hmp: fix sendkey out of bounds write (CVE-2015-8619)
When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.
Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 64ffbe04ea)
[BR: BSC#960334 CVE-2015-8619]
Signed-off-by: Bruce Rogers <brogers@suse.com>
Conflicts:
hmp.c
ui/input-legacy.c
This commit is contained in:
Wolfgang Bumiller
committed by
Bruce Rogers
Bruce Rogers
parent
63809d69ca
commit
64c69285c9
18
hmp.c
18
hmp.c
@@ -1476,21 +1476,18 @@ void hmp_send_key(Monitor *mon, const QDict *qdict)
|
||||
int has_hold_time = qdict_haskey(qdict, "hold-time");
|
||||
int hold_time = qdict_get_try_int(qdict, "hold-time", -1);
|
||||
Error *err = NULL;
|
||||
char keyname_buf[16];
|
||||
char *separator;
|
||||
int keyname_len;
|
||||
|
||||
while (1) {
|
||||
separator = strchr(keys, '-');
|
||||
keyname_len = separator ? separator - keys : strlen(keys);
|
||||
pstrcpy(keyname_buf, sizeof(keyname_buf), keys);
|
||||
|
||||
/* Be compatible with old interface, convert user inputted "<" */
|
||||
if (!strncmp(keyname_buf, "<", 1) && keyname_len == 1) {
|
||||
pstrcpy(keyname_buf, sizeof(keyname_buf), "less");
|
||||
if (keys[0] == '<' && keyname_len == 1) {
|
||||
keys = "less";
|
||||
keyname_len = 4;
|
||||
}
|
||||
keyname_buf[keyname_len] = 0;
|
||||
|
||||
keylist = g_malloc0(sizeof(*keylist));
|
||||
keylist->value = g_malloc0(sizeof(*keylist->value));
|
||||
@@ -1503,16 +1500,17 @@ void hmp_send_key(Monitor *mon, const QDict *qdict)
|
||||
}
|
||||
tmp = keylist;
|
||||
|
||||
if (strstart(keyname_buf, "0x", NULL)) {
|
||||
if (strstart(keys, "0x", NULL)) {
|
||||
char *endp;
|
||||
int value = strtoul(keyname_buf, &endp, 0);
|
||||
if (*endp != '\0') {
|
||||
int value = strtoul(keys, &endp, 0);
|
||||
assert(endp <= keys + keyname_len);
|
||||
if (endp != keys + keyname_len) {
|
||||
goto err_out;
|
||||
}
|
||||
keylist->value->kind = KEY_VALUE_KIND_NUMBER;
|
||||
keylist->value->number = value;
|
||||
} else {
|
||||
int idx = index_from_key(keyname_buf);
|
||||
int idx = index_from_key(keys, keyname_len);
|
||||
if (idx == Q_KEY_CODE_MAX) {
|
||||
goto err_out;
|
||||
}
|
||||
@@ -1534,7 +1532,7 @@ out:
|
||||
return;
|
||||
|
||||
err_out:
|
||||
monitor_printf(mon, "invalid parameter: %s\n", keyname_buf);
|
||||
monitor_printf(mon, "invalid parameter: %.*s\n", keyname_len, keys);
|
||||
goto out;
|
||||
}
|
||||
|
||||
|
||||
@@ -339,7 +339,7 @@ static inline int vnc_display_pw_expire(DisplayState *ds, time_t expires)
|
||||
void curses_display_init(DisplayState *ds, int full_screen);
|
||||
|
||||
/* input.c */
|
||||
int index_from_key(const char *key);
|
||||
int index_from_key(const char *key, size_t key_length);
|
||||
|
||||
/* gtk.c */
|
||||
void early_gtk_display_init(void);
|
||||
|
||||
@@ -60,12 +60,159 @@ static QTAILQ_HEAD(, QEMUPutLEDEntry) led_handlers =
|
||||
static QTAILQ_HEAD(, QEMUPutMouseEntry) mouse_handlers =
|
||||
QTAILQ_HEAD_INITIALIZER(mouse_handlers);
|
||||
|
||||
int index_from_key(const char *key)
|
||||
static const int key_defs[] = {
|
||||
[Q_KEY_CODE_SHIFT] = 0x2a,
|
||||
[Q_KEY_CODE_SHIFT_R] = 0x36,
|
||||
|
||||
[Q_KEY_CODE_ALT] = 0x38,
|
||||
[Q_KEY_CODE_ALT_R] = 0xb8,
|
||||
[Q_KEY_CODE_ALTGR] = 0x64,
|
||||
[Q_KEY_CODE_ALTGR_R] = 0xe4,
|
||||
[Q_KEY_CODE_CTRL] = 0x1d,
|
||||
[Q_KEY_CODE_CTRL_R] = 0x9d,
|
||||
|
||||
[Q_KEY_CODE_MENU] = 0xdd,
|
||||
|
||||
[Q_KEY_CODE_ESC] = 0x01,
|
||||
|
||||
[Q_KEY_CODE_1] = 0x02,
|
||||
[Q_KEY_CODE_2] = 0x03,
|
||||
[Q_KEY_CODE_3] = 0x04,
|
||||
[Q_KEY_CODE_4] = 0x05,
|
||||
[Q_KEY_CODE_5] = 0x06,
|
||||
[Q_KEY_CODE_6] = 0x07,
|
||||
[Q_KEY_CODE_7] = 0x08,
|
||||
[Q_KEY_CODE_8] = 0x09,
|
||||
[Q_KEY_CODE_9] = 0x0a,
|
||||
[Q_KEY_CODE_0] = 0x0b,
|
||||
[Q_KEY_CODE_MINUS] = 0x0c,
|
||||
[Q_KEY_CODE_EQUAL] = 0x0d,
|
||||
[Q_KEY_CODE_BACKSPACE] = 0x0e,
|
||||
|
||||
[Q_KEY_CODE_TAB] = 0x0f,
|
||||
[Q_KEY_CODE_Q] = 0x10,
|
||||
[Q_KEY_CODE_W] = 0x11,
|
||||
[Q_KEY_CODE_E] = 0x12,
|
||||
[Q_KEY_CODE_R] = 0x13,
|
||||
[Q_KEY_CODE_T] = 0x14,
|
||||
[Q_KEY_CODE_Y] = 0x15,
|
||||
[Q_KEY_CODE_U] = 0x16,
|
||||
[Q_KEY_CODE_I] = 0x17,
|
||||
[Q_KEY_CODE_O] = 0x18,
|
||||
[Q_KEY_CODE_P] = 0x19,
|
||||
[Q_KEY_CODE_BRACKET_LEFT] = 0x1a,
|
||||
[Q_KEY_CODE_BRACKET_RIGHT] = 0x1b,
|
||||
[Q_KEY_CODE_RET] = 0x1c,
|
||||
|
||||
[Q_KEY_CODE_A] = 0x1e,
|
||||
[Q_KEY_CODE_S] = 0x1f,
|
||||
[Q_KEY_CODE_D] = 0x20,
|
||||
[Q_KEY_CODE_F] = 0x21,
|
||||
[Q_KEY_CODE_G] = 0x22,
|
||||
[Q_KEY_CODE_H] = 0x23,
|
||||
[Q_KEY_CODE_J] = 0x24,
|
||||
[Q_KEY_CODE_K] = 0x25,
|
||||
[Q_KEY_CODE_L] = 0x26,
|
||||
[Q_KEY_CODE_SEMICOLON] = 0x27,
|
||||
[Q_KEY_CODE_APOSTROPHE] = 0x28,
|
||||
[Q_KEY_CODE_GRAVE_ACCENT] = 0x29,
|
||||
|
||||
[Q_KEY_CODE_BACKSLASH] = 0x2b,
|
||||
[Q_KEY_CODE_Z] = 0x2c,
|
||||
[Q_KEY_CODE_X] = 0x2d,
|
||||
[Q_KEY_CODE_C] = 0x2e,
|
||||
[Q_KEY_CODE_V] = 0x2f,
|
||||
[Q_KEY_CODE_B] = 0x30,
|
||||
[Q_KEY_CODE_N] = 0x31,
|
||||
[Q_KEY_CODE_M] = 0x32,
|
||||
[Q_KEY_CODE_COMMA] = 0x33,
|
||||
[Q_KEY_CODE_DOT] = 0x34,
|
||||
[Q_KEY_CODE_SLASH] = 0x35,
|
||||
|
||||
[Q_KEY_CODE_ASTERISK] = 0x37,
|
||||
|
||||
[Q_KEY_CODE_SPC] = 0x39,
|
||||
[Q_KEY_CODE_CAPS_LOCK] = 0x3a,
|
||||
[Q_KEY_CODE_F1] = 0x3b,
|
||||
[Q_KEY_CODE_F2] = 0x3c,
|
||||
[Q_KEY_CODE_F3] = 0x3d,
|
||||
[Q_KEY_CODE_F4] = 0x3e,
|
||||
[Q_KEY_CODE_F5] = 0x3f,
|
||||
[Q_KEY_CODE_F6] = 0x40,
|
||||
[Q_KEY_CODE_F7] = 0x41,
|
||||
[Q_KEY_CODE_F8] = 0x42,
|
||||
[Q_KEY_CODE_F9] = 0x43,
|
||||
[Q_KEY_CODE_F10] = 0x44,
|
||||
[Q_KEY_CODE_NUM_LOCK] = 0x45,
|
||||
[Q_KEY_CODE_SCROLL_LOCK] = 0x46,
|
||||
|
||||
[Q_KEY_CODE_KP_DIVIDE] = 0xb5,
|
||||
[Q_KEY_CODE_KP_MULTIPLY] = 0x37,
|
||||
[Q_KEY_CODE_KP_SUBTRACT] = 0x4a,
|
||||
[Q_KEY_CODE_KP_ADD] = 0x4e,
|
||||
[Q_KEY_CODE_KP_ENTER] = 0x9c,
|
||||
[Q_KEY_CODE_KP_DECIMAL] = 0x53,
|
||||
[Q_KEY_CODE_SYSRQ] = 0x54,
|
||||
|
||||
[Q_KEY_CODE_KP_0] = 0x52,
|
||||
[Q_KEY_CODE_KP_1] = 0x4f,
|
||||
[Q_KEY_CODE_KP_2] = 0x50,
|
||||
[Q_KEY_CODE_KP_3] = 0x51,
|
||||
[Q_KEY_CODE_KP_4] = 0x4b,
|
||||
[Q_KEY_CODE_KP_5] = 0x4c,
|
||||
[Q_KEY_CODE_KP_6] = 0x4d,
|
||||
[Q_KEY_CODE_KP_7] = 0x47,
|
||||
[Q_KEY_CODE_KP_8] = 0x48,
|
||||
[Q_KEY_CODE_KP_9] = 0x49,
|
||||
|
||||
[Q_KEY_CODE_LESS] = 0x56,
|
||||
|
||||
[Q_KEY_CODE_F11] = 0x57,
|
||||
[Q_KEY_CODE_F12] = 0x58,
|
||||
|
||||
[Q_KEY_CODE_PRINT] = 0xb7,
|
||||
|
||||
[Q_KEY_CODE_HOME] = 0xc7,
|
||||
[Q_KEY_CODE_PGUP] = 0xc9,
|
||||
[Q_KEY_CODE_PGDN] = 0xd1,
|
||||
[Q_KEY_CODE_END] = 0xcf,
|
||||
|
||||
[Q_KEY_CODE_LEFT] = 0xcb,
|
||||
[Q_KEY_CODE_UP] = 0xc8,
|
||||
[Q_KEY_CODE_DOWN] = 0xd0,
|
||||
[Q_KEY_CODE_RIGHT] = 0xcd,
|
||||
|
||||
[Q_KEY_CODE_INSERT] = 0xd2,
|
||||
[Q_KEY_CODE_DELETE] = 0xd3,
|
||||
#ifdef NEED_CPU_H
|
||||
#if defined(TARGET_SPARC) && !defined(TARGET_SPARC64)
|
||||
[Q_KEY_CODE_STOP] = 0xf0,
|
||||
[Q_KEY_CODE_AGAIN] = 0xf1,
|
||||
[Q_KEY_CODE_PROPS] = 0xf2,
|
||||
[Q_KEY_CODE_UNDO] = 0xf3,
|
||||
[Q_KEY_CODE_FRONT] = 0xf4,
|
||||
[Q_KEY_CODE_COPY] = 0xf5,
|
||||
[Q_KEY_CODE_OPEN] = 0xf6,
|
||||
[Q_KEY_CODE_PASTE] = 0xf7,
|
||||
[Q_KEY_CODE_FIND] = 0xf8,
|
||||
[Q_KEY_CODE_CUT] = 0xf9,
|
||||
[Q_KEY_CODE_LF] = 0xfa,
|
||||
[Q_KEY_CODE_HELP] = 0xfb,
|
||||
[Q_KEY_CODE_META_L] = 0xfc,
|
||||
[Q_KEY_CODE_META_R] = 0xfd,
|
||||
[Q_KEY_CODE_COMPOSE] = 0xfe,
|
||||
#endif
|
||||
#endif
|
||||
[Q_KEY_CODE_MAX] = 0,
|
||||
};
|
||||
|
||||
int index_from_key(const char *key, size_t key_length)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; QKeyCode_lookup[i] != NULL; i++) {
|
||||
if (!strcmp(key, QKeyCode_lookup[i])) {
|
||||
if (!strncmp(key, QKeyCode_lookup[i], key_length) &&
|
||||
!QKeyCode_lookup[i][key_length]) {
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user