A malicious or corrupted migration stream can supply an out-of-range
queue head, queue length, or keyboard key count, leading to
out-of-bounds accesses after load.
Validate that s->head is within the queue bounds, that s->n does not
exceed QUEUE_LENGTH, and that s->kbd.keys stays within the key[] array
bounds before any post_load processing.
Fixes: ccd4ed065be4 ("hid: introduce hid vmstate macros")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/input/hid.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/input/hid.c b/hw/input/hid.c
index 0f28827554e3..5098497f41bb 100644
--- a/hw/input/hid.c
+++ b/hw/input/hid.c
@@ -547,6 +547,13 @@ static int hid_post_load(void *opaque, int version_id)
{
HIDState *s = opaque;
+ if (s->head >= QUEUE_LENGTH || s->n > QUEUE_LENGTH) {
+ return -EINVAL;
+ }
+ if (s->kind == HID_KEYBOARD &&
+ (s->kbd.keys < 0 || s->kbd.keys > ARRAY_SIZE(s->kbd.key))) {
+ return -EINVAL;
+ }
hid_set_next_idle(s);
if (s->n == QUEUE_LENGTH && (s->kind == HID_TABLET ||
--
2.56.0.rc0.29.g47ce80527c56
