mirrors
/
qemu
mirror of https://gitlab.com/qemu-project/qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

usb-mtp: fix bounds check for guest provided filename 

The ObjectInfo struct has a variable length array containing the UTF-16
encoded filename. The number of characters of trailing data is given by
the 'length' field in the struct and this must be validated against the
size of the data packet received from the guest.

Since the data is UTF-16, we must convert the byte count we have to a
character count before validating. This must take care to truncate if
a malicious guest sent an odd number of bytes.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Bandan Das <bsd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Daniel P. Berrangé 2019-04-15 16:45:02 +01:00 committed by Peter Maydell
parent dbfc49b69a
commit 375cb86d9f
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hw/usb/dev-mtp.c
View File

@ -1699,12 +1699,19 @@ static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen)
MTPObject *o;
MTPObject *p = usb_mtp_object_lookup(s, s->dataset.parent_handle);
uint32_t next_handle = s->next_handle;
size_t filename_chars = dlen - offsetof(ObjectInfo, filename);
/*
* filename is utf-16. We're intentionally doing
* integer division to truncate if malicious guest
* sent an odd number of bytes.
*/
filename_chars /= 2;
assert(!s->write_pending);
assert(p != NULL);
filename = utf16_to_str(MIN(dataset->length,
dlen - offsetof(ObjectInfo, filename)),
filename = utf16_to_str(MIN(dataset->length, filename_chars),
dataset->filename);
if (strchr(filename, '/')) {