From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:51491)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mst@redhat.com>) id 1WkZ4e-0003Xk-D0
	for qemu-devel@nongnu.org; Wed, 14 May 2014 09:18:30 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <mst@redhat.com>) id 1WkZ4Y-0005KO-9h
	for qemu-devel@nongnu.org; Wed, 14 May 2014 09:18:20 -0400
Received: from mx1.redhat.com ([209.132.183.28]:10255)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <mst@redhat.com>) id 1WkZ4Y-0005Jj-2c
	for qemu-devel@nongnu.org; Wed, 14 May 2014 09:18:14 -0400
Received: from int-mx02.intmail.prod.int.phx2.redhat.com
	(int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
	by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id s4EDIDe2032764
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <qemu-devel@nongnu.org>; Wed, 14 May 2014 09:18:13 -0400
Date: Wed, 14 May 2014 16:16:57 +0300
From: "Michael S. Tsirkin" <mst@redhat.com>
Message-ID: <20140514131657.GA9952@redhat.com>
References: <1399896829-16617-1-git-send-email-mst@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1399896829-16617-1-git-send-email-mst@redhat.com>
Subject: Re: [Qemu-devel] [PATCH] usb: fix up post load checks
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Juan Quintela <quintela@redhat.com>, Gerd Hoffmann <kraxel@redhat.com>, dgilbert@redhat.com

On Mon, May 12, 2014 at 03:16:07PM +0300, Michael S. Tsirkin wrote:
> Correct post load checks:
> 1. dev->setup_len == sizeof(dev->data_buf)
>     seems fine, no need to fail migration
> 2. When state is DATA, passing index > len
>    will cause memcpy with negative length,
>    resulting in heap overflow
> 
> First of the issues was reported by dgilbert.
> 
> Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

This is CVE-2014-3461 

> ---
>  hw/usb/bus.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/usb/bus.c b/hw/usb/bus.c
> index e48b19f..2721719 100644
> --- a/hw/usb/bus.c
> +++ b/hw/usb/bus.c
> @@ -51,8 +51,9 @@ static int usb_device_post_load(void *opaque, int version_id)
>      }
>      if (dev->setup_index < 0 ||
>          dev->setup_len < 0 ||
> -        dev->setup_index >= sizeof(dev->data_buf) ||
> -        dev->setup_len >= sizeof(dev->data_buf)) {
> +        (dev->setup_state == SETUP_STATE_DATA &&
> +         dev->setup_index > dev->setup_len) ||
> +        dev->setup_len > sizeof(dev->data_buf)) {
>          return -EINVAL;
>      }
>      return 0;
> -- 
> MST