51 lines
2.0 KiB
Diff
51 lines
2.0 KiB
Diff
|
From 7e1bd6e7e109c6228bc4c40ea6f2af2d7f281fca Mon Sep 17 00:00:00 2001
|
||
|
|
From: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
Date: Tue, 8 Apr 2025 05:59:29 -0400
|
||
|
|
Subject: [PATCH] hw/misc/aspeed_hace: Fix buffer overflow in has_padding
|
||
|
|
function
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
cheery-pick from 78877b2e06464f49f777e086845e094ea7bc82ef
|
||
|
|
|
||
|
|
The maximum padding size is either 64 or 128 bytes and should always be smaller
|
||
|
|
than "req_len". If "padding_size" exceeds "req_len", then
|
||
|
|
"req_len - padding_size" underflows due to "uint32_t" data type, leading to a
|
||
|
|
large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory
|
||
|
|
access, potentially leading to a buffer overflow.
|
||
|
|
|
||
|
|
Added a check to ensure "padding_size" does not exceed "req_len" before
|
||
|
|
computing "pad_offset". This prevents "req_len - padding_size" from underflowing
|
||
|
|
and avoids accessing invalid memory.
|
||
|
|
|
||
|
|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
|
||
|
|
Reviewed-by: Cédric Le Goater <clg@redhat.com>
|
||
|
|
Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ")
|
||
|
|
Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com
|
||
|
|
Signed-off-by: Cédric Le Goater <clg@redhat.com>
|
||
|
|
Signed-off-by: qihao_yewu <qihao_yewu@cmss.chinamobile.com>
|
||
|
|
---
|
||
|
|
hw/misc/aspeed_hace.c | 5 +++++
|
||
|
|
1 file changed, 5 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
|
||
|
|
index b07506ec04..8706e3d376 100644
|
||
|
|
--- a/hw/misc/aspeed_hace.c
|
||
|
|
+++ b/hw/misc/aspeed_hace.c
|
||
|
|
@@ -123,6 +123,11 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
|
||
|
|
if (*total_msg_len <= s->total_req_len) {
|
||
|
|
uint32_t padding_size = s->total_req_len - *total_msg_len;
|
||
|
|
uint8_t *padding = iov->iov_base;
|
||
|
|
+
|
||
|
|
+ if (padding_size > req_len) {
|
||
|
|
+ return false;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
*pad_offset = req_len - padding_size;
|
||
|
|
if (padding[*pad_offset] == 0x80) {
|
||
|
|
return true;
|
||
|
|
--
|
||
|
|
2.41.0.windows.1
|
||
|
|
|