From b0ee78ff31617937f44161bde7515a67c88748c7 Mon Sep 17 00:00:00 2001 From: Li Qiang Date: Fri, 28 Jun 2019 09:13:58 -0700 Subject: [PATCH] virtio-gpu: check if the resource already exists in virtio_gpu_load() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While loading virtio-gpu, the data can be malicious, we should check if the resource already exists. Signed-off-by: Li Qiang Reviewed-by: Marc-André Lureau Message-id: 20190628161358.10400-1-liq3ea@163.com Signed-off-by: Gerd Hoffmann --- hw/display/virtio-gpu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 475a018c02..25d9e327fc 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, resource_id = qemu_get_be32(f); while (resource_id != 0) { + res = virtio_gpu_find_resource(g, resource_id); + if (res) { + return -EINVAL; + } + res = g_new0(struct virtio_gpu_simple_resource, 1); res->resource_id = resource_id; res->width = qemu_get_be32(f);