From: Munkhbaatar Enkhbaatar <[email protected]> Prevents huge allocations and crashes caused by malformed HTIF signature addresses.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3205 Signed-off-by: Munkhbaatar Enkhbaatar <[email protected]> Reviewed-by: Alistair Francis <[email protected]> Message-ID: <[email protected]> [ Squashed with following commit to fix build failures hw/char/riscv_htif: Fix format specifier for uint64_t Message-ID: <[email protected]> Signed-off-by: Chao Liu <[email protected]> ] Tested-by: Tao Tang <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> Signed-off-by: Chao Liu <[email protected]> Signed-off-by: Alistair Francis <[email protected]> (cherry picked from commit 14808578ccbcd17d474c98bb53b60452888f8529) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c index ec5db5a597..e7328a596f 100644 --- a/hw/char/riscv_htif.c +++ b/hw/char/riscv_htif.c @@ -171,6 +171,12 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) * begin/end_signature symbols exist. */ if (sig_file && begin_sig_addr && end_sig_addr) { + if (end_sig_addr <= begin_sig_addr) { + error_report("Invalid HTIF signature range:" + " begin=0x%" PRIx64 " end=0x%" PRIx64, + begin_sig_addr, end_sig_addr); + return; + } uint64_t sig_len = end_sig_addr - begin_sig_addr; char *sig_data = g_malloc(sig_len); dma_memory_read(&address_space_memory, begin_sig_addr, -- 2.47.3
