diff options
| author | Wolfgang Bumiller <w.bumiller@proxmox.com> | 2016-01-13 09:09:58 +0100 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2016-03-22 17:38:16 -0500 |
| commit | 24fe899c3c9d5c4d2a156a26e08e905ab8e98384 (patch) | |
| tree | eedaf68b0e240fa9449ce5edaf71ef16924f0080 /ui | |
| parent | aaf4fb6afb4653c86059255811886a5c4ea271f3 (diff) | |
hmp: fix sendkey out of bounds write (CVE-2015-8619)
When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.
Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.
Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 64ffbe04eaafebf4045a3ace52a360c14959d196)
Conflicts:
hmp.c
*removed dependency on 7fb1cf16
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'ui')
| -rw-r--r-- | ui/input-legacy.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/ui/input-legacy.c b/ui/input-legacy.c index e0a39f08a5..3f28bbce6f 100644 --- a/ui/input-legacy.c +++ b/ui/input-legacy.c @@ -57,12 +57,13 @@ struct QEMUPutLEDEntry { static QTAILQ_HEAD(, QEMUPutLEDEntry) led_handlers = QTAILQ_HEAD_INITIALIZER(led_handlers); -int index_from_key(const char *key) +int index_from_key(const char *key, size_t key_length) { int i; for (i = 0; QKeyCode_lookup[i] != NULL; i++) { - if (!strcmp(key, QKeyCode_lookup[i])) { + if (!strncmp(key, QKeyCode_lookup[i], key_length) && + !QKeyCode_lookup[i][key_length]) { break; } } |