htif: reject invalid signature ranges (end <= begin)

[PATCH] htif: reject invalid signature ranges (end <= begin)

heropd posted 1 patch 2 days, 8 hours ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20251127013621.66082-1-munkhuu0825@gmail.com

Maintainers: Palmer Dabbelt <palmer@dabbelt.com>, Alistair Francis <alistair.francis@wdc.com>, Weiwei Li <liwei1518@gmail.com>, Daniel Henrique Barboza <dbarboza@ventanamicro.com>, Liu Zhiwei <zhiwei_liu@linux.alibaba.com>, "Marc-André Lureau" <marcandre.lureau@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>

hw/char/riscv_htif.c | 5 +++++
1 file changed, 5 insertions(+)

Expand all Fold all

[PATCH] htif: reject invalid signature ranges (end <= begin)

Posted by heropd 2 days, 8 hours ago

From: Munkhbaatar Enkhbaatar <munkhuu0825@gmail.com>

Prevents huge allocations and crashes caused by malformed HTIF signature
addresses.
Fixes: link to issue #3205
---
 hw/char/riscv_htif.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index a78ea9b01c..aa205c84c0 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -170,6 +170,11 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
                  * begin/end_signature symbols exist.
                  */
                 if (sig_file && begin_sig_addr && end_sig_addr) {
+                    if (end_sig_addr <= begin_sig_addr) {
+                        error_report("Invalid HTIF signature range: begin=0x%llx end=0x%llx",
+                                    begin_sig_addr, end_sig_addr);
+                        return;
+                    }
                     uint64_t sig_len = end_sig_addr - begin_sig_addr;
                     char *sig_data = g_malloc(sig_len);
                     dma_memory_read(&address_space_memory, begin_sig_addr,
-- 
2.50.1 (Apple Git-155)