Commit ead7a57d authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Juan Quintela
Browse files

ssd0323: fix buffer overun on invalid state load 



CVE-2013-4538

s->cmd_len used as index in ssd0323_transfer() to store 32-bit field.
Possible this field might then be supplied by guest to overwrite a
return addr somewhere. Same for row/col fields, which are indicies into
framebuffer array.

To fix validate after load.

Additionally, validate that the row/col_start/end are within bounds;
otherwise the guest can provoke an overrun by either setting the _end
field so large that the row++ increments just walk off the end of the
array, or by setting the _start value to something bogus and then
letting the "we hit end of row" logic reset row to row_start.

For completeness, validate mode as well.

Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarJuan Quintela <quintela@redhat.com>
parent caa881ab

hw/display/ssd0323.c

+24 −0
Original line number Diff line number Diff line
@@ -312,18 +312,42 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int version_id) 
        return -EINVAL;



    s->cmd_len = qemu_get_be32(f);

    if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) {

        return -EINVAL;

    }

    s->cmd = qemu_get_be32(f);

    for (i = 0; i < 8; i++)

        s->cmd_data[i] = qemu_get_be32(f);

    s->row = qemu_get_be32(f);

    if (s->row < 0 || s->row >= 80) {

        return -EINVAL;

    }

    s->row_start = qemu_get_be32(f);

    if (s->row_start < 0 || s->row_start >= 80) {

        return -EINVAL;

    }

    s->row_end = qemu_get_be32(f);

    if (s->row_end < 0 || s->row_end >= 80) {

        return -EINVAL;

    }

    s->col = qemu_get_be32(f);

    if (s->col < 0 || s->col >= 64) {

        return -EINVAL;

    }

    s->col_start = qemu_get_be32(f);

    if (s->col_start < 0 || s->col_start >= 64) {

        return -EINVAL;

    }

    s->col_end = qemu_get_be32(f);

    if (s->col_end < 0 || s->col_end >= 64) {

        return -EINVAL;

    }

    s->redraw = qemu_get_be32(f);

    s->remap = qemu_get_be32(f);

    s->mode = qemu_get_be32(f);

    if (s->mode != SSD0323_CMD && s->mode != SSD0323_DATA) {

        return -EINVAL;

    }

    qemu_get_buffer(f, s->framebuffer, sizeof(s->framebuffer));



    ss->cs = qemu_get_be32(f);