From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:52783) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WW0n7-0005wf-9v for qemu-devel@nongnu.org; Fri, 04 Apr 2014 05:52:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WW0n2-0002lV-8y for qemu-devel@nongnu.org; Fri, 04 Apr 2014 05:52:05 -0400 From: Juan Quintela In-Reply-To: <1396543778-22307-10-git-send-email-mst@redhat.com> (Michael S. Tsirkin's message of "Thu, 3 Apr 2014 19:51:23 +0300") References: <1396543778-22307-1-git-send-email-mst@redhat.com> <1396543778-22307-10-git-send-email-mst@redhat.com> Date: Fri, 04 Apr 2014 11:51:52 +0200 Message-ID: <877g758ls7.fsf@elfo.mitica> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [Qemu-devel] [PATCH v5 09/24] hpet: fix buffer overrun on invalid state load Reply-To: quintela@redhat.com List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" Cc: Peter Maydell , Liu Ping Fan , mdroth@linux.vnet.ibm.com, Markus Armbruster , qemu-stable@nongnu.org, qemu-devel@nongnu.org, Anthony Liguori , Paolo Bonzini , =?us-ascii?Q?=3D=3FUTF-8=3Fq=3FAndreas=3D?= =?us-ascii?Q?20F=3DC3=3DA4rber=3F=3D?= , dgilbert@redhat.com "Michael S. Tsirkin" wrote: > CVE-2013-4527 hw/timer/hpet.c buffer overrun > > hpet is a VARRAY with a uint8 size but static array of 32 > > To fix, make sure num_timers is valid using VMSTATE_VALID hook. > > Reported-by: Anthony Liguori > Signed-off-by: Michael S. Tsirkin > Reviewed-by: Dr. David Alan Gilbert Ok, seing what you want to do with VMSTATE_VALIDATE. Much better solution is add a ->validate() field, and use it in the equivalent of LESS_EQUAL and rest of tests. Will sent a patch. Later, Juan. > --- > hw/timer/hpet.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > > diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c > index e15d6bc..2792f89 100644 > --- a/hw/timer/hpet.c > +++ b/hw/timer/hpet.c > @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque) > return 0; > } > > +static bool hpet_validate_num_timers(void *opaque, int version_id) > +{ > + HPETState *s = opaque; > + > + if (s->num_timers < HPET_MIN_TIMERS) { > + return false; > + } else if (s->num_timers > HPET_MAX_TIMERS) { > + return false; > + } > + return true; > +} > + > static int hpet_post_load(void *opaque, int version_id) > { > HPETState *s = opaque; > @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = { > VMSTATE_UINT64(isr, HPETState), > VMSTATE_UINT64(hpet_counter, HPETState), > VMSTATE_UINT8_V(num_timers, HPETState, 2), > + VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers), > VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0, > vmstate_hpet_timer, HPETTimer), > VMSTATE_END_OF_LIST()