From: Gerd Hoffmann <kraxel@redhat.com>
To: "Marc-André Lureau" <marcandre.lureau@redhat.com>
Cc: qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [PATCH] usbredir: fix buffer-overflow on vmload
Date: Wed, 14 Aug 2019 14:06:15 +0200 [thread overview]
Message-ID: <20190814120615.mmsvamz7d3bjgz3z@sirius.home.kraxel.org> (raw)
In-Reply-To: <20190807084048.4258-1-marcandre.lureau@redhat.com>
On Wed, Aug 07, 2019 at 12:40:48PM +0400, Marc-André Lureau wrote:
> If interface_count is NO_INTERFACE_INFO, let's not access the arrays
> out-of-bounds.
>
> ==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40
> READ of size 1 at 0x625000243930 thread T0
> #0 0x5642068086a7 in usbredir_check_bulk_receiving /home/elmarco/src/qemu/hw/usb/redirect.c:1503
> #1 0x56420681301c in usbredir_post_load /home/elmarco/src/qemu/hw/usb/redirect.c:2154
> #2 0x5642068a56c2 in vmstate_load_state /home/elmarco/src/qemu/migration/vmstate.c:168
> #3 0x56420688e2ac in vmstate_load /home/elmarco/src/qemu/migration/savevm.c:829
> #4 0x5642068980cb in qemu_loadvm_section_start_full /home/elmarco/src/qemu/migration/savevm.c:2211
> #5 0x564206899645 in qemu_loadvm_state_main /home/elmarco/src/qemu/migration/savevm.c:2395
> #6 0x5642068998cf in qemu_loadvm_state /home/elmarco/src/qemu/migration/savevm.c:2467
> #7 0x56420685f3e9 in process_incoming_migration_co /home/elmarco/src/qemu/migration/migration.c:449
> #8 0x564207106c47 in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:115
> #9 0x7f0c0604e37f (/lib64/libc.so.6+0x4d37f)
>
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Added to usb queue.
thanks,
Gerd
prev parent reply other threads:[~2019-08-14 12:07 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-07 8:40 [Qemu-devel] [PATCH] usbredir: fix buffer-overflow on vmload Marc-André Lureau
2019-08-07 11:21 ` Liam Merwick
2019-08-07 11:30 ` Li Qiang
2019-08-07 13:34 ` Philippe Mathieu-Daudé
2019-08-14 12:06 ` Gerd Hoffmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190814120615.mmsvamz7d3bjgz3z@sirius.home.kraxel.org \
--to=kraxel@redhat.com \
--cc=marcandre.lureau@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).