From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39530) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZlioZ-0003eF-88 for qemu-devel@nongnu.org; Mon, 12 Oct 2015 15:31:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZlioW-00071o-7Q for qemu-devel@nongnu.org; Mon, 12 Oct 2015 15:31:18 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41637) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZlioW-00071i-31 for qemu-devel@nongnu.org; Mon, 12 Oct 2015 15:31:16 -0400 Date: Tue, 13 Oct 2015 01:01:09 +0530 (IST) From: P J P Message-ID: MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Subject: [Qemu-devel] [PATCH] Limit memory r/w length to buffer size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerben van der Lubbe Hello, An OOB r/w access issue was reported by Mr Gerben Lubbe(CC'd here). The GDB(1) stub protocol supports commands 'm/M' to read & write 'len' bytes from/to the stub memory area. In that, the 'len' parameter value supplied by the host gdb(1) is not validated against the local buffer size. Which in turn could lead to OOB r/w memory access. Below is a proposed patch to fix this issue. === >>From 88edb457a66f8ff96209a1603914171eade0658b Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Mon, 12 Oct 2015 22:56:41 +0530 Subject: Limit memory r/w length to buffer size GDB(1) stub communication protocol supports commands m/M to read and write 'len' bytes from/to the stub memory area. m addr,len : read 'len' bytes from address 'addr' M addr,len: : write 'len' bytes of 'data' to 'addr' Qemu stub uses automatic buffers of size 'MAX_PACKET_LENGTH=4096' to process these commands. Limit 'len' parameter value supplied by the host gdb(1) to the maximum buffer size to avoid any OOB buffer access. Reported-by: Gerben van der Lubbe Signed-off-by: Prasad J Pandit --- gdbstub.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/gdbstub.c b/gdbstub.c index ffe7e6e..39da736 100644 --- a/gdbstub.c +++ b/gdbstub.c @@ -956,6 +956,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf) if (*p == ',') p++; len = strtoull(p, NULL, 16); + len = len > MAX_PACKET_LENGTH ? MAX_PACKET_LENGTH : len; if (target_memory_rw_debug(s->g_cpu, addr, mem_buf, len, false) != 0) { put_packet (s, "E14"); } else { @@ -968,6 +969,7 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf) if (*p == ',') p++; len = strtoull(p, (char **)&p, 16); + len = len > MAX_PACKET_LENGTH ? MAX_PACKET_LENGTH : len; if (*p == ':') p++; hextomem(mem_buf, p, len); -- 2.4.3 === Thank you. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F