Message ID | 1410799208-3250-3-git-send-email-afaerber@suse.de |
---|---|
State | New |
Headers | show |
On Mon, Sep 15, 2014 at 06:40:06PM +0200, Andreas Färber wrote: > From: Stefan Hajnoczi <stefanha@redhat.com> > > Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem > server on the host sends invalid values. > > Cc: Cam Macdonell <cam@cs.ualberta.ca> > Reported-by: Sebastian Krahmer <krahmer@suse.de> > Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> > [AF: Tighten upper bound check for posn in close_guest_eventfds()] > Cc: qemu-stable@nongnu.org > Signed-off-by: Andreas Färber <afaerber@suse.de> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> > --- > hw/misc/ivshmem.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c > index caeee1e..24f74f6 100644 > --- a/hw/misc/ivshmem.c > +++ b/hw/misc/ivshmem.c > @@ -389,6 +389,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn) > if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { > return; > } > + if (posn < 0 || posn >= s->nb_peers) { > + return; > + } > > guest_curr_max = s->peers[posn].nb_eventfds; > > @@ -455,6 +458,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) > } > } > > + if (incoming_posn < -1) { > + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); > + return; > + } > + > /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ > tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); > IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); > -- > 1.8.4.5
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index caeee1e..24f74f6 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -389,6 +389,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn) if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { return; } + if (posn < 0 || posn >= s->nb_peers) { + return; + } guest_curr_max = s->peers[posn].nb_eventfds; @@ -455,6 +458,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) } } + if (incoming_posn < -1) { + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); + return; + } + /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd);