Re: [Qemu-stable] [PATCH v5 09/24] hpet: fix buffer overrun on invalid state load

[Juan Quintela]

"Michael S. Tsirkin" <address@hidden> wrote:
> CVE-2013-4527 hw/timer/hpet.c buffer overrun
>
> hpet is a VARRAY with a uint8 size but static array of 32
>
> To fix, make sure num_timers is valid using VMSTATE_VALID hook.
>
> Reported-by: Anthony Liguori <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>
> Reviewed-by: Dr. David Alan Gilbert <address@hidden>


Ok, seing what you want to do with VMSTATE_VALIDATE.
Much better solution is add a ->validate() field, and use it in the
equivalent of LESS_EQUAL and rest of tests.

Will sent a patch.

Later, Juan.

> ---
>  hw/timer/hpet.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
> index e15d6bc..2792f89 100644
> --- a/hw/timer/hpet.c
> +++ b/hw/timer/hpet.c
> @@ -239,6 +239,18 @@ static int hpet_pre_load(void *opaque)
>      return 0;
>  }
>  
> +static bool hpet_validate_num_timers(void *opaque, int version_id)
> +{
> +    HPETState *s = opaque;
> +
> +    if (s->num_timers < HPET_MIN_TIMERS) {
> +        return false;
> +    } else if (s->num_timers > HPET_MAX_TIMERS) {
> +        return false;
> +    }
> +    return true;
> +}
> +
>  static int hpet_post_load(void *opaque, int version_id)
>  {
>      HPETState *s = opaque;
> @@ -307,6 +319,7 @@ static const VMStateDescription vmstate_hpet = {
>          VMSTATE_UINT64(isr, HPETState),
>          VMSTATE_UINT64(hpet_counter, HPETState),
>          VMSTATE_UINT8_V(num_timers, HPETState, 2),
> +        VMSTATE_VALIDATE("num_timers in range", hpet_validate_num_timers),
>          VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0,
>                                      vmstate_hpet_timer, HPETTimer),
>          VMSTATE_END_OF_LIST()