From nobody Fri Nov 7 02:09:57 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1544784175112429.4762438713982; Fri, 14 Dec 2018 02:42:55 -0800 (PST) Received: from localhost ([::1]:60840 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXkvl-0002Rg-LS for importer@patchew.org; Fri, 14 Dec 2018 05:42:53 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34515) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXks3-0008TV-9X for qemu-devel@nongnu.org; Fri, 14 Dec 2018 05:39:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gXks0-00056H-DJ for qemu-devel@nongnu.org; Fri, 14 Dec 2018 05:39:03 -0500 Received: from mx1.redhat.com ([209.132.183.28]:49112) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gXks0-00055d-3x for qemu-devel@nongnu.org; Fri, 14 Dec 2018 05:39:00 -0500 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 28E87A8BB; Fri, 14 Dec 2018 10:38:59 +0000 (UTC) Received: from sirius.home.kraxel.org (ovpn-117-174.ams2.redhat.com [10.36.117.174]) by smtp.corp.redhat.com (Postfix) with ESMTP id A6A4B60639; Fri, 14 Dec 2018 10:38:58 +0000 (UTC) Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id DAE344F268; Fri, 14 Dec 2018 11:38:54 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Fri, 14 Dec 2018 11:38:54 +0100 Message-Id: <20181214103854.13820-6-kraxel@redhat.com> In-Reply-To: <20181214103854.13820-1-kraxel@redhat.com> References: <20181214103854.13820-1-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Fri, 14 Dec 2018 10:38:59 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 5/5] usb-mtp: Limit filename to object information size X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Hanselmann , Gerd Hoffmann Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" From: Michael Hanselmann The filename length in MTP metadata is specified by the guest. By trusting it directly it'd theoretically be possible to get the host to write memory parts outside the filename buffer into a filename. In practice though there are usually NUL bytes stopping the string operations. Also use the opportunity to not assign the filename member twice. Signed-off-by: Michael Hanselmann Message-id: ab70659d8d5c580bdf150a5f7d5cc60c8e374ffc.1544740018.git.public@= hansmi.ch [ kraxel: codestyle fix: break a long line ] Signed-off-by: Gerd Hoffmann --- hw/usb/dev-mtp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 36c43b8c20..6098005cd4 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1710,7 +1710,7 @@ free: s->write_pending =3D false; } =20 -static void usb_mtp_write_metadata(MTPState *s) +static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) { MTPData *d =3D s->data_out; ObjectInfo *dataset =3D (ObjectInfo *)d->data; @@ -1722,7 +1722,9 @@ static void usb_mtp_write_metadata(MTPState *s) assert(!s->write_pending); assert(p !=3D NULL); =20 - filename =3D utf16_to_str(dataset->length, dataset->filename); + filename =3D utf16_to_str(MIN(dataset->length, + dlen - offsetof(ObjectInfo, filename)), + dataset->filename); =20 if (strchr(filename, '/')) { usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans, @@ -1738,7 +1740,6 @@ static void usb_mtp_write_metadata(MTPState *s) s->dataset.filename =3D filename; s->dataset.format =3D dataset->format; s->dataset.size =3D dataset->size; - s->dataset.filename =3D filename; s->write_pending =3D true; =20 if (s->dataset.format =3D=3D FMT_ASSOCIATION) { @@ -1807,7 +1808,7 @@ static void usb_mtp_get_data(MTPState *s, mtp_contain= er *container, if (d->offset =3D=3D d->length) { /* The operation might have already failed */ if (!s->result) { - usb_mtp_write_metadata(s); + usb_mtp_write_metadata(s, dlen); } usb_mtp_data_free(s->data_out); s->data_out =3D NULL; --=20 2.9.3