From: Alistair Francis <[email protected]> It was possible that a guest could overflow the `doe_cap->write_mbox` buffer by writing more then PCI_DOE_DW_SIZE_MAX dwords. `doe_cap->write_mbox_len` would continue to increment and there were no bounds checks on the length when offsetting into doe_cap->write_mbox.
This patch adds a check and reports a guest error if we would overflow. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3679 Signed-off-by: Alistair Francis <[email protected]> --- hw/pci/pcie_doe.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/hw/pci/pcie_doe.c b/hw/pci/pcie_doe.c index 2210f86968..765ebea42c 100644 --- a/hw/pci/pcie_doe.c +++ b/hw/pci/pcie_doe.c @@ -356,8 +356,14 @@ void pcie_doe_write_config(DOECap *doe_cap, if (size != DWORD_BYTE) { return; } - doe_cap->write_mbox[doe_cap->write_mbox_len] = val; - doe_cap->write_mbox_len++; + if (doe_cap->write_mbox_len < PCI_DOE_DW_SIZE_MAX) { + doe_cap->write_mbox[doe_cap->write_mbox_len] = val; + doe_cap->write_mbox_len++; + } else { + qemu_log_mask(LOG_GUEST_ERROR, + "Mailbox write length (%d) is overflowing\n", + doe_cap->write_mbox_len); + } break; case PCI_EXP_DOE_CAP: /* fallthrough */ -- 2.54.0
