From 9ea892729b9c77eaf7b923da8a3e370dbb022e6e Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Thu, 26 Jul 2018 16:24:48 +0200 Subject: [PATCH 6/8] multiboot: Check validity of mh_header_addr RH-Author: Kevin Wolf Message-id: <20180726162448.22072-7-kwolf@redhat.com> Patchwork-id: 81515 O-Subject: [RHEL-7.6/7.5.z qemu-kvm PATCH 6/6] multiboot: Check validity of mh_header_addr Bugzilla: 1549822 RH-Acked-by: John Snow RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Miroslav Rezanina I couldn't find a case where this prevents something bad from happening that isn't already caught by other checks, but let's err on the safe side and check that mh_header_addr is as expected. Signed-off-by: Kevin Wolf Reviewed-by: Jack Schwartz (cherry picked from commit dbf2dce7aabb7723542bd182175904846d70b0f9) Signed-off-by: Kevin Wolf Signed-off-by: Miroslav Rezanina --- hw/i386/multiboot.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c index 6f489a5..e1f6e56 100644 --- a/hw/i386/multiboot.c +++ b/hw/i386/multiboot.c @@ -208,6 +208,10 @@ int load_multiboot(FWCfgState *fw_cfg, error_report("invalid load_addr address"); exit(1); } + if (mh_header_addr - mh_load_addr > i) { + error_report("invalid header_addr address"); + exit(1); + } uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr); uint32_t mb_load_size = 0; -- 1.8.3.1