From 363ba1c72fed4425e7917afc36722584aaeaad8a Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Mon, 15 Sep 2014 18:40:06 +0200 Subject: [PATCH] ivshmem: validate incoming_posn value from server MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem server on the host sends invalid values. Cc: Cam Macdonell Reported-by: Sebastian Krahmer Signed-off-by: Stefan Hajnoczi [AF: Tighten upper bound check for posn in close_guest_eventfds()] Cc: qemu-stable@nongnu.org Signed-off-by: Andreas Färber Reviewed-by: Michael S. Tsirkin Signed-off-by: Paolo Bonzini --- hw/misc/ivshmem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/misc/ivshmem.c b/hw/misc/ivshmem.c index caeee1ebf5..24f74f6f58 100644 --- a/hw/misc/ivshmem.c +++ b/hw/misc/ivshmem.c @@ -389,6 +389,9 @@ static void close_guest_eventfds(IVShmemState *s, int posn) if (!ivshmem_has_feature(s, IVSHMEM_IOEVENTFD)) { return; } + if (posn < 0 || posn >= s->nb_peers) { + return; + } guest_curr_max = s->peers[posn].nb_eventfds; @@ -455,6 +458,11 @@ static void ivshmem_read(void *opaque, const uint8_t *buf, int size) } } + if (incoming_posn < -1) { + IVSHMEM_DPRINTF("invalid incoming_posn %ld\n", incoming_posn); + return; + } + /* pick off s->server_chr->msgfd and store it, posn should accompany msg */ tmp_fd = qemu_chr_fe_get_msgfd(s->server_chr); IVSHMEM_DPRINTF("posn is %ld, fd is %d\n", incoming_posn, tmp_fd); -- 2.11.4.GIT