From patchwork Sun Oct 11 13:48:41 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [2/2] multiboot: Limit number of multiboot modules Date: Sun, 11 Oct 2009 03:48:41 -0000 From: Adam Lackorzynski X-Patchwork-Id: 35700 Message-Id: <1255268921-5403-2-git-send-email-adam@os.inf.tu-dresden.de> To: qemu-devel@nongnu.org Cc: From: Adam Lackorzynski Add size checks to avoid overwriting the multiboot structure when too many modules are loaded. Signed-off-by: Adam Lackorzynski Acked-by: Kevin Wolf --- hw/pc.c | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/hw/pc.c b/hw/pc.c index e34ad9c..b190d22 100644 --- a/hw/pc.c +++ b/hw/pc.c @@ -702,6 +702,10 @@ static int load_multiboot(void *fw_cfg, int mb_mod_count = 0; do { + if (mb_mod_info + 16 > mb_mod_cmdline) { + printf("WARNING: Too many modules loaded, aborting.\n"); + break; + } next_initrd = strchr(initrd_filename, ','); if (next_initrd) *next_initrd = '\0'; @@ -712,8 +716,11 @@ static int load_multiboot(void *fw_cfg, initrd_filename); stl_p(bootinfo + mb_mod_info + 8, mb_bootinfo + mb_mod_cmdline); /* string */ mb_mod_cmdline += strlen(initrd_filename) + 1; - if (mb_mod_cmdline > sizeof(bootinfo)) + if (mb_mod_cmdline > sizeof(bootinfo)) { mb_mod_cmdline = sizeof(bootinfo); + printf("WARNING: Too many module cmdlines loaded, aborting.\n"); + break; + } if ((next_space = strchr(initrd_filename, ' '))) *next_space = '\0'; #ifdef DEBUG_MULTIBOOT