From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45207) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WW5fQ-0002f6-GH for qemu-devel@nongnu.org; Fri, 04 Apr 2014 11:04:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WW5fK-0003DS-TF for qemu-devel@nongnu.org; Fri, 04 Apr 2014 11:04:28 -0400 Date: Fri, 4 Apr 2014 18:04:50 +0300 From: "Michael S. Tsirkin" Message-ID: <20140404150450.GA1032@redhat.com> References: <1396543778-22307-1-git-send-email-mst@redhat.com> <1396543778-22307-10-git-send-email-mst@redhat.com> <877g758ls7.fsf@elfo.mitica> <20140404144739.GA31943@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140404144739.GA31943@redhat.com> Subject: Re: [Qemu-devel] [PATCH v5 09/24] hpet: fix buffer overrun on invalid state load List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Juan Quintela Cc: Peter Maydell , Liu Ping Fan , mdroth@linux.vnet.ibm.com, Markus Armbruster , qemu-stable@nongnu.org, qemu-devel@nongnu.org, Anthony Liguori , Paolo Bonzini , =?us-ascii?B?PT9VVEYtOD9xP0FuZHJlYXM9MjBGPUMzPUE0cmJlcj89?= , dgilbert@redhat.com On Fri, Apr 04, 2014 at 05:47:39PM +0300, Michael S. Tsirkin wrote: > On Fri, Apr 04, 2014 at 11:51:52AM +0200, Juan Quintela wrote: > > "Michael S. Tsirkin" wrote: > > > CVE-2013-4527 hw/timer/hpet.c buffer overrun > > > > > > hpet is a VARRAY with a uint8 size but static array of 32 > > > > > > To fix, make sure num_timers is valid using VMSTATE_VALID hook. > > > > > > Reported-by: Anthony Liguori > > > Signed-off-by: Michael S. Tsirkin > > > Reviewed-by: Dr. David Alan Gilbert > > > > > > Ok, seing what you want to do with VMSTATE_VALIDATE. > > It does not seem clean to add a callback that is only > be used with a single type. > > > Much better solution is add a ->validate() field, and use it in the > > equivalent of LESS_EQUAL and rest of tests. > > > > Will sent a patch. > > > > Later, Juan. > > I think it's better to stick to plain C, extending macros like > LESS_EQUAL is too tricky, vmstate is already full ugly one-off macros. Sent too quick, phrase is cut off short ... let's not add any more, let's use a generic macro like VMSTATE_VALIDATE. > > > --- > > > hw/timer/hpet.c | 13 +++++++++++++ > > > 1 file changed, 13 insertions(+) > > > > > > diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c > > > index e15d6bc..2792f89 100644 > > > --- a/hw/timer/hpet.c > > > +++ b/hw/timer/hpet.c > > > @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque) > > > return 0; > > > } > > > > > > +static bool hpet_validate_num_timers(void *opaque, int version_id) > > > +{ > > > + HPETState *s = opaque; > > > + > > > + if (s->num_timers < HPET_MIN_TIMERS) { > > > + return false; > > > + } else if (s->num_timers > HPET_MAX_TIMERS) { > > > + return false; > > > + } > > > + return true; > > > +} > > > + > > > static int hpet_post_load(void *opaque, int version_id) > > > { > > > HPETState *s = opaque; > > > @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = { > > > VMSTATE_UINT64(isr, HPETState), > > > VMSTATE_UINT64(hpet_counter, HPETState), > > > VMSTATE_UINT8_V(num_timers, HPETState, 2), > > > + VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers), > > > VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, > > > vmstate_hpet_timer, HPETTimer), > > > VMSTATE_END_OF_LIST()