From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39367) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WW5On-0007wz-UL for qemu-devel@nongnu.org; Fri, 04 Apr 2014 10:47:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WW5Oj-0005MZ-1W for qemu-devel@nongnu.org; Fri, 04 Apr 2014 10:47:17 -0400 Date: Fri, 4 Apr 2014 17:47:39 +0300 From: "Michael S. Tsirkin" Message-ID: <20140404144739.GA31943@redhat.com> References: <1396543778-22307-1-git-send-email-mst@redhat.com> <1396543778-22307-10-git-send-email-mst@redhat.com> <877g758ls7.fsf@elfo.mitica> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <877g758ls7.fsf@elfo.mitica> Subject: Re: [Qemu-devel] [PATCH v5 09/24] hpet: fix buffer overrun on invalid state load List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Juan Quintela Cc: Peter Maydell , Liu Ping Fan , mdroth@linux.vnet.ibm.com, Markus Armbruster , qemu-stable@nongnu.org, qemu-devel@nongnu.org, Anthony Liguori , Paolo Bonzini , =?us-ascii?B?PT9VVEYtOD9xP0FuZHJlYXM9MjBGPUMzPUE0cmJlcj89?= , dgilbert@redhat.com On Fri, Apr 04, 2014 at 11:51:52AM +0200, Juan Quintela wrote: > "Michael S. Tsirkin" wrote: > > CVE-2013-4527 hw/timer/hpet.c buffer overrun > > > > hpet is a VARRAY with a uint8 size but static array of 32 > > > > To fix, make sure num_timers is valid using VMSTATE_VALID hook. > > > > Reported-by: Anthony Liguori > > Signed-off-by: Michael S. Tsirkin > > Reviewed-by: Dr. David Alan Gilbert > > > Ok, seing what you want to do with VMSTATE_VALIDATE. It does not seem clean to add a callback that is only be used with a single type. > Much better solution is add a ->validate() field, and use it in the > equivalent of LESS_EQUAL and rest of tests. > > Will sent a patch. > > Later, Juan. I think it's better to stick to plain C, extending macros like LESS_EQUAL is too tricky, vmstate is already full ugly one-off macros. > > --- > > hw/timer/hpet.c | 13 +++++++++++++ > > 1 file changed, 13 insertions(+) > > > > diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c > > index e15d6bc..2792f89 100644 > > --- a/hw/timer/hpet.c > > +++ b/hw/timer/hpet.c > > @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque) > > return 0; > > } > > > > +static bool hpet_validate_num_timers(void *opaque, int version_id) > > +{ > > + HPETState *s = opaque; > > + > > + if (s->num_timers < HPET_MIN_TIMERS) { > > + return false; > > + } else if (s->num_timers > HPET_MAX_TIMERS) { > > + return false; > > + } > > + return true; > > +} > > + > > static int hpet_post_load(void *opaque, int version_id) > > { > > HPETState *s = opaque; > > @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = { > > VMSTATE_UINT64(isr, HPETState), > > VMSTATE_UINT64(hpet_counter, HPETState), > > VMSTATE_UINT8_V(num_timers, HPETState, 2), > > + VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers), > > VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, > > vmstate_hpet_timer, HPETTimer), > > VMSTATE_END_OF_LIST()