From nobody Sun Nov 24 14:49:32 2024 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1722583118656314.7691973173861; Fri, 2 Aug 2024 00:18:38 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sZmYM-0000zO-SJ; Fri, 02 Aug 2024 03:18:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sZmYK-0000yD-SX for qemu-devel@nongnu.org; Fri, 02 Aug 2024 03:18:16 -0400 Received: from mailout04.t-online.de ([194.25.134.18]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sZmYI-0000V4-KM for qemu-devel@nongnu.org; Fri, 02 Aug 2024 03:18:16 -0400 Received: from fwd87.aul.t-online.de (fwd87.aul.t-online.de [10.223.144.113]) by mailout04.t-online.de (Postfix) with SMTP id 5ECCA1F10F; Fri, 2 Aug 2024 09:18:06 +0200 (CEST) Received: from linpower.localnet ([79.208.28.154]) by fwd87.t-online.de with (TLSv1.3:TLS_AES_256_GCM_SHA384 encrypted) esmtp id 1sZmY9-3pYbZp0; Fri, 2 Aug 2024 09:18:05 +0200 Received: by linpower.localnet (Postfix, from userid 1000) id 29AED200200; Fri, 2 Aug 2024 09:18:05 +0200 (CEST) From: =?UTF-8?q?Volker=20R=C3=BCmelin?= To: Gerd Hoffmann , Manos Pitsidianakis , "Michael S. Tsirkin" Cc: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Zheyu Ma , qemu-devel@nongnu.org Subject: [PATCH] hw/audio/virtio-snd: fix invalid param check Date: Fri, 2 Aug 2024 09:18:05 +0200 Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-TOI-EXPURGATEID: 150726::1722583085-467EC20D-16985D7C/0/0 CLEAN NORMAL X-TOI-MSGID: 19101feb-ea67-43a7-9b8e-1e58f4105566 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=194.25.134.18; envelope-from=volker.ruemelin@t-online.de; helo=mailout04.t-online.de X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1722583120648116600 Commit 9b6083465f ("virtio-snd: check for invalid param shift operands") tries to prevent invalid parameters specified by the guest. However, the code is not correct. Change the code so that the parameters format and rate, which are a bit numbers, are compared with the bit size of the data type. Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands") Signed-off-by: Volker R=C3=BCmelin Reviewed-by: Manos Pitsidianakis --- hw/audio/virtio-snd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index e5196aa4bb..d1cf5eb445 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s, error_report("Number of channels is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->format) > sizeof(supported_formats) || + if (params->format >=3D sizeof(supported_formats) * BITS_PER_BYTE || !(supported_formats & BIT(params->format))) { error_report("Stream format is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->rate) > sizeof(supported_rates) || + if (params->rate >=3D sizeof(supported_rates) * BITS_PER_BYTE || !(supported_rates & BIT(params->rate))) { error_report("Stream rate is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); --=20 2.35.3