From nobody Mon Apr 29 11:20:48 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1516029305164389.64345877347546; Mon, 15 Jan 2018 07:15:05 -0800 (PST) Received: from localhost ([::1]:41950 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eb6TY-0002UQ-ET for importer@patchew.org; Mon, 15 Jan 2018 10:15:04 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57341) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eb6Rp-0001WH-EH for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:21 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eb6Ro-0008H8-MU for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:17 -0500 Received: from forward104j.mail.yandex.net ([2a02:6b8:0:801:2::107]:33469) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eb6Ro-0008FB-Bc for qemu-devel@nongnu.org; Mon, 15 Jan 2018 10:13:16 -0500 Received: from mxback3o.mail.yandex.net (mxback3o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::1d]) by forward104j.mail.yandex.net (Yandex) with ESMTP id 59E7E42A1F for ; Mon, 15 Jan 2018 18:13:12 +0300 (MSK) Received: from web59g.yandex.ru (web59g.yandex.ru [2a02:6b8:0:1402::9d]) by mxback3o.mail.yandex.net (nwsmtp/Yandex) with ESMTP id LfoTLJmYSp-DB2G72WR; Mon, 15 Jan 2018 18:13:11 +0300 Received: by web59g.yandex.ru with HTTP; Mon, 15 Jan 2018 18:13:11 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1516029191; bh=D+7Z7sKDCf4j9LozuBXS6j4+Ga1hnYJ4nO+4vOa/2s8=; h=From:To:Subject:Message-Id:Date; b=Mm7M2oboJofVGcfEw1jJn8ti8dIy0VeJp8t7JGv7ElDCX8yqFMGf2nxW1FMVHN0nS +gJazGIbYJTaFCawJh3EZdmZGj9Hvwk+E55nNPjShoH05FxirWVXBPThuMSkYmDmec Vcupwl7+WWrdl9AXLSPYduqcnXndKouhh6YcRS34= Authentication-Results: mxback3o.mail.yandex.net; dkim=pass header.i=@yandex.ru From: Aleksey Kuleshov To: qemu-devel MIME-Version: 1.0 Message-Id: <4692971516029191@web59g.yandex.ru> X-Mailer: Yamail [ http://yandex.ru ] 5.0 Date: Mon, 15 Jan 2018 18:13:11 +0300 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2a02:6b8:0:801:2::107 Subject: [Qemu-devel] [PATCH] m25p80: prevent buffer overflow during erasing X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" memset is not checked, so it's possible to go beyond the storage. Add checks and truncate requested length. Signed-off-by: Aleksey Kuleshov Acked-by: Marcin Krzemi=C5=84ski --- hw/block/m25p80.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c index ea142160b3..18ec501912 100644 --- a/hw/block/m25p80.c +++ b/hw/block/m25p80.c @@ -539,6 +539,8 @@ static void flash_erase(Flash *s, int offset, FlashCMD = cmd) uint32_t len; uint8_t capa_to_assert =3D 0; =20 + assert(0 <=3D offset && offset < s->size); + switch (cmd) { case ERASE_4K: case ERASE4_4K: @@ -581,6 +583,14 @@ static void flash_erase(Flash *s, int offset, FlashCMD= cmd) qemu_log_mask(LOG_GUEST_ERROR, "M25P80: erase with write protect!\= n"); return; } + + if (offset + len > s->size) { + qemu_log_mask(LOG_GUEST_ERROR, + "M25P80: trying to erase beyond the flash size= ! " + "Truncating the length...\n"); + len =3D s->size - offset; + } + memset(s->storage + offset, 0xff, len); flash_sync_area(s, offset, len); } --=20 2.11.0