From nobody Sun May 12 17:45:18 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1627562279188730.1432752166135; Thu, 29 Jul 2021 05:37:59 -0700 (PDT) Received: from localhost ([::1]:50604 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m95IT-00065O-Qi for importer@patchew.org; Thu, 29 Jul 2021 08:37:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:36768) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1m95FU-0004K0-RU; Thu, 29 Jul 2021 08:34:52 -0400 Received: from relay.felk.cvut.cz ([2001:718:2:1611:0:1:0:70]:30812) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1m95FS-0007fC-6V; Thu, 29 Jul 2021 08:34:52 -0400 Received: from cmp.felk.cvut.cz (haar.felk.cvut.cz [147.32.84.19]) by relay.felk.cvut.cz (8.15.2/8.15.2) with ESMTP id 16TCXu5e088617; Thu, 29 Jul 2021 14:33:56 +0200 (CEST) (envelope-from pisa@cmp.felk.cvut.cz) Received: from haar.felk.cvut.cz (localhost [127.0.0.1]) by cmp.felk.cvut.cz (8.14.0/8.12.3/SuSE Linux 0.6) with ESMTP id 16TCXtqh006610; Thu, 29 Jul 2021 14:33:55 +0200 Received: (from pisa@localhost) by haar.felk.cvut.cz (8.14.0/8.13.7/Submit) id 16TCXt6C006609; Thu, 29 Jul 2021 14:33:55 +0200 From: Pavel Pisa To: qemu-devel@nongnu.org, Paolo Bonzini , Jason Wang , Qiang Ning , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Subject: [PATCH v2] hw/net/can: sja1000 fix buff2frame_bas and buff2frame_pel when dlc is out of std CAN 8 bytes Date: Thu, 29 Jul 2021 14:33:27 +0200 Message-Id: <20210729123327.14650-1-pisa@cmp.felk.cvut.cz> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-FELK-MailScanner-Information: X-MailScanner-ID: 16TCXu5e088617 X-FELK-MailScanner: Found to be clean X-FELK-MailScanner-SpamCheck: not spam, SpamAssassin (not cached, score=-0.098, required 6, BAYES_00 -0.50, KHOP_HELO_FCRDNS 0.40, SPF_HELO_NONE 0.00, SPF_NONE 0.00) X-FELK-MailScanner-From: pisa@cmp.felk.cvut.cz X-FELK-MailScanner-Watermark: 1628166837.85924@BdDccHH9XTy5OQS5MPtL/A Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: none client-ip=2001:718:2:1611:0:1:0:70; envelope-from=pisa@cmp.felk.cvut.cz; helo=relay.felk.cvut.cz X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Pavel Pisa , qemu-stable@nongnu.org, Vikram Garhwal , Jan Charvat , Jin-Yang Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZM-MESSAGEID: 1627562280269100001 Content-Type: text/plain; charset="utf-8" Problem reported by openEuler fuzz-sig group. The buff2frame_bas function (hw\net\can\can_sja1000.c) infoleak(qemu5.x~qemu6.x) or stack-overflow(qemu 4.x). Reported-by: Qiang Ning Signed-off-by: Pavel Pisa Reviewed-by: Philippe Mathieu-Daud=C3=A9 --- hw/net/can/can_sja1000.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c index 42d2f99dfb..34eea684ce 100644 --- a/hw/net/can/can_sja1000.c +++ b/hw/net/can/can_sja1000.c @@ -275,6 +275,10 @@ static void buff2frame_pel(const uint8_t *buff, qemu_c= an_frame *frame) } frame->can_dlc =3D buff[0] & 0x0f; =20 + if (frame->can_dlc > 8) { + frame->can_dlc =3D 8; + } + if (buff[0] & 0x80) { /* Extended */ frame->can_id |=3D QEMU_CAN_EFF_FLAG; frame->can_id |=3D buff[1] << 21; /* ID.28~ID.21 */ @@ -311,6 +315,10 @@ static void buff2frame_bas(const uint8_t *buff, qemu_c= an_frame *frame) } frame->can_dlc =3D buff[1] & 0x0f; =20 + if (frame->can_dlc > 8) { + frame->can_dlc =3D 8; + } + for (i =3D 0; i < frame->can_dlc; i++) { frame->data[i] =3D buff[2 + i]; } --=20 2.20.1