diff options
| author | Kevin Wolf <kwolf@redhat.com> | 2018-03-14 17:57:45 +0100 |
|---|---|---|
| committer | Kevin Wolf <kwolf@redhat.com> | 2018-03-21 15:13:25 +0100 |
| commit | dbf2dce7aabb7723542bd182175904846d70b0f9 (patch) | |
| tree | 76fc2434242e81598e8d2a47189727f9f78050a9 | |
| parent | b17a9054a0652a1481be48a6729e972abf02412f (diff) | |
| download | qemu-dbf2dce7aabb7723542bd182175904846d70b0f9.zip qemu-dbf2dce7aabb7723542bd182175904846d70b0f9.tar.gz qemu-dbf2dce7aabb7723542bd182175904846d70b0f9.tar.bz2 | |
multiboot: Check validity of mh_header_addr
I couldn't find a case where this prevents something bad from happening
that isn't already caught by other checks, but let's err on the safe
side and check that mh_header_addr is as expected.
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Jack Schwartz <jack.schwartz@oracle.com>
| -rw-r--r-- | hw/i386/multiboot.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c index 1e215bf..5bc0a2c 100644 --- a/hw/i386/multiboot.c +++ b/hw/i386/multiboot.c @@ -229,6 +229,10 @@ int load_multiboot(FWCfgState *fw_cfg, error_report("invalid load_addr address"); exit(1); } + if (mh_header_addr - mh_load_addr > i) { + error_report("invalid header_addr address"); + exit(1); + } uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr); uint32_t mb_load_size = 0; |