On 21/7/26 13:11, Laurent Vivier wrote:
rx_desc_len is migrated as a raw uint8_t from the stream in both
e1000e and igb, but it is a derived value that can be computed from
the register state. A crafted migration stream can set rx_desc_len
to an invalid value, causing a stack buffer overflow in
e1000e_write_packet_to_guest() which copies rx_desc_len bytes into
a 32-byte stack union.
Recalculate rx_desc_len from the register state in post_load,
ignoring the untrusted value from the stream.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3869
Laurent Vivier (2):
hw/net/e1000e: recalculate rx_desc_len on migration load
hw/net/igb: recalculate rx_desc_len on migration load
hw/net/e1000e_core.c | 2 ++
hw/net/igb_core.c | 2 ++
2 files changed, 4 insertions(+)
Series:
Reviewed-by: Philippe Mathieu-Daudé <[email protected]>
