From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52778) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adBeV-0003as-A2 for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:02:01 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adBeS-0006c1-4h for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:01:55 -0500 Received: from mx1.redhat.com ([209.132.183.28]:36839) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adBeS-0006bv-0P for qemu-devel@nongnu.org; Tue, 08 Mar 2016 02:01:52 -0500 From: Peter Xu Date: Tue, 8 Mar 2016 15:00:46 +0800 Message-Id: <1457420446-25276-9-git-send-email-peterx@redhat.com> In-Reply-To: <1457420446-25276-1-git-send-email-peterx@redhat.com> References: <1457420446-25276-1-git-send-email-peterx@redhat.com> Subject: [Qemu-devel] [PATCH 8/8] hw/i386: fix unbounded stack for load_multiboot List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pbonzini@redhat.com, "Michael S. Tsirkin" , Eduardo Habkost , peterx@redhat.com, Richard Henderson Suggested-by: Paolo Bonzini CC: Paolo Bonzini CC: Richard Henderson CC: Eduardo Habkost CC: "Michael S. Tsirkin" Signed-off-by: Peter Xu --- hw/i386/multiboot.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c index 9e164e6..0eecb9a 100644 --- a/hw/i386/multiboot.c +++ b/hw/i386/multiboot.c @@ -159,6 +159,12 @@ int load_multiboot(FWCfgState *fw_cfg, uint8_t *mb_bootinfo_data; uint32_t cmdline_len; +#define __KERN_FNAME_LEN (1024) +#define __KERN_CMDLINE_LEN (4096) + + assert(strlen(kernel_filename) + 1 >= __KERN_FNAME_LEN); + assert(strlen(kernel_cmdline) + 1 >= __KERN_CMDLINE_LEN); + /* Ok, let's see if it is a multiboot image. The header is 12x32bit long, so the latest entry may be 8192 - 48. */ for (i = 0; i < (8192 - 48); i += 4) { @@ -324,7 +330,7 @@ int load_multiboot(FWCfgState *fw_cfg, } /* Commandline support */ - char kcmdline[strlen(kernel_filename) + strlen(kernel_cmdline) + 2]; + char kcmdline[__KERN_FNAME_LEN + __KERN_CMDLINE_LEN]; snprintf(kcmdline, sizeof(kcmdline), "%s %s", kernel_filename, kernel_cmdline); stl_p(bootinfo + MBI_CMDLINE, mb_add_cmdline(&mbs, kcmdline)); @@ -370,4 +376,6 @@ int load_multiboot(FWCfgState *fw_cfg, nb_option_roms++; return 1; /* yes, we are multiboot */ +#undef __KERN_FNAME_LEN +#undef __KERN_CMDLINE_LEN } -- 2.4.3