[Qemu-devel] [PATCH v4 21/30] ssd0323: fix buffer overun on invalid state load

["Michael S. Tsirkin" <mst@redhat.com>]

CVE-2013-4538

s->cmd_len used as index in ssd0323_transfer() to store 32-bit field.
Possible this field might then be supplied by guest to overwrite a
return addr somewhere. Same for row/col fields, which are indicies into
framebuffer array.

To fix validate after load.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/display/ssd0323.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c
index 971152e..b520c69 100644
--- a/hw/display/ssd0323.c
+++ b/hw/display/ssd0323.c
@@ -312,13 +312,22 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int version_id)
         return -EINVAL;
 
     s->cmd_len = qemu_get_be32(f);
+    if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) {
+        return -EINVAL;
+    }
     s->cmd = qemu_get_be32(f);
     for (i = 0; i < 8; i++)
         s->cmd_data[i] = qemu_get_be32(f);
     s->row = qemu_get_be32(f);
+    if (s->row < 0 || s->row >= 80 ) {
+        return -EINVAL;
+    }
     s->row_start = qemu_get_be32(f);
     s->row_end = qemu_get_be32(f);
     s->col = qemu_get_be32(f);
+    if (s->col < 0 || s->col >= 64 ) {
+        return -EINVAL;
+    }
     s->col_start = qemu_get_be32(f);
     s->col_end = qemu_get_be32(f);
     s->redraw = qemu_get_be32(f);
-- 
MST