hw/char/goldfish_tty: Fix signed data length

[PATCH] hw/char/goldfish_tty: Fix signed data length

Laurent Vivier posted 1 patch 1 month ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260827174403.610834-1-laurent@vivier.eu

Maintainers: Laurent Vivier <laurent@vivier.eu>, "Marc-André Lureau" <marcandre.lureau@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>

hw/char/goldfish_tty.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] hw/char/goldfish_tty: Fix signed data length

Posted by Laurent Vivier 1 month ago

The guest-controlled data_len register is uint32_t, but was copied into
a signed int. A value of 0xffffffff consequently became -1, allowing the
DMA transfer size to exceed the 128-byte stack buffer.

Use an unsigned length variable so that each transfer remains bounded by
GOLFISH_TTY_BUFFER_SIZE.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4245
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
---
 hw/char/goldfish_tty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/goldfish_tty.c b/hw/char/goldfish_tty.c
index 8e1e9228c78b..f64527f50a02 100644
--- a/hw/char/goldfish_tty.c
+++ b/hw/char/goldfish_tty.c
@@ -71,7 +71,7 @@ static void goldfish_tty_cmd(GoldfishTTYState *s, uint32_t cmd)
 {
     uint32_t to_copy;
     uint8_t data_out[GOLFISH_TTY_BUFFER_SIZE];
-    int len;
+    unsigned int len;
     uint64_t ptr;
 
     switch (cmd) {
-- 
2.55.0