Peter Xu <[email protected]> writes: > Add an underflow check for the subtract of total RAMBlock size to make sure > it won't underflow. It should not happen in production systems but only if > the migration stream was hijacked, which is not a real concern since > migration channel is trusted. Still protect against it. > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4013 > Reported-by: Tristan Madani <[email protected]> > Signed-off-by: Peter Xu <[email protected]> > --- > migration/ram.c | 11 +++++++++-- > 1 file changed, 9 insertions(+), 2 deletions(-) > > diff --git a/migration/ram.c b/migration/ram.c > index 8918b2f03b..85feff578c 100644 > --- a/migration/ram.c > +++ b/migration/ram.c > @@ -4268,7 +4268,7 @@ static int parse_ramblocks(QEMUFile *f, ram_addr_t > total_ram_bytes) > int ret = 0; > > /* Synchronize RAM block list */ > - while (!ret && total_ram_bytes) { > + while (total_ram_bytes) { > RAMBlock *block; > char id[256]; > ram_addr_t length; > @@ -4285,8 +4285,15 @@ static int parse_ramblocks(QEMUFile *f, ram_addr_t > total_ram_bytes) > error_report("Unknown ramblock \"%s\", cannot accept " > "migration", id); > ret = -EINVAL; > + break; > + } > + > + if (usub64_overflow(total_ram_bytes, length, &total_ram_bytes)) { > + error_report("%s: RAMBlock '%s' size underflow total RAM size", > + __func__, block->idstr); > + ret = -EFAULT; > + break; > } > - total_ram_bytes -= length; > } > > return ret;
Reviewed-by: Fabiano Rosas <[email protected]>
