mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
5eb0b194e9
qemu/hw
History
Michael S. Tsirkin 5eb0b194e9 cadence_uart: bounds check write offset 
cadence_uart_init() initializes an I/O memory region of size 0x1000
bytes.  However in uart_write(), the 'offset' parameter (offset within
region) is divided by 4 and then used to index the array 'r' of size
CADENCE_UART_R_MAX which is much smaller: (0x48/4).  If 'offset>>=2'
exceeds CADENCE_UART_R_MAX, this will cause an out-of-bounds memory
write where the offset and the value are controlled by guest.

This will corrupt QEMU memory, in most situations this causes the vm to
crash.

Fix by checking the offset against the array size.

Cc: qemu-stable@nongnu.org
Reported-by: 李强 <liqiang6-s@360.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20160418100735.GA517@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-04-19 11:13:59 +01:00
..
9pfs util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
acpi Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
alpha util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
arm hw/arm/bcm2836: Wire up CPU timer interrupts correctly 2016-04-04 17:33:51 +01:00
audio Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
block Fix pflash migration 2016-04-15 17:27:34 +02:00
bt util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
char cadence_uart: bounds check write offset 2016-04-19 11:13:59 +01:00
core Sort the fw_cfg file list 2016-04-07 19:57:33 +03:00
cpu include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
cris util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
display virtio-gpu: block live migration 2016-04-11 12:36:34 +02:00
dma Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
gpio hw/gpio: Add the emulation of gpio_key 2016-03-30 17:27:22 +01:00
i2c i.MX: Add missing descriptions in devices. 2016-03-16 17:42:18 +00:00
i386 tpm: acpi: remove IRQ from TPM's CRS to make Windows not see conflict 2016-04-13 19:52:34 +03:00
ide ide: really restart pending and in-flight atapi dma 2016-04-12 18:48:15 -04:00
input virtio-input: support absolute axis config in pass-through 2016-04-13 17:26:12 +02:00
intc Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
ipack include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
ipmi include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
isa hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
lm32 util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
m68k hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
mem include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
microblaze util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
mips hw/mips/cps: enable ITU for multithreading processors 2016-03-30 09:14:00 +01:00
misc ivshmem: fix ivshmem-{plain,doorbell} crash without arg 2016-04-13 12:01:47 +02:00
moxie hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
net net: stellaris_enet: check packet length against receive buffer 2016-04-11 14:22:33 +01:00
nvram Sort the fw_cfg file list 2016-04-07 19:57:33 +03:00
openrisc hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
pci util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
pci-bridge hw/pci-bridge: Add missing unref in case register-bus fails 2016-04-07 19:57:33 +03:00
pci-host include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
pcmcia hw: Clean up includes 2016-01-29 15:07:25 +00:00
ppc ppc patch queue for 2016-04-08 2016-04-08 11:54:19 +01:00
s390x hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
scsi virtio: merge virtio_queue_aio_set_host_notifier_handler with virtio_queue_set_aio 2016-04-07 19:57:33 +03:00
sd Replaced get_tick_per_sec() by NANOSECONDS_PER_SECOND 2016-03-22 22:20:17 +01:00
sh4 hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
smbios include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
sparc util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
sparc64 util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
ssi hw: Clean up includes 2016-01-29 15:07:25 +00:00
timer hw/timer: Revert "hpet: inverse polarity when pin above ISA_NUM_IRQS" 2016-04-08 00:07:43 +02:00
tpm tpm: Fix write to file descriptor function 2016-04-13 19:52:34 +03:00
tricore hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
unicore32 hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
usb * Log filtering from Alex and Peter 2016-03-24 21:42:40 +00:00
vfio VFIO updates 2016-03-28 2016-03-29 17:39:41 +01:00
virtio hw/virtio/balloon: Replace TARGET_PAGE_SIZE with BALLOON_PAGE_SIZE 2016-04-14 16:44:42 +03:00
watchdog util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
xen util: move declarations out of qemu-common.h 2016-03-22 22:20:17 +01:00
xenpv
xtensa hw: explicitly include qemu-common.h and cpu.h 2016-03-22 22:20:17 +01:00
Makefile.objs