From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56487) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJf4L-0000hA-5x for qemu-devel@nongnu.org; Thu, 14 Jan 2016 05:23:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aJf4K-0000Ce-CG for qemu-devel@nongnu.org; Thu, 14 Jan 2016 05:23:53 -0500 Date: Thu, 14 Jan 2016 15:53:38 +0530 (IST) From: P J P In-Reply-To: <1452764448-17953-1-git-send-email-mst@redhat.com> Message-ID: References: <1452764448-17953-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Subject: Re: [Qemu-devel] [PATCH] cadence_gem: fix buffer overflow List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael S. Tsirkin" Cc: Peter Crosthwaite , Jason Wang , qemu-devel@nongnu.org, Alistair Francis , qemu-arm@nongnu.org, =?GB2312?B?wfXB7g==?= +-- On Thu, 14 Jan 2016, Michael S. Tsirkin wrote --+ | gem_receive copies a packet received from network into an rxbuf[2048] | array on stack, with size limited by descriptor length set by guest. If | guest is malicious and specifies a descriptor length that is too large, | and should packet size exceed array size, this results in a buffer | overflow. | | diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c | index 3639fc1..15a0786 100644 | --- a/hw/net/cadence_gem.c | +++ b/hw/net/cadence_gem.c | @@ -862,6 +862,14 @@ static void gem_transmit(CadenceGEMState *s) | break; | } | | + if (tx_desc_get_length(desc) > sizeof(tx_packet) - (p - tx_packet)) { | + DB_PRINT("TX descriptor @ 0x%x too large: size 0x%x space 0x%x\n", | + (unsigned)packet_desc_addr, | + (unsigned)tx_desc_get_length(desc), | + sizeof(tx_packet) - (p - tx_packet)); | + break; | + } | + Commit message says gem_receive, but the patch fixes gem_transmit() routine. -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F