The ADB_WRITEREG handler accesses buf[1] and buf[2] without
checking that enough data was provided, allowing out-of-bounds
reads from a short request buffer.
Add length checks before each access: require at least 2 bytes
before reading buf[1], and exactly 3 bytes for register 3 commands
that read buf[2].
Fixes: 77cb0f5aafc8 ("Split adb.c into adb.c, adb-mouse.c and adb-kbd.c")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/input/adb-kbd.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/hw/input/adb-kbd.c b/hw/input/adb-kbd.c
index ece51d5df72b..9d80a3849b77 100644
--- a/hw/input/adb-kbd.c
+++ b/hw/input/adb-kbd.c
@@ -241,12 +241,18 @@ static int adb_kbd_request(ADBDevice *d, uint8_t *obuf,
olen = 0;
switch (cmd) {
case ADB_WRITEREG:
+ if (len < 2) {
+ return 0;
+ }
trace_adb_device_kbd_writereg(reg, buf[1]);
switch (reg) {
case 2:
/* LED status */
break;
case 3:
+ if (len != 3) {
+ return 0;
+ }
switch (buf[2]) {
case ADB_CMD_SELF_TEST:
break;
--
2.56.0.rc0.29.g47ce80527c56
