* [Qemu-devel] [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message
@ 2011-11-28 19:27 Markus Armbruster
2011-11-29 9:36 ` Alon Levy
0 siblings, 1 reply; 3+ messages in thread
From: Markus Armbruster @ 2011-11-28 19:27 UTC (permalink / raw)
To: qemu-devel; +Cc: alevy
ATR size exceeding the limit is diagnosed, but then we merrily use it
anyway, overrunning card->atr[].
The message is read from a character device. Obvious security
implications unless the other end of the character device is trusted.
Spotted by Coverity. CVE-2011-4111.
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
hw/ccid-card-passthru.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
index 2cbc81b..9f51c6c 100644
--- a/hw/ccid-card-passthru.c
+++ b/hw/ccid-card-passthru.c
@@ -150,6 +150,7 @@ static void ccid_card_vscard_handle_message(PassthruState *card,
error_report("ATR size exceeds spec, ignoring");
ccid_card_vscard_send_error(card, scr_msg_header->reader_id,
VSC_GENERAL_ERROR);
+ break;
}
memcpy(card->atr, data, scr_msg_header->length);
card->atr_length = scr_msg_header->length;
--
1.7.6.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message
2011-11-28 19:27 [Qemu-devel] [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message Markus Armbruster
@ 2011-11-29 9:36 ` Alon Levy
2011-11-29 9:51 ` Markus Armbruster
0 siblings, 1 reply; 3+ messages in thread
From: Alon Levy @ 2011-11-29 9:36 UTC (permalink / raw)
To: anthony; +Cc: qemu-devel, Markus Armbruster
On Mon, Nov 28, 2011 at 08:27:37PM +0100, Markus Armbruster wrote:
> ATR size exceeding the limit is diagnosed, but then we merrily use it
> anyway, overrunning card->atr[].
>
> The message is read from a character device. Obvious security
> implications unless the other end of the character device is trusted.
>
> Spotted by Coverity. CVE-2011-4111.
>
Anthony, do you want me to do a pull request for this or can you merge
it as is?
Alon
> Signed-off-by: Markus Armbruster <armbru@redhat.com>
> ---
> hw/ccid-card-passthru.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c
> index 2cbc81b..9f51c6c 100644
> --- a/hw/ccid-card-passthru.c
> +++ b/hw/ccid-card-passthru.c
> @@ -150,6 +150,7 @@ static void ccid_card_vscard_handle_message(PassthruState *card,
> error_report("ATR size exceeds spec, ignoring");
> ccid_card_vscard_send_error(card, scr_msg_header->reader_id,
> VSC_GENERAL_ERROR);
> + break;
> }
> memcpy(card->atr, data, scr_msg_header->length);
> card->atr_length = scr_msg_header->length;
> --
> 1.7.6.4
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message
2011-11-29 9:36 ` Alon Levy
@ 2011-11-29 9:51 ` Markus Armbruster
0 siblings, 0 replies; 3+ messages in thread
From: Markus Armbruster @ 2011-11-29 9:51 UTC (permalink / raw)
To: anthony; +Cc: qemu-devel
Alon Levy <alevy@redhat.com> writes:
> On Mon, Nov 28, 2011 at 08:27:37PM +0100, Markus Armbruster wrote:
>> ATR size exceeding the limit is diagnosed, but then we merrily use it
>> anyway, overrunning card->atr[].
>>
>> The message is read from a character device. Obvious security
>> implications unless the other end of the character device is trusted.
>>
>> Spotted by Coverity. CVE-2011-4111.
>>
>
> Anthony, do you want me to do a pull request for this or can you merge
> it as is?
It's already in, commit 7e62255a.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-11-29 9:51 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-11-28 19:27 [Qemu-devel] [PATCH] ccid: Fix buffer overrun in handling of VSC_ATR message Markus Armbruster
2011-11-29 9:36 ` Alon Levy
2011-11-29 9:51 ` Markus Armbruster
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).