* [PATCH] hw/audio/virtio-snd: fix invalid param check
@ 2024-08-02 7:18 Volker Rümelin
2024-08-02 11:11 ` Manos Pitsidianakis
0 siblings, 1 reply; 2+ messages in thread
From: Volker Rümelin @ 2024-08-02 7:18 UTC (permalink / raw)
To: Gerd Hoffmann, Manos Pitsidianakis, Michael S. Tsirkin
Cc: Philippe Mathieu-Daudé, Zheyu Ma, qemu-devel
Commit 9b6083465f ("virtio-snd: check for invalid param shift
operands") tries to prevent invalid parameters specified by the
guest. However, the code is not correct.
Change the code so that the parameters format and rate, which are
a bit numbers, are compared with the bit size of the data type.
Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands")
Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
---
hw/audio/virtio-snd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index e5196aa4bb..d1cf5eb445 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
error_report("Number of channels is not supported.");
return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
}
- if (BIT(params->format) > sizeof(supported_formats) ||
+ if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE ||
!(supported_formats & BIT(params->format))) {
error_report("Stream format is not supported.");
return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
}
- if (BIT(params->rate) > sizeof(supported_rates) ||
+ if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE ||
!(supported_rates & BIT(params->rate))) {
error_report("Stream rate is not supported.");
return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
--
2.35.3
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] hw/audio/virtio-snd: fix invalid param check
2024-08-02 7:18 [PATCH] hw/audio/virtio-snd: fix invalid param check Volker Rümelin
@ 2024-08-02 11:11 ` Manos Pitsidianakis
0 siblings, 0 replies; 2+ messages in thread
From: Manos Pitsidianakis @ 2024-08-02 11:11 UTC (permalink / raw)
To: Volker Rü melin, Gerd Hoffmann, Michael S. Tsirkin
Cc: Philippe Mathieu-Daudé , Zheyu Ma, qemu-devel
On Fri, 02 Aug 2024 10:18, Volker Rümelin <vr_qemu@t-online.de> wrote:
>Commit 9b6083465f ("virtio-snd: check for invalid param shift
>operands") tries to prevent invalid parameters specified by the
>guest. However, the code is not correct.
>
>Change the code so that the parameters format and rate, which are
>a bit numbers, are compared with the bit size of the data type.
>
>Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands")
>Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
>---
> hw/audio/virtio-snd.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
>index e5196aa4bb..d1cf5eb445 100644
>--- a/hw/audio/virtio-snd.c
>+++ b/hw/audio/virtio-snd.c
>@@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s,
> error_report("Number of channels is not supported.");
> return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
> }
>- if (BIT(params->format) > sizeof(supported_formats) ||
>+ if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE ||
> !(supported_formats & BIT(params->format))) {
> error_report("Stream format is not supported.");
> return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
> }
>- if (BIT(params->rate) > sizeof(supported_rates) ||
>+ if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE ||
> !(supported_rates & BIT(params->rate))) {
> error_report("Stream rate is not supported.");
> return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);
>--
>2.35.3
>
Thanks for the fix Volker :)
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-08-02 11:13 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-02 7:18 [PATCH] hw/audio/virtio-snd: fix invalid param check Volker Rümelin
2024-08-02 11:11 ` Manos Pitsidianakis
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).