5a0f88db96
Fix CVE-2013-4148 (bnc#864812), CVE-2013-4149 (bnc#864649), CVE-2013-4150 (bnc#864650), CVE-2013-4151 (bnc#864653), CVE-2013-4526 (bnc#864671), CVE-2013-4527 (bnc#864673), CVE-2013-4529 (bnc#864678), CVE-2013-4530 (bnc#864682), CVE-2013-4531 (bnc#864796), CVE-2013-4533 (bnc#864655), CVE-2013-4534 (bnc#864811), CVE-2013-4535 / CVE-2013-4536 (bnc#864665), CVE-2013-4537 (bnc#864391), CVE-2013-4538 (bnc#864769), CVE-2013-4539 (bnc#864805), CVE-2013-4540 (bnc#864801), CVE-2013-4541 (bnc#864802), CVE-2013-4542 (bnc#864804), CVE-2013-6399 (bnc#864814), CVE-2014-0182 (bnc#874788) OBS-URL: https://build.opensuse.org/request/show/235280 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=211
83 lines
2.7 KiB
Diff
83 lines
2.7 KiB
Diff
From fb4795c3470c9258f96324a7e49fabf33ae1b98b Mon Sep 17 00:00:00 2001
|
|
From: "Michael S. Tsirkin" <mst@redhat.com>
|
|
Date: Thu, 3 Apr 2014 19:52:05 +0300
|
|
Subject: [PATCH] ssd0323: fix buffer overun on invalid state load
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
CVE-2013-4538
|
|
|
|
s->cmd_len used as index in ssd0323_transfer() to store 32-bit field.
|
|
Possible this field might then be supplied by guest to overwrite a
|
|
return addr somewhere. Same for row/col fields, which are indicies into
|
|
framebuffer array.
|
|
|
|
To fix validate after load.
|
|
|
|
Additionally, validate that the row/col_start/end are within bounds;
|
|
otherwise the guest can provoke an overrun by either setting the _end
|
|
field so large that the row++ increments just walk off the end of the
|
|
array, or by setting the _start value to something bogus and then
|
|
letting the "we hit end of row" logic reset row to row_start.
|
|
|
|
For completeness, validate mode as well.
|
|
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
|
|
Signed-off-by: Juan Quintela <quintela@redhat.com>
|
|
(cherry picked from commit ead7a57df37d2187813a121308213f41591bd811)
|
|
[AF: BNC#864769]
|
|
Signed-off-by: Andreas Färber <afaerber@suse.de>
|
|
---
|
|
hw/display/ssd0323.c | 24 ++++++++++++++++++++++++
|
|
1 file changed, 24 insertions(+)
|
|
|
|
diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c
|
|
index 971152e..9727007 100644
|
|
--- a/hw/display/ssd0323.c
|
|
+++ b/hw/display/ssd0323.c
|
|
@@ -312,18 +312,42 @@ static int ssd0323_load(QEMUFile *f, void *opaque, int version_id)
|
|
return -EINVAL;
|
|
|
|
s->cmd_len = qemu_get_be32(f);
|
|
+ if (s->cmd_len < 0 || s->cmd_len > ARRAY_SIZE(s->cmd_data)) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->cmd = qemu_get_be32(f);
|
|
for (i = 0; i < 8; i++)
|
|
s->cmd_data[i] = qemu_get_be32(f);
|
|
s->row = qemu_get_be32(f);
|
|
+ if (s->row < 0 || s->row >= 80) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->row_start = qemu_get_be32(f);
|
|
+ if (s->row_start < 0 || s->row_start >= 80) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->row_end = qemu_get_be32(f);
|
|
+ if (s->row_end < 0 || s->row_end >= 80) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->col = qemu_get_be32(f);
|
|
+ if (s->col < 0 || s->col >= 64) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->col_start = qemu_get_be32(f);
|
|
+ if (s->col_start < 0 || s->col_start >= 64) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->col_end = qemu_get_be32(f);
|
|
+ if (s->col_end < 0 || s->col_end >= 64) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
s->redraw = qemu_get_be32(f);
|
|
s->remap = qemu_get_be32(f);
|
|
s->mode = qemu_get_be32(f);
|
|
+ if (s->mode != SSD0323_CMD && s->mode != SSD0323_DATA) {
|
|
+ return -EINVAL;
|
|
+ }
|
|
qemu_get_buffer(f, s->framebuffer, sizeof(s->framebuffer));
|
|
|
|
ss->cs = qemu_get_be32(f);
|