From patchwork Mon Jan 15 15:13:11 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Aleksey Kuleshov X-Patchwork-Id: 860940 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=nongnu.org (client-ip=2001:4830:134:3::11; helo=lists.gnu.org; envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org; receiver=) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=yandex.ru header.i=@yandex.ru header.b="Mm7M2obo"; dkim-atps=neutral Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zKxj72qz1z9sBd for ; Tue, 16 Jan 2018 02:14:35 +1100 (AEDT) Received: from localhost ([::1]:41913 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eb6T3-00027t-9j for incoming@patchwork.ozlabs.org; Mon, 15 Jan 2018 10:14:33 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57341) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eb6Rp-0001WH-EH for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eb6Ro-0008H8-MU for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:17 -0500 Received: from forward104j.mail.yandex.net ([2a02:6b8:0:801:2::107]:33469) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eb6Ro-0008FB-Bc for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:16 -0500 Received: from mxback3o.mail.yandex.net (mxback3o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::1d]) by forward104j.mail.yandex.net (Yandex) with ESMTP id 59E7E42A1F for ; Mon, 15 Jan 2018 18:13:12 +0300 (MSK) Received: from web59g.yandex.ru (web59g.yandex.ru [2a02:6b8:0:1402::9d]) by mxback3o.mail.yandex.net (nwsmtp/Yandex) with ESMTP id LfoTLJmYSp-DB2G72WR; Mon, 15 Jan 2018 18:13:11 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1516029191; bh=D+7Z7sKDCf4j9LozuBXS6j4+Ga1hnYJ4nO+4vOa/2s8=; h=From:To:Subject:Message-Id:Date; b=Mm7M2oboJofVGcfEw1jJn8ti8dIy0VeJp8t7JGv7ElDCX8yqFMGf2nxW1FMVHN0nS +gJazGIbYJTaFCawJh3EZdmZGj9Hvwk+E55nNPjShoH05FxirWVXBPThuMSkYmDmec Vcupwl7+WWrdl9AXLSPYduqcnXndKouhh6YcRS34= Authentication-Results: mxback3o.mail.yandex.net; dkim=pass header.i=@yandex.ru Received: by web59g.yandex.ru with HTTP; Mon, 15 Jan 2018 18:13:11 +0300 From: Aleksey Kuleshov To: qemu-devel MIME-Version: 1.0 Message-Id: <4692971516029191@web59g.yandex.ru> X-Mailer: Yamail [ http://yandex.ru ] 5.0 Date: Mon, 15 Jan 2018 18:13:11 +0300 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2a02:6b8:0:801:2::107 Subject: [Qemu-devel] [PATCH] m25p80: prevent buffer overflow during erasing X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: "Qemu-devel" memset is not checked, so it's possible to go beyond the storage. Add checks and truncate requested length. Signed-off-by: Aleksey Kuleshov Acked-by: Marcin Krzemiński --- hw/block/m25p80.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c index ea142160b3..18ec501912 100644 --- a/hw/block/m25p80.c +++ b/hw/block/m25p80.c @@ -539,6 +539,8 @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd) uint32_t len; uint8_t capa_to_assert = 0; + assert(0 <= offset && offset < s->size); + switch (cmd) { case ERASE_4K: case ERASE4_4K: @@ -581,6 +583,14 @@ static void flash_erase(Flash *s, int offset, FlashCMD cmd) qemu_log_mask(LOG_GUEST_ERROR, "M25P80: erase with write protect!\n"); return; } + + if (offset + len > s->size) { + qemu_log_mask(LOG_GUEST_ERROR, + "M25P80: trying to erase beyond the flash size! " + "Truncating the length...\n"); + len = s->size - offset; + } + memset(s->storage + offset, 0xff, len); flash_sync_area(s, offset, len); }