mirror of https://gitlab.com/qemu-project/qemu
virtio-serial: fix heapover-flow
Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before get config->emerg_wr. It is neccessary because sizeof(virtio_console_config) is 8 byte if VirtIOSerial doesn't have the feature of VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize), read/write emerg_wr will lead to heap-over-flow. Signed-off-by: linzhecheng <linzhecheng@huawei.com> Message-Id: <20180328133435.20112-1-linzhecheng@huawei.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
parent
c2b01cfec1
commit
9f91022f28
|
@ -580,13 +580,16 @@ static void set_config(VirtIODevice *vdev, const uint8_t *config_data)
|
||||||
VirtIOSerial *vser = VIRTIO_SERIAL(vdev);
|
VirtIOSerial *vser = VIRTIO_SERIAL(vdev);
|
||||||
struct virtio_console_config *config =
|
struct virtio_console_config *config =
|
||||||
(struct virtio_console_config *)config_data;
|
(struct virtio_console_config *)config_data;
|
||||||
uint8_t emerg_wr_lo = le32_to_cpu(config->emerg_wr);
|
|
||||||
VirtIOSerialPort *port = find_first_connected_console(vser);
|
VirtIOSerialPort *port = find_first_connected_console(vser);
|
||||||
VirtIOSerialPortClass *vsc;
|
VirtIOSerialPortClass *vsc;
|
||||||
|
uint8_t emerg_wr_lo;
|
||||||
|
|
||||||
if (!config->emerg_wr) {
|
if (!virtio_has_feature(vser->host_features,
|
||||||
|
VIRTIO_CONSOLE_F_EMERG_WRITE) || !config->emerg_wr) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
emerg_wr_lo = le32_to_cpu(config->emerg_wr);
|
||||||
/* Make sure we don't misdetect an emergency write when the guest
|
/* Make sure we don't misdetect an emergency write when the guest
|
||||||
* does a short config write after an emergency write. */
|
* does a short config write after an emergency write. */
|
||||||
config->emerg_wr = 0;
|
config->emerg_wr = 0;
|
||||||
|
|
Loading…
Reference in New Issue