aboutsummaryrefslogtreecommitdiff
path: root/hw/input
diff options
context:
space:
mode:
authorMichael S. Tsirkin <mst@redhat.com>2014-04-03 19:52:09 +0300
committerMichael Roth <mdroth@linux.vnet.ibm.com>2014-07-20 22:05:55 -0500
commit894f179e8d206b8ef544ea3680c6b433e7a9e3f9 (patch)
tree665ef648cbc7266c55d4e54b3201e0f8cbb3ee47 /hw/input
parent2265c71b3548913becbd1f6427e715dbbe3b0d2e (diff)
tsc210x: fix buffer overrun on invalid state load
CVE-2013-4539 s->precision, nextprecision, function and nextfunction come from wire and are used as idx into resolution[] in TSC_CUT_RESOLUTION. Validate after load to avoid buffer overrun. Cc: Andreas Färber <afaerber@suse.de> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw/input')
-rw-r--r--hw/input/tsc210x.c12
1 files changed, 12 insertions, 0 deletions
diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c
index 485c9e5753..aa5b6886ea 100644
--- a/hw/input/tsc210x.c
+++ b/hw/input/tsc210x.c
@@ -1070,9 +1070,21 @@ static int tsc210x_load(QEMUFile *f, void *opaque, int version_id)
s->enabled = qemu_get_byte(f);
s->host_mode = qemu_get_byte(f);
s->function = qemu_get_byte(f);
+ if (s->function < 0 || s->function >= ARRAY_SIZE(mode_regs)) {
+ return -EINVAL;
+ }
s->nextfunction = qemu_get_byte(f);
+ if (s->nextfunction < 0 || s->nextfunction >= ARRAY_SIZE(mode_regs)) {
+ return -EINVAL;
+ }
s->precision = qemu_get_byte(f);
+ if (s->precision < 0 || s->precision >= ARRAY_SIZE(resolution)) {
+ return -EINVAL;
+ }
s->nextprecision = qemu_get_byte(f);
+ if (s->nextprecision < 0 || s->nextprecision >= ARRAY_SIZE(resolution)) {
+ return -EINVAL;
+ }
s->filter = qemu_get_byte(f);
s->pin_func = qemu_get_byte(f);
s->ref = qemu_get_byte(f);