diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2020-09-15 23:52:58 +0530 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2020-09-21 09:44:54 +0200 |
| commit | 1328fe0c32d5474604105b8105310e944976b058 (patch) | |
| tree | 8d26d8476365b01f0022b54db2b386b2869bd6cc /hw/ide/qdev.c | |
| parent | 26d56f489e68386844e33e558c26ecb67256e32d (diff) | |
| download | qemu-1328fe0c32d5474604105b8105310e944976b058.zip qemu-1328fe0c32d5474604105b8105310e944976b058.tar.gz qemu-1328fe0c32d5474604105b8105310e944976b058.tar.bz2 | |
hw: usb: hcd-ohci: check len and frame_number variables
While servicing the OHCI transfer descriptors(TD), OHCI host
controller derives variables 'start_addr', 'end_addr', 'len'
etc. from values supplied by the host controller driver.
Host controller driver may supply values such that using
above variables leads to out-of-bounds access issues.
Add checks to avoid them.
AddressSanitizer: stack-buffer-overflow on address 0x7ffd53af76a0
READ of size 2 at 0x7ffd53af76a0 thread T0
#0 ohci_service_iso_td ../hw/usb/hcd-ohci.c:734
#1 ohci_service_ed_list ../hw/usb/hcd-ohci.c:1180
#2 ohci_process_lists ../hw/usb/hcd-ohci.c:1214
#3 ohci_frame_boundary ../hw/usb/hcd-ohci.c:1257
#4 timerlist_run_timers ../util/qemu-timer.c:572
#5 qemu_clock_run_timers ../util/qemu-timer.c:586
#6 qemu_clock_run_all_timers ../util/qemu-timer.c:672
#7 main_loop_wait ../util/main-loop.c:527
#8 qemu_main_loop ../softmmu/vl.c:1676
#9 main ../softmmu/main.c:50
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Reported-by: Yongkang Jia <j_kangel@163.com>
Reported-by: Yi Ren <yunye.ry@alibaba-inc.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20200915182259.68522-2-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/ide/qdev.c')
0 files changed, 0 insertions, 0 deletions