From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55917) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZkTkP-0004MD-KA for qemu-devel@nongnu.org; Fri, 09 Oct 2015 05:13:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZkTkO-0003nt-I6 for qemu-devel@nongnu.org; Fri, 09 Oct 2015 05:13:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54338) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZkTkO-0003ni-Cq for qemu-devel@nongnu.org; Fri, 09 Oct 2015 05:13:52 -0400 From: Stefan Hajnoczi Date: Fri, 9 Oct 2015 10:13:27 +0100 Message-Id: <1444382007-20416-6-git-send-email-stefanha@redhat.com> In-Reply-To: <1444382007-20416-1-git-send-email-stefanha@redhat.com> References: <1444382007-20416-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PULL 5/5] sdhci.c: Limit the maximum block size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Peter Maydell , Stefan Hajnoczi , Alistair Francis From: Alistair Francis It is possible for the guest to set an invalid block size which is larger then the fifo_buffer[] array. This could cause a buffer overflow. To avoid this limit the maximum size of the blksize variable. Signed-off-by: Alistair Francis Reported-by: Intel Security ATR Reviewed-by: Stefan Hajnoczi Reviewed-by: Peter Crosthwaite Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com Suggested-by: Igor Mitsyanko Reported-by: Intel Security ATR Reviewed-by: Stefan Hajnoczi Signed-off-by: Stefan Hajnoczi --- hw/sd/sdhci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 4a64509..3cd6aa6 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1006,6 +1006,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) MASKED_WRITE(s->blksize, mask, value); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); } + + /* Limit block size to the maximum buffer size */ + if (extract32(s->blksize, 0, 12) > s->buf_maxsz) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \ + "the maximum buffer 0x%x", __func__, s->blksize, + s->buf_maxsz); + + s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz); + } + break; case SDHC_ARGUMENT: MASKED_WRITE(s->argument, mask, value); -- 2.4.3