From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34278) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WLeAw-0004jT-9X for qemu-devel@nongnu.org; Thu, 06 Mar 2014 14:41:57 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WLeAm-0006AZ-MX for qemu-devel@nongnu.org; Thu, 06 Mar 2014 14:41:50 -0500 Message-ID: <5318CF72.5070905@suse.de> Date: Thu, 06 Mar 2014 20:41:38 +0100 From: =?ISO-8859-1?Q?Andreas_F=E4rber?= MIME-Version: 1.0 References: <1386087086-3691-1-git-send-email-mst@redhat.com> <1386087086-3691-20-git-send-email-mst@redhat.com> In-Reply-To: <1386087086-3691-20-git-send-email-mst@redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH 19/23] tsc210x: fix buffer overrun on invalid state load List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" , qemu-devel@nongnu.org Cc: Peter Maydell , qemu-stable@nongnu.org Am 03.12.2013 17:29, schrieb Michael S. Tsirkin: > CVE-2013-4539 >=20 > s->precision, nextprecision, function and nextfunction > come from wire and are used > as idx into resolution[] in TSC_CUT_RESOLUTION. >=20 > Validate after load to avoid buffer overrun. >=20 > Signed-off-by: Michael S. Tsirkin > --- > hw/input/tsc210x.c | 12 ++++++++++++ > 1 file changed, 12 insertions(+) >=20 > diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c > index 485c9e5..c7513c7 100644 > --- a/hw/input/tsc210x.c > +++ b/hw/input/tsc210x.c > @@ -1070,9 +1070,21 @@ static int tsc210x_load(QEMUFile *f, void *opaqu= e, int version_id) > s->enabled =3D qemu_get_byte(f); > s->host_mode =3D qemu_get_byte(f); > s->function =3D qemu_get_byte(f); > + if (s->function > ARRAY_SIZE(mode_regs)) { Don't these need to be >=3D according to the commit message? Regards, Andreas > + return -EINVAL; > + } > s->nextfunction =3D qemu_get_byte(f); > + if (s->nextfunction > ARRAY_SIZE(mode_regs)) { > + return -EINVAL; > + } > s->precision =3D qemu_get_byte(f); > + if (s->precision > ARRAY_SIZE(resolution)) { > + return -EINVAL; > + } > s->nextprecision =3D qemu_get_byte(f); > + if (s->nextprecision > ARRAY_SIZE(resolution)) { > + return -EINVAL; > + } > s->filter =3D qemu_get_byte(f); > s->pin_func =3D qemu_get_byte(f); > s->ref =3D qemu_get_byte(f); >=20 --=20 SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 N=FCrnberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imend=F6rffer; HRB 16746 AG N=FCrnbe= rg