diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2014-11-18 12:29:05 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2014-11-18 12:29:05 +0000 |
| commit | ea5b201a0acfb4c3029afd4e7999b4278e1351d4 (patch) | |
| tree | 135bed3afc90dde3d2d998ef6fc0f53de48ff373 | |
| parent | 444b1996cb3769d8636b223c281fb09ab89b7a31 (diff) | |
| parent | 0be839a2701369f669532ea5884c15bead1c6e08 (diff) | |
Merge remote-tracking branch 'remotes/amit-migration/tags/for-2.2' into staging
Fix for CVE-2014-7840, avoiding arbitrary qemu memory overwrite for
migration by Michael S. Tsirkin.
# gpg: Signature made Tue 18 Nov 2014 11:23:00 GMT using RSA key ID 854083B6
# gpg: Good signature from "Amit Shah <amit@amitshah.net>"
# gpg: aka "Amit Shah <amit@kernel.org>"
# gpg: aka "Amit Shah <amitshah@gmx.net>"
* remotes/amit-migration/tags/for-2.2:
migration: fix parameter validation on ram load
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | arch_init.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/arch_init.c b/arch_init.c index 88a5ba0837..593a990b6d 100644 --- a/arch_init.c +++ b/arch_init.c @@ -1006,7 +1006,7 @@ static inline void *host_from_stream_offset(QEMUFile *f, uint8_t len; if (flags & RAM_SAVE_FLAG_CONTINUE) { - if (!block) { + if (!block || block->length <= offset) { error_report("Ack, bad migration stream!"); return NULL; } @@ -1019,8 +1019,9 @@ static inline void *host_from_stream_offset(QEMUFile *f, id[len] = 0; QTAILQ_FOREACH(block, &ram_list.blocks, next) { - if (!strncmp(id, block->idstr, sizeof(id))) + if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) { return memory_region_get_ram_ptr(block->mr) + offset; + } } error_report("Can't find block %s!", id); |