1 From 94998eaa5ef06ba17ad12976ac84801033a28582 Mon Sep 17 00:00:00 2001
2 From: "Michael S. Tsirkin" <mst@redhat.com>
3 Date: Mon, 28 Apr 2014 16:08:23 +0300
4 Subject: [PATCH] virtio: validate config_len on load
6 Malformed input can have config_len in migration stream
7 exceed the array size allocated on destination, the
8 result will be heap overflow.
10 To fix, that config_len matches on both sides.
14 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
15 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
16 Signed-off-by: Juan Quintela <quintela@redhat.com>
20 v2: use %ix and %zx to print config_len values
21 Signed-off-by: Juan Quintela <quintela@redhat.com>
22 (cherry picked from commit a890a2f9137ac3cf5b607649e66a6f3a5512d8dc)
24 hw/virtio/virtio.c | 8 +++++++-
25 1 file changed, 7 insertions(+), 1 deletion(-)
27 diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
28 index a70169a..7f4e7ec 100644
29 --- a/hw/virtio/virtio.c
30 +++ b/hw/virtio/virtio.c
31 @@ -898,6 +898,7 @@ int virtio_set_features(VirtIODevice *vdev, uint32_t val)
32 int virtio_load(VirtIODevice *vdev, QEMUFile *f)
38 uint32_t supported_features;
39 @@ -924,7 +925,12 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f)
40 features, supported_features);
43 - vdev->config_len = qemu_get_be32(f);
44 + config_len = qemu_get_be32(f);
45 + if (config_len != vdev->config_len) {
46 + error_report("Unexpected config length 0x%x. Expected 0x%zx",
47 + config_len, vdev->config_len);
50 qemu_get_buffer(f, vdev->config, vdev->config_len);
52 num = qemu_get_be32(f);