Received: from eggs.gnu.org ([2001:4830:134:3::10]:45267) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eDQsw-0006RE-FG for qemu-devel@nongnu.org; Sat, 11 Nov 2017 03:11:30 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eDQsv-0006fl-C4 for qemu-devel@nongnu.org; Sat, 11 Nov 2017 03:11:26 -0500 From: P J P Date: Sat, 11 Nov 2017 13:41:11 +0530 Message-Id: <20171111081111.32724-1-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH v1] highbank: validate register offset before access List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Qemu Developers Cc: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Moguofang , Peter Maydell , qemu-arm@nongnu.org, Shawn Guo , Rob Herring , Prasad J Pandit From: Prasad J Pandit An 'offset' parameter sent to highbank register r/w functions could be greater than number(NUM_REGS=0x200) of hb registers, leading to an OOB access issue. Add check to avoid it. Reported-by: Moguofang (Dennis mo) Signed-off-by: Prasad J Pandit --- hw/arm/highbank.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) Update: log error message(via qemu_log_mask) before returning -> https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg01914.html diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c index 354c6b25a8..8494dc6a48 100644 --- a/hw/arm/highbank.c +++ b/hw/arm/highbank.c @@ -34,6 +34,7 @@ #include "hw/ide/ahci.h" #include "hw/cpu/a9mpcore.h" #include "hw/cpu/a15mpcore.h" +#include "qemu/log.h" #define SMP_BOOT_ADDR 0x100 #define SMP_BOOT_REG 0x40 @@ -117,14 +118,26 @@ static void hb_regs_write(void *opaque, hwaddr offset, } } + if (offset / 4 >= NUM_REGS) { + qemu_log_mask(LOG_GUEST_ERROR, + "highbank: bad write offset 0x%x\n", (uint32_t)offset); + return; + } regs[offset/4] = value; } static uint64_t hb_regs_read(void *opaque, hwaddr offset, unsigned size) { + uint32_t value; uint32_t *regs = opaque; - uint32_t value = regs[offset/4]; + + if (offset / 4 >= NUM_REGS) { + qemu_log_mask(LOG_GUEST_ERROR, + "highbank: bad read offset 0x%x\n", (uint32_t)offset); + return 0; + } + value = regs[offset/4]; if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) { value |= 0x30000000; -- 2.13.6