From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:37067)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1VnvyA-0004uT-6u
	for qemu-devel@nongnu.org; Tue, 03 Dec 2013 14:49:24 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1Vnvy3-0000Wj-RG
	for qemu-devel@nongnu.org; Tue, 03 Dec 2013 14:49:18 -0500
Received: from mail-pd0-f181.google.com ([209.85.192.181]:63672)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peter.maydell@linaro.org>) id 1Vnvy3-0000WQ-Ly
	for qemu-devel@nongnu.org; Tue, 03 Dec 2013 14:49:11 -0500
Received: by mail-pd0-f181.google.com with SMTP id p10so20559178pdj.26
	for <qemu-devel@nongnu.org>; Tue, 03 Dec 2013 11:49:10 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <1386087086-3691-16-git-send-email-mst@redhat.com>
References: <1386087086-3691-1-git-send-email-mst@redhat.com>
	<1386087086-3691-16-git-send-email-mst@redhat.com>
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 3 Dec 2013 19:48:43 +0000
Message-ID: <CAFEAcA-KvvvZ2ZVBaoe0DR_giE=kcbZyfVw3S5R-+bVqZ0WHBw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [Qemu-devel] [PATCH 15/23] pxa2xx: avoid buffer overrun on
	incoming migration
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Michael Roth <mdroth@linux.vnet.ibm.com>, QEMU Developers <qemu-devel@nongnu.org>, qemu-stable <qemu-stable@nongnu.org>

On 3 December 2013 16:29, Michael S. Tsirkin <mst@redhat.com> wrote:
> From: Michael Roth <mdroth@linux.vnet.ibm.com>
>
> CVE-2013-4533
>
> s->rx_level is read from the wire and used to determine how many bytes
> to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the
> length of s->rx_fifo[] the buffer can be overrun with arbitrary data
> from the wire.
>
> Fix this by introducing a constant, RX_FIFO_SZ, that defines the length
> of s->rx_fifo[], and taking the wire value modulo RX_FIFO_SZ (as is done
> elsewhere in the emulation code when s->rx_level exceeds RX_FIFO_SZ).
>
> Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>  hw/arm/pxa2xx.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
> index 02b7016..41d3c39 100644
> --- a/hw/arm/pxa2xx.c
> +++ b/hw/arm/pxa2xx.c
> @@ -457,6 +457,8 @@ static const VMStateDescription vmstate_pxa2xx_mm = {
>      }
>  };
>
> +#define RX_FIFO_SZ 16
> +
>  #define TYPE_PXA2XX_SSP "pxa2xx-ssp"
>  #define PXA2XX_SSP(obj) \
>      OBJECT_CHECK(PXA2xxSSPState, (obj), TYPE_PXA2XX_SSP)
> @@ -481,7 +483,7 @@ typedef struct {
>      uint8_t ssrsa;
>      uint8_t ssacd;
>
> -    uint32_t rx_fifo[16];
> +    uint32_t rx_fifo[RX_FIFO_SZ];
>      int rx_level;
>      int rx_start;
>  } PXA2xxSSPState;
> @@ -756,7 +758,7 @@ static int pxa2xx_ssp_load(QEMUFile *f, void *opaque, int version_id)
>      qemu_get_8s(f, &s->ssrsa);
>      qemu_get_8s(f, &s->ssacd);
>
> -    s->rx_level = qemu_get_byte(f);
> +    s->rx_level = qemu_get_byte(f) % RX_FIFO_SZ;
>      s->rx_start = 0;
>      for (i = 0; i < s->rx_level; i ++)
>          s->rx_fifo[i] = qemu_get_byte(f);

An rx_level of 16 is OK, but this change will incorrectly read
it as zero, won't it?

thanks
-- PMM