From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B1E3C4338F for ; Mon, 26 Jul 2021 16:28:07 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 6EB6C6056B for ; Mon, 26 Jul 2021 16:28:06 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 6EB6C6056B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=cmp.felk.cvut.cz Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=nongnu.org Received: from localhost ([::1]:48886 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m83SX-0000aL-H9 for qemu-devel@archiver.kernel.org; Mon, 26 Jul 2021 12:28:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39684) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m83Qc-0008G6-B6 for qemu-devel@nongnu.org; Mon, 26 Jul 2021 12:26:06 -0400 Received: from relay.felk.cvut.cz ([2001:718:2:1611:0:1:0:70]:34048) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m83QY-00081R-98 for qemu-devel@nongnu.org; Mon, 26 Jul 2021 12:26:06 -0400 Received: from cmp.felk.cvut.cz (haar.felk.cvut.cz [147.32.84.19]) by relay.felk.cvut.cz (8.15.2/8.15.2) with ESMTP id 16QGP1Wr095207; Mon, 26 Jul 2021 18:25:01 +0200 (CEST) (envelope-from pisa@cmp.felk.cvut.cz) Received: from haar.felk.cvut.cz (localhost [127.0.0.1]) by cmp.felk.cvut.cz (8.14.0/8.12.3/SuSE Linux 0.6) with ESMTP id 16QGP1UM028124; Mon, 26 Jul 2021 18:25:01 +0200 Received: (from pisa@localhost) by haar.felk.cvut.cz (8.14.0/8.13.7/Submit) id 16QGP0s5028121; Mon, 26 Jul 2021 18:25:00 +0200 From: Pavel Pisa To: qemu-devel@nongnu.org, Paolo Bonzini , Jason Wang Subject: [PATCH] hw/net/can: sja1000 fix buff2frame_bas for dlc out of std CAN 8 bytes Date: Mon, 26 Jul 2021 18:24:58 +0200 Message-Id: <20210726162458.26197-1-pisa@cmp.felk.cvut.cz> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-FELK-MailScanner-Information: X-MailScanner-ID: 16QGP1Wr095207 X-FELK-MailScanner: Found to be clean X-FELK-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.099, required 6, BAYES_00 -0.50, KHOP_HELO_FCRDNS 0.40, SPF_HELO_NONE 0.00, SPF_NONE 0.00) X-FELK-MailScanner-From: pisa@cmp.felk.cvut.cz X-FELK-MailScanner-Watermark: 1627921504.37022@0ZgaExImNT6bN1EfnNZV6w Received-SPF: none client-ip=2001:718:2:1611:0:1:0:70; envelope-from=pisa@cmp.felk.cvut.cz; helo=relay.felk.cvut.cz X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Vikram Garhwal , Qiang Ning , Jiri Novak , Oliver Hartkopp , Jin-Yang , Ondrej Ille , Jan Charvat , Jan Kiszka , Pavel Pisa Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" Problem reported by openEuler fuzz-sig group. The buff2frame_bas function (hw\net\can\can_sja1000.c) infoleak(qemu5.x~qemu6.x) or stack-overflow(qemu 4.x). Reported-by: Qiang Ning Signed-off-by: Pavel Pisa --- hw/net/can/can_sja1000.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c index 42d2f99dfb..64e81bff58 100644 --- a/hw/net/can/can_sja1000.c +++ b/hw/net/can/can_sja1000.c @@ -311,6 +311,10 @@ static void buff2frame_bas(const uint8_t *buff, qemu_can_frame *frame) } frame->can_dlc = buff[1] & 0x0f; + if (frame->can_dlc > 8) { + frame->can_dlc = 8; + } + for (i = 0; i < frame->can_dlc; i++) { frame->data[i] = buff[2 + i]; } -- 2.20.1