From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:37221) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RlBKV-0003wR-Q1 for qemu-devel@nongnu.org; Wed, 11 Jan 2012 22:27:56 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RlBKU-0006FK-F7 for qemu-devel@nongnu.org; Wed, 11 Jan 2012 22:27:55 -0500 Received: from ozlabs.org ([203.10.76.45]:43260) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RlBKU-0006EY-0g for qemu-devel@nongnu.org; Wed, 11 Jan 2012 22:27:54 -0500 Date: Thu, 12 Jan 2012 14:26:57 +1100 From: David Gibson Message-ID: <20120112032657.GR4935@truffala.fritz.box> References: <1326260692-7272-1-git-send-email-david@gibson.dropbear.id.au> <1326260692-7272-2-git-send-email-david@gibson.dropbear.id.au> <4F0D29D4.4010604@weilnetz.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4F0D29D4.4010604@weilnetz.de> Subject: Re: [Qemu-devel] [PATCH 1/4] load_image_targphys() should enforce the max size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Weil Cc: agraf@suse.de, qemu-devel@nongnu.org On Wed, Jan 11, 2012 at 07:19:00AM +0100, Stefan Weil wrote: > Am 11.01.2012 06:44, schrieb David Gibson: > >From: Benjamin Herrenschmidt > > > >load_image_targphys() gets passed a max size for the file, but > >doesn't enforce it at all. Add a check and return -1 (error) if > >the file is too big, without loading it. > > > >Signed-off-by: Benjamin Herrenschmidt > >Signed-off-by: David Gibson > >--- > >hw/loader.c | 2 ++ > >1 files changed, 2 insertions(+), 0 deletions(-) > > > >diff --git a/hw/loader.c b/hw/loader.c > >index 446b628..7ad9e22 100644 > >--- a/hw/loader.c > >+++ b/hw/loader.c > >@@ -108,6 +108,8 @@ int load_image_targphys(const char *filename, > >int size; > > > >size = get_image_size(filename); > >+ if (size > max_sz) > >+ return -1; > >if (size > 0) > >rom_add_file_fixed(filename, addr, -1); > >return size; > > Even if this file is full of block statements without braces, > we should not add more of them. See CODING_STYLE and > scripts/checkpatch.pl. I know the coding style, I thought the counterexample right next to it would take precedence. Corrected in a respin. > There remains an additional problem: > Using 'int' for the size of files was sufficient 10 years ago, > but it is that no longer. get_image_size() silently reduced the > return value from lseek() to an 'int' value. So even with your > patch, very large files will be loaded (partially)! Well, sure, but that's an independent bug. I'll fix it later if I get to it, but that kind of leads to changing the types of a whole bunch of things. -- David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson