration
> > 2. When state is DATA, passing index > len
> > will cause memcpy with negative length,
> > resulting in heap overflow
> >
> > First of the issues was reported by dgilbert.
> >
> > Reported-by: "Dr. David Alan Gilbert" <address@hidden>
> > Signed-off-by: Michael S. Tsirkin <address@hidden>
> > ---
> > hw/usb/bus.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/hw/usb/bus.c b/hw/usb/bus.c
> > index e48b19f..2721719 100644
> > --- a/hw/usb/bus.c
> > +++ b/hw/usb/bus.c
> > @@ -51,8 +51,9 @@ static int usb_device_post_load(void *opaque, int
> > version_id)
> > }
> > if (dev->setup_index < 0 ||
> > dev->setup_len < 0 ||
> > - dev->setup_index >= sizeof(dev->data_buf) ||
>
> Does this check should be deleted ?
It's ok, index <= len && len <= sizeof(buf) implies index <= sizeof(buf)
>
> > - dev->setup_len >= sizeof(dev->data_buf)) {
> > + (dev->setup_state == SETUP_STATE_DATA &&
> > + dev->setup_index > dev->setup_len) ||
> > + dev->setup_len > sizeof(dev->data_buf)) {
> > return -EINVAL;
> > }
> > return 0;
> > --
> > MST
>
> Best regards,
> -Gonglei
Re: [Qemu-devel] [PATCH] usb: fix up post load checks, Michael S. Tsirkin, 2014/05/14