diff options
author | Stefan Hajnoczi <stefanha@redhat.com> | 2014-09-15 18:40:06 +0200 |
---|---|---|
committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-01-06 15:43:21 -0600 |
commit | 15905fde7bd40bc15173e77661981d462e6ca62b (patch) | |
tree | 0e5e934ebdfecbd59be4a9f8484c1bd0844af913 /hw | |
parent | f1a842948a20ea25fef1d0f842b115805b269c02 (diff) | |
download | qemu-15905fde7bd40bc15173e77661981d462e6ca62b.tar.gz |
ivshmem: validate incoming_posn value from server
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem
server on the host sends invalid values.
Cc: Cam Macdonell <cam@cs.ualberta.ca>
Reported-by: Sebastian Krahmer <krahmer@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
[AF: Tighten upper bound check for posn in close_guest_eventfds()]
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 363ba1c72fed4425e7917afc36722584aaeaad8a)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw')
-rw-r--r-- | hw/misc/ivshmem.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index 2a05961f4b..02e3dd9b2f 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -385,6 +385,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn) if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { return; } + if (posn < 0 || posn >= s->nb_peers) { + return; + } guest_curr_max = s->peers[posn].nb_eventfds; @@ -451,6 +454,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) } } + if (incoming_posn < -1) { + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); + return; + } + /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); |