From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50105) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WSP3O-0000fq-A9 for qemu-devel@nongnu.org; Tue, 25 Mar 2014 06:58:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WSP3J-0006Ac-GT for qemu-devel@nongnu.org; Tue, 25 Mar 2014 06:57:58 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34030) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WSP3J-0006AK-77 for qemu-devel@nongnu.org; Tue, 25 Mar 2014 06:57:53 -0400 Date: Tue, 25 Mar 2014 10:57:40 +0000 From: "Dr. David Alan Gilbert" Message-ID: <20140325105740.GE2459@work-vm> References: <1395698484-22562-1-git-send-email-mst@redhat.com> <1395698484-22562-4-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1395698484-22562-4-git-send-email-mst@redhat.com> Subject: Re: [Qemu-devel] [PATCH RFC v3 3/3] hpet: fix buffer overrun on invalid state load List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" Cc: Peter Maydell , qemu-devel@nongnu.org, Anthony Liguori * Michael S. Tsirkin (mst@redhat.com) wrote: > CVE-2013-4527 hw/timer/hpet.c buffer overrun > > hpet is a VARRAY with a uint8 size but static array of 32 > > To fix, make sure num_timers is valid using VMSTATE_TEST hook. > > Reported-by: Anthony Liguori > Signed-off-by: Michael S. Tsirkin Reviewed-by: Dr. David Alan Gilbert > --- > hw/timer/hpet.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > > diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c > index 1ee0640..7303ade 100644 > --- a/hw/timer/hpet.c > +++ b/hw/timer/hpet.c > @@ -248,6 +248,18 @@ static int hpet_pre_load(void *opaque) > return 0; > } > > +static bool hpet_validate_num_timers(void *opaque, int version_id) > +{ > + HPETState *s = opaque; > + > + if (s->num_timers < HPET_MIN_TIMERS) { > + return false; > + } else if (s->num_timers > HPET_MAX_TIMERS) { > + return false; > + } > + return true; > +} > + > static int hpet_post_load(void *opaque, int version_id) > { > HPETState *s = opaque; > @@ -318,6 +330,7 @@ static const VMStateDescription vmstate_hpet = { > VMSTATE_UINT64(isr, HPETState), > VMSTATE_UINT64(hpet_counter, HPETState), > VMSTATE_UINT8_V(num_timers, HPETState, 2), > + VMSTATE_TEST("num_timers in range", hpet_validate_num_timers), > VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, > vmstate_hpet_timer, HPETTimer), > VMSTATE_END_OF_LIST() > -- > MST > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK