diff options
| author | Alistair Francis <alistair.francis@xilinx.com> | 2015-10-06 10:40:41 -0700 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2015-10-12 11:17:45 +0100 |
| commit | 9201bb9a8c7cd3ba2382b7db5b2e40f603e61528 (patch) | |
| tree | 131b06da5d5ab464f77a00bd67704c0234989b2d /hw/sd | |
| parent | c84b31926f018af6fea2ab37a1fc47060b4bcfa1 (diff) | |
sdhci.c: Limit the maximum block size
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com
Suggested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'hw/sd')
| -rw-r--r-- | hw/sd/sdhci.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 7f9d814706..7f73527d44 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1009,6 +1009,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) MASKED_WRITE(s->blksize, mask, value); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); } + + /* Limit block size to the maximum buffer size */ + if (extract32(s->blksize, 0, 12) > s->buf_maxsz) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \ + "the maximum buffer 0x%x", __func__, s->blksize, + s->buf_maxsz); + + s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz); + } + break; case SDHC_ARGUMENT: MASKED_WRITE(s->argument, mask, value); |