aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKevin Wolf <kwolf@redhat.com>2018-03-14 17:57:45 +0100
committerKevin Wolf <kwolf@redhat.com>2018-03-21 15:13:25 +0100
commitdbf2dce7aabb7723542bd182175904846d70b0f9 (patch)
tree76fc2434242e81598e8d2a47189727f9f78050a9
parentb17a9054a0652a1481be48a6729e972abf02412f (diff)
multiboot: Check validity of mh_header_addr
I couldn't find a case where this prevents something bad from happening that isn't already caught by other checks, but let's err on the safe side and check that mh_header_addr is as expected. Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Jack Schwartz <jack.schwartz@oracle.com>
-rw-r--r--hw/i386/multiboot.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 1e215bf8d3..5bc0a2cddb 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -229,6 +229,10 @@ int load_multiboot(FWCfgState *fw_cfg,
error_report("invalid load_addr address");
exit(1);
}
+ if (mh_header_addr - mh_load_addr > i) {
+ error_report("invalid header_addr address");
+ exit(1);
+ }
uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
uint32_t mb_load_size = 0;