cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
9ae3a8
From 9ea892729b9c77eaf7b923da8a3e370dbb022e6e Mon Sep 17 00:00:00 2001
9ae3a8
From: Kevin Wolf <kwolf@redhat.com>
9ae3a8
Date: Thu, 26 Jul 2018 16:24:48 +0200
9ae3a8
Subject: [PATCH 6/8] multiboot: Check validity of mh_header_addr
9ae3a8
9ae3a8
RH-Author: Kevin Wolf <kwolf@redhat.com>
9ae3a8
Message-id: <20180726162448.22072-7-kwolf@redhat.com>
9ae3a8
Patchwork-id: 81515
9ae3a8
O-Subject: [RHEL-7.6/7.5.z qemu-kvm PATCH 6/6] multiboot: Check validity of mh_header_addr
9ae3a8
Bugzilla: 1549822
9ae3a8
RH-Acked-by: John Snow <jsnow@redhat.com>
9ae3a8
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
9ae3a8
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
9ae3a8
I couldn't find a case where this prevents something bad from happening
9ae3a8
that isn't already caught by other checks, but let's err on the safe
9ae3a8
side and check that mh_header_addr is as expected.
9ae3a8
9ae3a8
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
9ae3a8
Reviewed-by: Jack Schwartz <jack.schwartz@oracle.com>
9ae3a8
(cherry picked from commit dbf2dce7aabb7723542bd182175904846d70b0f9)
9ae3a8
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
9ae3a8
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
9ae3a8
---
9ae3a8
 hw/i386/multiboot.c | 4 ++++
9ae3a8
 1 file changed, 4 insertions(+)
9ae3a8
9ae3a8
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
9ae3a8
index 6f489a5..e1f6e56 100644
9ae3a8
--- a/hw/i386/multiboot.c
9ae3a8
+++ b/hw/i386/multiboot.c
9ae3a8
@@ -208,6 +208,10 @@ int load_multiboot(FWCfgState *fw_cfg,
9ae3a8
             error_report("invalid load_addr address");
9ae3a8
             exit(1);
9ae3a8
         }
9ae3a8
+        if (mh_header_addr - mh_load_addr > i) {
9ae3a8
+            error_report("invalid header_addr address");
9ae3a8
+            exit(1);
9ae3a8
+        }
9ae3a8
 
9ae3a8
         uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
9ae3a8
         uint32_t mb_load_size = 0;
9ae3a8
-- 
9ae3a8
1.8.3.1
9ae3a8