From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53022) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WUWKm-0008Gv-Mu for qemu-devel@nongnu.org; Mon, 31 Mar 2014 03:08:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WUWKi-0003sW-22 for qemu-devel@nongnu.org; Mon, 31 Mar 2014 03:08:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40228) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WUWKh-0003sA-QO for qemu-devel@nongnu.org; Mon, 31 Mar 2014 03:08:35 -0400 From: Stefan Hajnoczi Date: Mon, 31 Mar 2014 09:08:11 +0200 Message-Id: <1396249691-29990-3-git-send-email-stefanha@redhat.com> In-Reply-To: <1396249691-29990-1-git-send-email-stefanha@redhat.com> References: <1396249691-29990-1-git-send-email-stefanha@redhat.com> Subject: [Qemu-devel] [PATCH 2/2] ivshmem: validate incoming_posn value from server List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Cam Macdonell , Stefan Hajnoczi Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem server on the host sends invalid values. Cc: Cam Macdonell Reported-by: Sebastian Krahmer Signed-off-by: Stefan Hajnoczi --- hw/misc/ivshmem.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index 78363ce..25c22b7 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -383,6 +383,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn) if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { return; } + if (posn < 0 || posn > s->nb_peers) { + return; + } guest_curr_max = s->peers[posn].nb_eventfds; @@ -433,6 +436,12 @@ static void ivshmem_read(void *opaque, const uint8_t * buf, int size) } memcpy(&incoming_posn, buf, sizeof(long)); + + if (incoming_posn < -1) { + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); + return; + } + /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); -- 1.9.0