[PATCH 1/2] sd: check bit number before setting card_status flag

From: P J P <ppandit@redhat.com>
To: "Philippe Mathieu-Daudé" <f4bug@amsat.org>
Cc: Alexander Bulekov <alxndr@bu.edu>,
	QEMU Developers <qemu-devel@nongnu.org>,
	Stefan Hajnoczi <stefanha@redhat.com>,
	Prasad J Pandit <pjp@fedoraproject.org>
Subject: [PATCH 1/2] sd: check bit number before setting card_status flag
Date: Wed, 20 May 2020 20:54:49 +0530	[thread overview]
Message-ID: <20200520152450.200362-2-ppandit@redhat.com> (raw)
In-Reply-To: <20200520152450.200362-1-ppandit@redhat.com>

From: Prasad J Pandit <pjp@fedoraproject.org>

SD card emulator sets 'sd->card_status' while performing block
write commands. While doing so, it tests the corresponding bit
derived from 's->data_start' address. This may lead to OOB access.
Add check to avoid it.

Reported-by: Alex <alxndr@bu.edu>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
 hw/sd/sd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 71a9af09ab..916e9fff58 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -802,7 +802,12 @@ static void sd_function_switch(SDState *sd, uint32_t arg)
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 {
-    return test_bit(sd_addr_to_wpnum(addr), sd->wp_groups);
+    uint64_t bit = sd_addr_to_wpnum(addr);
+
+    if (bit < sd->wpgrps_size) {
+        return test_bit(bit, sd->wp_groups);
+    }
+    return true;
 }
 
 static void sd_lock_command(SDState *sd)
-- 
2.26.2


