Define MAX_VCENTRY_SIZE(8KB) and CERT_BUF_MAX_LEN to establish a finite size for a single entry VCEntry. Add validation in update_cert_store() to ensure certificate data does not exceed this limit.
This finite size definition is needed for proper memory allocation and will be used in a later commit to handle VCEntry structures with known size constraints. Signed-off-by: Zhuoying Cai <[email protected]> Reviewed-by: Matthew Rosato <[email protected]> Reviewed-by: Eric Farman <[email protected]> --- hw/s390x/cert-store.c | 6 ++++++ include/hw/s390x/ipl/diag320.h | 3 +++ 2 files changed, 9 insertions(+) diff --git a/hw/s390x/cert-store.c b/hw/s390x/cert-store.c index c679406c2c..c086e75f75 100644 --- a/hw/s390x/cert-store.c +++ b/hw/s390x/cert-store.c @@ -91,6 +91,12 @@ static int update_cert_store(S390IPLCertificateStore *cert_store, cert_buf_size = ROUND_UP(cert->der_size, 4); data_buf_size = keyid_buf_size + hash_buf_size + cert_buf_size; + if (data_buf_size > CERT_BUF_MAX_LEN) { + error_report("Certificate data size %zu exceeds maximum buffer size %zu", + data_buf_size, CERT_BUF_MAX_LEN); + return -1; + } + if (cert_store->largest_cert_size < data_buf_size) { cert_store->largest_cert_size = data_buf_size; } diff --git a/include/hw/s390x/ipl/diag320.h b/include/hw/s390x/ipl/diag320.h index 7fda2d44fd..f3c23a3176 100644 --- a/include/hw/s390x/ipl/diag320.h +++ b/include/hw/s390x/ipl/diag320.h @@ -92,6 +92,9 @@ struct VCEntry { }; typedef struct VCEntry VCEntry; +#define MAX_VCENTRY_SIZE (8 * 1024) +#define CERT_BUF_MAX_LEN (MAX_VCENTRY_SIZE - sizeof(VCEntryHeader)) + struct VCBlockHeader { uint32_t in_len; uint32_t reserved0; -- 2.54.0
