From: "Daniel P. Berrangé" <berrange@redhat.com> To: qemu-devel@nongnu.org Cc: "Gerd Hoffmann" <kraxel@redhat.com>, "Bandan Das" <bsd@redhat.com>, "Thomas Huth" <thuth@redhat.com>, "Greg Kurz" <groug@kaod.org>, "Peter Maydell" <peter.maydell@linaro.org>, "Daniel P. Berrangé" <berrange@redhat.com> Subject: [Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename Date: Mon, 15 Apr 2019 16:45:02 +0100 [thread overview] Message-ID: <20190415154503.6758-3-berrange@redhat.com> (raw) In-Reply-To: <20190415154503.6758-1-berrange@redhat.com> The ObjectInfo struct has a variable length array containing the UTF-16 encoded filename. The number of characters of trailing data is given by the 'length' field in the struct and this must be validated against the size of the data packet received from the guest. Since the data is UTF-16, we must convert the byte count we have to a character count before validating. This must take care to truncate if a malicious guest sent an odd number of bytes. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- hw/usb/dev-mtp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 838cd74da6..6b7d1296e4 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1699,12 +1699,19 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) MTPObject *o; MTPObject *p = usb_mtp_object_lookup(s, s->dataset.parent_handle); uint32_t next_handle = s->next_handle; + size_t filename_chars = dlen - offsetof(ObjectInfo, filename); + + /* + * filename is utf-16. We're intentionally doing + * integer division to truncate if malicious guest + * sent an odd number of bytes. + */ + filename_chars /= 2; assert(!s->write_pending); assert(p != NULL); - filename = utf16_to_str(MIN(dataset->length, - dlen - offsetof(ObjectInfo, filename)), + filename = utf16_to_str(MIN(dataset->length, filename_chars), dataset->filename); if (strchr(filename, '/')) { -- 2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: "Daniel P. Berrangé" <berrange@redhat.com> To: qemu-devel@nongnu.org Cc: Peter Maydell <peter.maydell@linaro.org>, Thomas Huth <thuth@redhat.com>, Greg Kurz <groug@kaod.org>, Bandan Das <bsd@redhat.com>, Gerd Hoffmann <kraxel@redhat.com> Subject: [Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename Date: Mon, 15 Apr 2019 16:45:02 +0100 [thread overview] Message-ID: <20190415154503.6758-3-berrange@redhat.com> (raw) Message-ID: <20190415154502.32BdxZlbCsbBNZBdAH8j-FrWdc49J4M-zby-cSkTstE@z> (raw) In-Reply-To: <20190415154503.6758-1-berrange@redhat.com> The ObjectInfo struct has a variable length array containing the UTF-16 encoded filename. The number of characters of trailing data is given by the 'length' field in the struct and this must be validated against the size of the data packet received from the guest. Since the data is UTF-16, we must convert the byte count we have to a character count before validating. This must take care to truncate if a malicious guest sent an odd number of bytes. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> --- hw/usb/dev-mtp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 838cd74da6..6b7d1296e4 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1699,12 +1699,19 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) MTPObject *o; MTPObject *p = usb_mtp_object_lookup(s, s->dataset.parent_handle); uint32_t next_handle = s->next_handle; + size_t filename_chars = dlen - offsetof(ObjectInfo, filename); + + /* + * filename is utf-16. We're intentionally doing + * integer division to truncate if malicious guest + * sent an odd number of bytes. + */ + filename_chars /= 2; assert(!s->write_pending); assert(p != NULL); - filename = utf16_to_str(MIN(dataset->length, - dlen - offsetof(ObjectInfo, filename)), + filename = utf16_to_str(MIN(dataset->length, filename_chars), dataset->filename); if (strchr(filename, '/')) { -- 2.20.1
next prev parent reply other threads:[~2019-04-15 15:45 UTC|newest] Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-04-15 15:45 [Qemu-devel] [PATCH 0/3] usb-mtp: fix ObjectInfo request handling Daniel P. Berrangé 2019-04-15 15:45 ` Daniel P. Berrangé 2019-04-15 15:45 ` [Qemu-devel] [PATCH 1/3] usb-mtp: fix string length for filename when writing metadata Daniel P. Berrangé 2019-04-15 15:45 ` Daniel P. Berrangé 2019-04-15 17:02 ` Bandan Das 2019-04-15 17:02 ` Bandan Das 2019-04-15 15:45 ` Daniel P. Berrangé [this message] 2019-04-15 15:45 ` [Qemu-devel] [PATCH 2/3] usb-mtp: fix bounds check for guest provided filename Daniel P. Berrangé 2019-04-16 19:41 ` Bandan Das 2019-04-16 19:41 ` Bandan Das 2019-04-15 15:45 ` [Qemu-devel] [PATCH 3/3] usb-mtp: fix alignment of access of ObjectInfo filename field Daniel P. Berrangé 2019-04-15 15:45 ` Daniel P. Berrangé 2019-04-15 16:52 ` [Qemu-devel] [PATCH 0/3] usb-mtp: fix ObjectInfo request handling Bandan Das 2019-04-15 16:52 ` Bandan Das 2019-04-15 16:54 ` Daniel P. Berrangé 2019-04-15 16:54 ` Daniel P. Berrangé 2019-04-16 8:40 ` Daniel P. Berrangé 2019-04-16 8:40 ` Daniel P. Berrangé 2019-04-16 16:10 ` Bandan Das 2019-04-16 16:10 ` Bandan Das 2019-04-16 16:12 ` Daniel P. Berrangé 2019-04-16 16:12 ` Daniel P. Berrangé 2019-04-16 16:45 ` Bandan Das 2019-04-16 16:45 ` Bandan Das 2019-04-16 16:52 ` Daniel P. Berrangé 2019-04-16 16:52 ` Daniel P. Berrangé 2019-04-16 17:20 ` Bandan Das 2019-04-16 17:20 ` Bandan Das 2019-04-15 17:09 ` [Qemu-devel] [PATCH for-4.0? " Eric Blake 2019-04-15 17:09 ` Eric Blake 2019-04-15 17:18 ` Peter Maydell 2019-04-15 17:18 ` Peter Maydell 2019-04-16 8:48 ` Daniel P. Berrangé 2019-04-16 8:48 ` Daniel P. Berrangé 2019-04-16 13:35 ` [Qemu-devel] [PATCH " Peter Maydell 2019-04-16 13:35 ` Peter Maydell 2019-04-16 17:27 ` Peter Maydell 2019-04-16 17:27 ` Peter Maydell 2019-04-16 19:33 ` Peter Maydell 2019-04-16 19:33 ` Peter Maydell 2019-04-16 22:27 ` Peter Maydell 2019-04-16 22:27 ` Peter Maydell 2019-04-17 8:27 ` Gerd Hoffmann 2019-04-17 8:27 ` Gerd Hoffmann
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190415154503.6758-3-berrange@redhat.com \ --to=berrange@redhat.com \ --cc=bsd@redhat.com \ --cc=groug@kaod.org \ --cc=kraxel@redhat.com \ --cc=peter.maydell@linaro.org \ --cc=qemu-devel@nongnu.org \ --cc=thuth@redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.