From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53500) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wk96V-0002AH-Du for qemu-devel@nongnu.org; Tue, 13 May 2014 05:34:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Wk96P-00074R-32 for qemu-devel@nongnu.org; Tue, 13 May 2014 05:34:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:29096) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Wk96O-00074L-OM for qemu-devel@nongnu.org; Tue, 13 May 2014 05:34:25 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4D9YOHP014956 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Tue, 13 May 2014 05:34:24 -0400 Date: Tue, 13 May 2014 12:33:16 +0300 From: "Michael S. Tsirkin" Message-ID: <1399973136-21527-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Subject: [Qemu-devel] [PATCH v2] usb: fix up post load checks List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: "Dr. David Alan Gilbert" , Gerd Hoffmann Correct post load checks: 1. dev->setup_len == sizeof(dev->data_buf) seems fine, no need to fail migration 2. When state is DATA, passing index > len will cause memcpy with negative length, resulting in heap overflow First of the issues was reported by dgilbert. Reported-by: "Dr. David Alan Gilbert" Signed-off-by: Michael S. Tsirkin --- changes from v1: - drop state check - lightly tested hw/usb/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/usb/bus.c b/hw/usb/bus.c index e48b19f..ff1dfe6 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -51,8 +51,8 @@ static int usb_device_post_load(void *opaque, int version_id) } if (dev->setup_index < 0 || dev->setup_len < 0 || - dev->setup_index >= sizeof(dev->data_buf) || - dev->setup_len >= sizeof(dev->data_buf)) { + dev->setup_index > dev->setup_len || + dev->setup_len > sizeof(dev->data_buf)) { return -EINVAL; } return 0; -- MST