From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58081) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WW6Wj-00086j-Kp for qemu-devel@nongnu.org; Fri, 04 Apr 2014 11:59:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WW6We-0003hj-FH for qemu-devel@nongnu.org; Fri, 04 Apr 2014 11:59:33 -0400 Date: Fri, 4 Apr 2014 18:11:12 +0300 From: "Michael S. Tsirkin" Message-ID: <20140404151112.GA1066@redhat.com> References: <1396543778-22307-1-git-send-email-mst@redhat.com> <1396543778-22307-10-git-send-email-mst@redhat.com> <877g758ls7.fsf@elfo.mitica> <20140404144739.GA31943@redhat.com> <20140404150450.GA1032@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20140404150450.GA1032@redhat.com> Subject: Re: [Qemu-devel] [PATCH v5 09/24] hpet: fix buffer overrun on invalid state load List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Juan Quintela Cc: Peter Maydell , Liu Ping Fan , mdroth@linux.vnet.ibm.com, Markus Armbruster , qemu-stable@nongnu.org, qemu-devel@nongnu.org, Anthony Liguori , Paolo Bonzini , =?us-ascii?B?PT9VVEYtOD9xP0FuZHJlYXM9MjBGPUMzPUE0cmJlcj89?= , dgilbert@redhat.com On Fri, Apr 04, 2014 at 06:04:50PM +0300, Michael S. Tsirkin wrote: > On Fri, Apr 04, 2014 at 05:47:39PM +0300, Michael S. Tsirkin wrote: > > On Fri, Apr 04, 2014 at 11:51:52AM +0200, Juan Quintela wrote: > > > "Michael S. Tsirkin" wrote: > > > > CVE-2013-4527 hw/timer/hpet.c buffer overrun > > > > > > > > hpet is a VARRAY with a uint8 size but static array of 32 > > > > > > > > To fix, make sure num_timers is valid using VMSTATE_VALID hook. > > > > > > > > Reported-by: Anthony Liguori > > > > Signed-off-by: Michael S. Tsirkin > > > > Reviewed-by: Dr. David Alan Gilbert > > > > > > > > > Ok, seing what you want to do with VMSTATE_VALIDATE. > > > > It does not seem clean to add a callback that is only > > be used with a single type. > > > > > Much better solution is add a ->validate() field, and use it in the > > > equivalent of LESS_EQUAL and rest of tests. > > > > > > Will sent a patch. > > > > > > Later, Juan. > > > > I think it's better to stick to plain C, extending macros like > > LESS_EQUAL is too tricky, vmstate is already full ugly one-off macros. > > Sent too quick, phrase is cut off short > > ... let's not add any more, let's use a generic macro like > VMSTATE_VALIDATE. > Hmm and I notice this still sounds rude and unclear. Pls exuse the tone and the confusion, I wrote this in a hurry, I'm sorry about that. It's weekend here - I'll write a clearer response next week. > > > > --- > > > > hw/timer/hpet.c | 13 +++++++++++++ > > > > 1 file changed, 13 insertions(+) > > > > > > > > diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c > > > > index e15d6bc..2792f89 100644 > > > > --- a/hw/timer/hpet.c > > > > +++ b/hw/timer/hpet.c > > > > @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque) > > > > return 0; > > > > } > > > > > > > > +static bool hpet_validate_num_timers(void *opaque, int version_id) > > > > +{ > > > > + HPETState *s = opaque; > > > > + > > > > + if (s->num_timers < HPET_MIN_TIMERS) { > > > > + return false; > > > > + } else if (s->num_timers > HPET_MAX_TIMERS) { > > > > + return false; > > > > + } > > > > + return true; > > > > +} > > > > + > > > > static int hpet_post_load(void *opaque, int version_id) > > > > { > > > > HPETState *s = opaque; > > > > @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = { > > > > VMSTATE_UINT64(isr, HPETState), > > > > VMSTATE_UINT64(hpet_counter, HPETState), > > > > VMSTATE_UINT8_V(num_timers, HPETState, 2), > > > > + VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers), > > > > VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, > > > > vmstate_hpet_timer, HPETTimer), > > > > VMSTATE_END_OF_LIST()