From 9201bb9a8c7cd3ba2382b7db5b2e40f603e61528 Mon Sep 17 00:00:00 2001 From: Alistair Francis Date: Tue, 6 Oct 2015 10:40:41 -0700 Subject: sdhci.c: Limit the maximum block size It is possible for the guest to set an invalid block size which is larger then the fifo_buffer[] array. This could cause a buffer overflow. To avoid this limit the maximum size of the blksize variable. Signed-off-by: Alistair Francis Reported-by: Intel Security ATR Reviewed-by: Stefan Hajnoczi Reviewed-by: Peter Crosthwaite Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com Suggested-by: Igor Mitsyanko Reported-by: Intel Security ATR Reviewed-by: Stefan Hajnoczi Signed-off-by: Stefan Hajnoczi --- hw/sd/sdhci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c index 7f9d814..7f73527 100644 --- a/hw/sd/sdhci.c +++ b/hw/sd/sdhci.c @@ -1009,6 +1009,16 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size) MASKED_WRITE(s->blksize, mask, value); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); } + + /* Limit block size to the maximum buffer size */ + if (extract32(s->blksize, 0, 12) > s->buf_maxsz) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Size 0x%x is larger than " \ + "the maximum buffer 0x%x", __func__, s->blksize, + s->buf_maxsz); + + s->blksize = deposit32(s->blksize, 0, 12, s->buf_maxsz); + } + break; case SDHC_ARGUMENT: MASKED_WRITE(s->argument, mask, value); -- cgit v1.1