From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50291) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XTZK8-0003te-Lm for qemu-devel@nongnu.org; Mon, 15 Sep 2014 12:40:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XTZK1-0006ud-Fq for qemu-devel@nongnu.org; Mon, 15 Sep 2014 12:40:20 -0400 From: =?UTF-8?q?Andreas=20F=C3=A4rber?= Date: Mon, 15 Sep 2014 18:40:06 +0200 Message-Id: <1410799208-3250-3-git-send-email-afaerber@suse.de> In-Reply-To: <1410799208-3250-1-git-send-email-afaerber@suse.de> References: <1410799208-3250-1-git-send-email-afaerber@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH v3 2/4] ivshmem: validate incoming_posn value from server List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Sebastian Krahmer , "Michael S. Tsirkin" , qemu-stable@nongnu.org, David Marchand , Bruce Rogers , Stefan Hajnoczi , Cam Macdonell , =?UTF-8?q?Andreas=20F=C3=A4rber?= From: Stefan Hajnoczi Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem server on the host sends invalid values. Cc: Cam Macdonell Reported-by: Sebastian Krahmer Signed-off-by: Stefan Hajnoczi [AF: Tighten upper bound check for posn in close_guest_eventfds()] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas F=C3=A4rber --- hw/misc/ivshmem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index caeee1e..24f74f6 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -389,6 +389,9 @@ static void close_guest_eventfds(IVShmemState *s, int= posn) if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { return; } + if (posn < 0 || posn >=3D s->nb_peers) { + return; + } =20 guest_curr_max =3D s->peers[posn].nb_eventfds; =20 @@ -455,6 +458,11 @@ static void ivshmem_read(void *opaque, const uint8_t= *buf, int size) } } =20 + if (incoming_posn < -1) { + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); + return; + } + /* pick off s->server_chr->msgfd and store it, posn should accompany= msg */ tmp_fd =3D qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); --=20 1.8.4.5