diff mbox series

[PULL,02/21] roms: assert if max rom size is less thanthe used size

Message ID 1557953433-19663-3-git-send-email-pbonzini@redhat.com
State New
Headers show
Series [PULL,01/21] hw/input: Add a CONFIG_PS2 switch for theps2.c file | expand

Commit Message

Paolo Bonzini May 15, 2019, 8:50 p.m. UTC 
From: Igor Mammedov <imammedo@redhat.com>

It would ensure that we would notice attempt to write beyond
the allocated buffer. In case of MemoryRegion backed ROM it's
the host buffer and the guest RAM otherwise.

assert can be triggered with:
  dd if=/dev/zero of=/tmp/blob bs=63k count=1
  qemu-system-x86_64 `for  i in {1..33}; do echo -n " -acpitable /tmp/blob"; done`

Fixes: (a1666142db acpi-build: make ROMs RAM blocks resizeable)

Reported-by: Wei Yang <richardw.yang@linux.intel.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <1554982098-336210-1-git-send-email-imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/loader.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Thomas Huth May 16, 2019, 12:40 p.m. UTC | #1 
On 15/05/2019 22.50, Paolo Bonzini wrote:
> From: Igor Mammedov <imammedo@redhat.com>
> 
> It would ensure that we would notice attempt to write beyond
> the allocated buffer. In case of MemoryRegion backed ROM it's
> the host buffer and the guest RAM otherwise.
> 
> assert can be triggered with:
>   dd if=/dev/zero of=/tmp/blob bs=63k count=1
>   qemu-system-x86_64 `for  i in {1..33}; do echo -n " -acpitable /tmp/blob"; done`

Sorry, but a user should normally never be able to trigger an assert,
even if passing lots of garbage to qemu via the command line. asserts
are for guarding against programming errors.

Could you please change this into a proper error message instead?

 Thanks,
  Thomas
diff mbox series

Patch

diff --git a/hw/core/loader.c b/hw/core/loader.c
index fe5cb24..a097bbe 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1025,6 +1025,7 @@  MemoryRegion *rom_add_blob(const char *name, const void *blob, size_t len,
     rom->addr     = addr;
     rom->romsize  = max_len ? max_len : len;
     rom->datasize = len;
+    g_assert(rom->romsize >= rom->datasize);
     rom->data     = g_malloc0(rom->datasize);
     memcpy(rom->data, blob, len);
     rom_insert(rom);