Skip to contentSkip to conversation

usb: fix up post load checks

PATCH Applied Michael S. Tsirkin 2 participants 2 messages May 13, 2014 – May 14, 2014

lore
Share & tools
lore

Michael S. Tsirkin

author
#0 lore raw

PATCH v2 1/1 usb: fix up post load checks

Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow

First of the issues was reported by dgilbert.

Reported-by "Dr. David Alan Gilbert" <[email protected]>
Signed-off-by Michael S. Tsirkin <[email protected]>

---

changes from v1:
- drop state check
- lightly tested

 hw/usb/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
hw/usb/bus.c +2 -2
index e48b19f..ff1dfe6 100644
@@ -51,8 +51,8 @@ static int usb_device_post_load(void *opaque, int version_id)
     }
     if (dev->setup_index < 0 ||
         dev->setup_len < 0 ||
-        dev->setup_index >= sizeof(dev->data_buf) ||
-        dev->setup_len >= sizeof(dev->data_buf)) {
+        dev->setup_index > dev->setup_len ||
+        dev->setup_len > sizeof(dev->data_buf)) {
         return -EINVAL;
     }
     return 0;
Signature · 1 line
MST