From 7174e54cf14290233f4ae3e989ebc7b507636e77 Mon Sep 17 00:00:00 2001 From: Jan Kiszka Date: Mon, 30 Sep 2013 12:35:13 +0200 Subject: kvmvapic: Prevent reading beyond the end of guest RAM rom_state_paddr is guest provided (caller address of outw(VAPIC_PORT) + writen 16-bit value) and can be influenced to point beyond the end of the host memory backing the guest's RAM. Make sure we do not use this pointer to actually read beyond the limits. Reading arbitrary guest bytes is harmless, the guest kernel has to manage access to this I/O port anyway. Signed-off-by: Jan Kiszka Acked-by: Michael S. Tsirkin Signed-off-by: Gleb Natapov --- hw/i386/kvmvapic.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'hw/i386/kvmvapic.c') diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c index 1c2dbf59cf..2d876009fc 100644 --- a/hw/i386/kvmvapic.c +++ b/hw/i386/kvmvapic.c @@ -596,6 +596,9 @@ static int vapic_map_rom_writable(VAPICROMState *s) section = memory_region_find(as, 0, 1); /* read ROM size from RAM region */ + if (rom_paddr + 2 >= memory_region_size(section.mr)) { + return -1; + } ram = memory_region_get_ram_ptr(section.mr); rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; if (rom_size == 0) { -- cgit v1.2.1