[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 5/5] usb-mtp: Limit filename to object information si
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 5/5] usb-mtp: Limit filename to object information size |
Date: |
Fri, 14 Dec 2018 11:38:54 +0100 |
From: Michael Hanselmann <address@hidden>
The filename length in MTP metadata is specified by the guest. By
trusting it directly it'd theoretically be possible to get the host to
write memory parts outside the filename buffer into a filename. In
practice though there are usually NUL bytes stopping the string
operations.
Also use the opportunity to not assign the filename member twice.
Signed-off-by: Michael Hanselmann <address@hidden>
Message-id: address@hidden
[ kraxel: codestyle fix: break a long line ]
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/usb/dev-mtp.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 36c43b8c20..6098005cd4 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1710,7 +1710,7 @@ free:
s->write_pending = false;
}
-static void usb_mtp_write_metadata(MTPState *s)
+static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen)
{
MTPData *d = s->data_out;
ObjectInfo *dataset = (ObjectInfo *)d->data;
@@ -1722,7 +1722,9 @@ static void usb_mtp_write_metadata(MTPState *s)
assert(!s->write_pending);
assert(p != NULL);
- filename = utf16_to_str(dataset->length, dataset->filename);
+ filename = utf16_to_str(MIN(dataset->length,
+ dlen - offsetof(ObjectInfo, filename)),
+ dataset->filename);
if (strchr(filename, '/')) {
usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans,
@@ -1738,7 +1740,6 @@ static void usb_mtp_write_metadata(MTPState *s)
s->dataset.filename = filename;
s->dataset.format = dataset->format;
s->dataset.size = dataset->size;
- s->dataset.filename = filename;
s->write_pending = true;
if (s->dataset.format == FMT_ASSOCIATION) {
@@ -1807,7 +1808,7 @@ static void usb_mtp_get_data(MTPState *s, mtp_container
*container,
if (d->offset == d->length) {
/* The operation might have already failed */
if (!s->result) {
- usb_mtp_write_metadata(s);
+ usb_mtp_write_metadata(s, dlen);
}
usb_mtp_data_free(s->data_out);
s->data_out = NULL;
--
2.9.3
- [Qemu-devel] [PULL 0/5] Usb 20181214 patches, Gerd Hoffmann, 2018/12/14
- [Qemu-devel] [PULL 4/5] usb-mtp: use O_NOFOLLOW and O_CLOEXEC., Gerd Hoffmann, 2018/12/14
- [Qemu-devel] [PULL 1/5] pvusb: set max grants only in initialise, Gerd Hoffmann, 2018/12/14
- [Qemu-devel] [PULL 2/5] usb-host: reset and close libusb_device_handle before qemu exit, Gerd Hoffmann, 2018/12/14
- [Qemu-devel] [PULL 3/5] ehci: fix fetch qtd race, Gerd Hoffmann, 2018/12/14
- [Qemu-devel] [PULL 5/5] usb-mtp: Limit filename to object information size,
Gerd Hoffmann <=
- Re: [Qemu-devel] [PULL 0/5] Usb 20181214 patches, Peter Maydell, 2018/12/16