* [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite
@ 2016-08-09 2:24 chaojianhu
2016-08-09 3:51 ` Jason Wang
0 siblings, 1 reply; 4+ messages in thread
From: chaojianhu @ 2016-08-09 2:24 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-trivial, edgar.iglesias, alistair.francis, jasowang,
qemu-arm, chaojianhu
The .receive callback of xlnx.xps-ethernetlite doesn't check the length
of data before calling memcpy. As a result, the NetClientState object in
heap will be overflowd. All versions of qemu with xlnx.xps-ethernetlite
will be affected.
Reported-by: chaojianhu <chaojianhu@hotmail.com>
---
hw/net/xilinx_ethlite.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 54db2b8..6d3eecc 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
}
D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase));
+ if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4 ) {
+ D(qemu_log("ethlite packet is too big, size=%x\n", size);
+ return -1;
+ }
memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size);
s->regs[rxbase + R_RX_CTRL0] |= CTRL_S;
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite
2016-08-09 2:24 chaojianhu
@ 2016-08-09 3:51 ` Jason Wang
0 siblings, 0 replies; 4+ messages in thread
From: Jason Wang @ 2016-08-09 3:51 UTC (permalink / raw)
To: chaojianhu, qemu-devel
Cc: qemu-trivial, edgar.iglesias, alistair.francis, qemu-arm
On 2016年08月09日 10:24, chaojianhu wrote:
> The .receive callback of xlnx.xps-ethernetlite doesn't check the length
> of data before calling memcpy. As a result, the NetClientState object in
> heap will be overflowd. All versions of qemu with xlnx.xps-ethernetlite
> will be affected.
>
> Reported-by: chaojianhu <chaojianhu@hotmail.com>
Patch looks correct. But as reported, please add Signed-off-by with your
name and repost.
Thanks
>
> ---
> hw/net/xilinx_ethlite.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
> index 54db2b8..6d3eecc 100644
> --- a/hw/net/xilinx_ethlite.c
> +++ b/hw/net/xilinx_ethlite.c
> @@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
> }
>
> D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase));
> + if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4 ) {
> + D(qemu_log("ethlite packet is too big, size=%x\n", size);
> + return -1;
> + }
> memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size);
>
> s->regs[rxbase + R_RX_CTRL0] |= CTRL_S;
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite
@ 2016-08-09 3:52 chaojianhu
2016-08-09 7:26 ` Jason Wang
0 siblings, 1 reply; 4+ messages in thread
From: chaojianhu @ 2016-08-09 3:52 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-trivial, edgar.iglesias, alistair.francis, jasowang,
qemu-arm, chaojianhu
The .receive callback of xlnx.xps-ethernetlite doesn't check the length
of data before calling memcpy. As a result, the NetClientState object in
heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite
will be affected.
Reported-by: chaojianhu <chaojianhu@hotmail.com>
Signed-off-by: chaojianhu <chaojianhu@hotmail.com>
---
hw/net/xilinx_ethlite.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index 54db2b8..35de353 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
}
D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase));
+ if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4) {
+ D(qemu_log("ethlite packet is too big, size=%x\n", size));
+ return -1;
+ }
memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size);
s->regs[rxbase + R_RX_CTRL0] |= CTRL_S;
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite
2016-08-09 3:52 [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite chaojianhu
@ 2016-08-09 7:26 ` Jason Wang
0 siblings, 0 replies; 4+ messages in thread
From: Jason Wang @ 2016-08-09 7:26 UTC (permalink / raw)
To: chaojianhu, qemu-devel
Cc: qemu-trivial, edgar.iglesias, alistair.francis, qemu-arm
On 2016年08月09日 11:52, chaojianhu wrote:
> The .receive callback of xlnx.xps-ethernetlite doesn't check the length
> of data before calling memcpy. As a result, the NetClientState object in
> heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite
> will be affected.
>
> Reported-by: chaojianhu <chaojianhu@hotmail.com>
> Signed-off-by: chaojianhu <chaojianhu@hotmail.com>
>
> ---
> hw/net/xilinx_ethlite.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
> index 54db2b8..35de353 100644
> --- a/hw/net/xilinx_ethlite.c
> +++ b/hw/net/xilinx_ethlite.c
> @@ -197,6 +197,10 @@ static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
> }
>
> D(qemu_log("%s %zd rxbase=%x\n", __func__, size, rxbase));
> + if (size > (R_MAX - R_RX_BUF0 - rxbase) * 4) {
> + D(qemu_log("ethlite packet is too big, size=%x\n", size));
> + return -1;
> + }
> memcpy(&s->regs[rxbase + R_RX_BUF0], buf, size);
>
> s->regs[rxbase + R_RX_CTRL0] |= CTRL_S;
Applied, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-08-09 7:27 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-09 3:52 [Qemu-trivial] [PATCH] hw/net: Fix a heap overflow in xlnx.xps-ethernetlite chaojianhu
2016-08-09 7:26 ` Jason Wang
-- strict thread matches above, loose matches on Subject: below --
2016-08-09 2:24 chaojianhu
2016-08-09 3:51 ` Jason Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).