pl022: fix buffer overun on invalid state load
CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst@redhat.com Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
This commit is contained in:
parent
5f691ff91d
commit
d8d0a0bc7e
|
@ -240,11 +240,25 @@ static const MemoryRegionOps pl022_ops = {
|
||||||
.endianness = DEVICE_NATIVE_ENDIAN,
|
.endianness = DEVICE_NATIVE_ENDIAN,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
static int pl022_post_load(void *opaque, int version_id)
|
||||||
|
{
|
||||||
|
PL022State *s = opaque;
|
||||||
|
|
||||||
|
if (s->tx_fifo_head < 0 ||
|
||||||
|
s->tx_fifo_head >= ARRAY_SIZE(s->tx_fifo) ||
|
||||||
|
s->rx_fifo_head < 0 ||
|
||||||
|
s->rx_fifo_head >= ARRAY_SIZE(s->rx_fifo)) {
|
||||||
|
return -1;
|
||||||
|
}
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
static const VMStateDescription vmstate_pl022 = {
|
static const VMStateDescription vmstate_pl022 = {
|
||||||
.name = "pl022_ssp",
|
.name = "pl022_ssp",
|
||||||
.version_id = 1,
|
.version_id = 1,
|
||||||
.minimum_version_id = 1,
|
.minimum_version_id = 1,
|
||||||
.minimum_version_id_old = 1,
|
.minimum_version_id_old = 1,
|
||||||
|
.post_load = pl022_post_load,
|
||||||
.fields = (VMStateField[]) {
|
.fields = (VMStateField[]) {
|
||||||
VMSTATE_UINT32(cr0, PL022State),
|
VMSTATE_UINT32(cr0, PL022State),
|
||||||
VMSTATE_UINT32(cr1, PL022State),
|
VMSTATE_UINT32(cr1, PL022State),
|
||||||
|
|
Loading…
Reference in a new issue