Check that tx_count, rx_count, and rx_wpos are within valid bounds after migration to prevent out-of-bounds memory access from a corrupted or malicious migration stream.
Reported-by: Pavee Hui <[email protected]> Fixes: 35548b06cf55 ("cadence_uart: initial version of device model") Signed-off-by: Marc-André Lureau <[email protected]> --- hw/char/cadence_uart.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index c790372e98fb..1a065e2429eb 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -586,6 +586,11 @@ static int cadence_uart_post_load(void *opaque, int version_id) { CadenceUARTState *s = opaque; + if (s->tx_count > CADENCE_UART_TX_FIFO_SIZE || + s->rx_count > CADENCE_UART_RX_FIFO_SIZE || + s->rx_wpos >= CADENCE_UART_RX_FIFO_SIZE) { + return -EINVAL; + } /* Ensure these two aren't invalid numbers */ if (s->r[R_BRGR] < 1 || s->r[R_BRGR] & ~0xFFFF || s->r[R_BDIV] <= 3 || s->r[R_BDIV] & ~0xFF) { -- 2.56.0.rc0.29.g47ce80527c56
