aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPeter Maydell <peter.maydell@linaro.org>2014-11-18 12:29:05 +0000
committerPeter Maydell <peter.maydell@linaro.org>2014-11-18 12:29:05 +0000
commitea5b201a0acfb4c3029afd4e7999b4278e1351d4 (patch)
tree135bed3afc90dde3d2d998ef6fc0f53de48ff373
parent444b1996cb3769d8636b223c281fb09ab89b7a31 (diff)
parent0be839a2701369f669532ea5884c15bead1c6e08 (diff)
downloadqemu-arm-ea5b201a0acfb4c3029afd4e7999b4278e1351d4.tar.gz
Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.2' into staging
Fix for CVE-2014-7840, avoiding arbitrary qemu memory overwrite for migration by Michael S. Tsirkin. # gpg: Signature made Tue 18 Nov 2014 11:23:00 GMT using RSA key ID 854083B6 # gpg: Good signature from "Amit Shah <amit@amitshah.net>" # gpg: aka "Amit Shah <amit@kernel.org>" # gpg: aka "Amit Shah <amitshah@gmx.net>" * remotes/amit-migration/tags/for-2.2: migration: fix parameter validation on ram load Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-rw-r--r--arch_init.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/arch_init.c b/arch_init.c
index 88a5ba0837..593a990b6d 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -1006,7 +1006,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,
uint8_t len;
if (flags & RAM_SAVE_FLAG_CONTINUE) {
- if (!block) {
+ if (!block || block->length <= offset) {
error_report("Ack, bad migration stream!");
return NULL;
}
@@ -1019,8 +1019,9 @@ static inline void *host_from_stream_offset(QEMUFile *f,
id[len] = 0;
QTAILQ_FOREACH(block, &ram_list.blocks, next) {
- if (!strncmp(id, block->idstr, sizeof(id)))
+ if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) {
return memory_region_get_ram_ptr(block->mr) + offset;
+ }
}
error_report("Can't find block %s!", id);