From nobody Fri May 17 07:47:12 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 16273168936393.7697267789578746; Mon, 26 Jul 2021 09:28:13 -0700 (PDT) Received: from localhost ([::1]:48886 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m83Se-0000aL-AC for importer@patchew.org; Mon, 26 Jul 2021 12:28:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39684) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m83Qc-0008G6-B6 for qemu-devel@nongnu.org; Mon, 26 Jul 2021 12:26:06 -0400 Received: from relay.felk.cvut.cz ([2001:718:2:1611:0:1:0:70]:34048) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m83QY-00081R-98 for qemu-devel@nongnu.org; Mon, 26 Jul 2021 12:26:06 -0400 Received: from cmp.felk.cvut.cz (haar.felk.cvut.cz [147.32.84.19]) by relay.felk.cvut.cz (8.15.2/8.15.2) with ESMTP id 16QGP1Wr095207; Mon, 26 Jul 2021 18:25:01 +0200 (CEST) (envelope-from pisa@cmp.felk.cvut.cz) Received: from haar.felk.cvut.cz (localhost [127.0.0.1]) by cmp.felk.cvut.cz (8.14.0/8.12.3/SuSE Linux 0.6) with ESMTP id 16QGP1UM028124; Mon, 26 Jul 2021 18:25:01 +0200 Received: (from pisa@localhost) by haar.felk.cvut.cz (8.14.0/8.13.7/Submit) id 16QGP0s5028121; Mon, 26 Jul 2021 18:25:00 +0200 From: Pavel Pisa To: qemu-devel@nongnu.org, Paolo Bonzini , Jason Wang Subject: [PATCH] hw/net/can: sja1000 fix buff2frame_bas for dlc out of std CAN 8 bytes Date: Mon, 26 Jul 2021 18:24:58 +0200 Message-Id: <20210726162458.26197-1-pisa@cmp.felk.cvut.cz> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FELK-MailScanner-Information: X-MailScanner-ID: 16QGP1Wr095207 X-FELK-MailScanner: Found to be clean X-FELK-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.099, required 6, BAYES_00 -0.50, KHOP_HELO_FCRDNS 0.40, SPF_HELO_NONE 0.00, SPF_NONE 0.00) X-FELK-MailScanner-From: pisa@cmp.felk.cvut.cz X-FELK-MailScanner-Watermark: 1627921504.37022@0ZgaExImNT6bN1EfnNZV6w Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: none client-ip=2001:718:2:1611:0:1:0:70; envelope-from=pisa@cmp.felk.cvut.cz; helo=relay.felk.cvut.cz X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Vikram Garhwal , Qiang Ning , Jiri Novak , Oliver Hartkopp , Jin-Yang , Ondrej Ille , Jan Charvat , Jan Kiszka , Pavel Pisa Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZM-MESSAGEID: 1627316897070100003 Content-Type: text/plain; charset="utf-8" Problem reported by openEuler fuzz-sig group. The buff2frame_bas function (hw\net\can\can_sja1000.c) infoleak(qemu5.x~qemu6.x) or stack-overflow(qemu 4.x). Reported-by: Qiang Ning Signed-off-by: Pavel Pisa --- hw/net/can/can_sja1000.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c index 42d2f99dfb..64e81bff58 100644 --- a/hw/net/can/can_sja1000.c +++ b/hw/net/can/can_sja1000.c @@ -311,6 +311,10 @@ static void buff2frame_bas(const uint8_t *buff, qemu_c= an_frame *frame) } frame->can_dlc =3D buff[1] & 0x0f; =20 + if (frame->can_dlc > 8) { + frame->can_dlc =3D 8; + } + for (i =3D 0; i < frame->can_dlc; i++) { frame->data[i] =3D buff[2 + i]; } --=20 2.20.1