From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42135) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VN3W7-0001P8-Lw for qemu-devel@nongnu.org; Fri, 20 Sep 2013 12:25:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VN3W2-0006kM-GL for qemu-devel@nongnu.org; Fri, 20 Sep 2013 12:25:15 -0400 Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 20 Sep 2013 18:24:45 +0200 Message-Id: <1379694292-1601-7-git-send-email-pbonzini@redhat.com> In-Reply-To: <1379694292-1601-1-git-send-email-pbonzini@redhat.com> References: <1379694292-1601-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 06/13] kvmvapic: Catch invalid ROM size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Jan Kiszka , qemu-stable@nongnu.org From: Jan Kiszka If not caught early, a zero-length ROM will cause a NULL-pointer access later on in patch_hypercalls when allocating a zero-length ROM copy and trying to read from it. CC: qemu-stable@nongnu.org Signed-off-by: Jan Kiszka Signed-off-by: Paolo Bonzini --- hw/i386/kvmvapic.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index d3a6fbe..c66fbf2 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -578,7 +578,7 @@ static int patch_hypercalls(VAPICROMState *s) * enable write access to the option ROM so that variables can be updated by * the guest. */ -static void vapic_map_rom_writable(VAPICROMState *s) +static int vapic_map_rom_writable(VAPICROMState *s) { hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; MemoryRegionSection section; @@ -599,6 +599,9 @@ static void vapic_map_rom_writable(VAPICROMState *s) /* read ROM size from RAM region */ ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; + if (rom_size == 0) { + return -1; + } s->rom_size = rom_size; /* We need to round to avoid creating subpages @@ -612,11 +615,15 @@ static void vapic_map_rom_writable(VAPICROMState *s) memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000); s->rom_mapped_writable = true; memory_region_unref(section.mr); + + return 0; } static int vapic_prepare(VAPICROMState *s) { - vapic_map_rom_writable(s); + if (vapic_map_rom_writable(s) < 0) { + return -1; + } if (patch_hypercalls(s) < 0) { return -1; -- 1.8.3.1