hw/misc/aspeed_hace: Fix OOB read in has_padding()

[PATCH] hw/misc/aspeed_hace: Fix OOB read in has_padding()

Cédric Le Goater posted 1 patch 2 weeks, 4 days ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260908053101.1149625-1-clg@redhat.com

Maintainers: "Cédric Le Goater" <clg@kaod.org>, Peter Maydell <peter.maydell@linaro.org>, Steven Lee <steven_lee@aspeedtech.com>, Troy Lee <leetroy@gmail.com>, Jamin Lin <jamin_lin@aspeedtech.com>, Kane Chen <kane_chen@aspeedtech.com>, Andrew Jeffery <andrew@codeconstruct.com.au>, Joel Stanley <joel@jms.id.au>

hw/misc/aspeed_hace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Expand all Fold all

[PATCH] hw/misc/aspeed_hace: Fix OOB read in has_padding()

Posted by Cédric Le Goater 2 weeks, 4 days ago

When total_msg_len equals total_req_len, padding_size is 0, making
pad_offset equal to req_len. The subsequent padding[pad_offset] read
accesses one byte past the buffer. Return false early when
padding_size is zero.

Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Reported-by: Christopher Boker <Chris@cveasyai.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 8de05a9d98b3..bf8af710335d 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -225,7 +225,7 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
 
-        if (padding_size > req_len) {
+        if (padding_size == 0 || padding_size > req_len) {
             return false;
         }
 
-- 
2.55.0

RE: [PATCH] hw/misc/aspeed_hace: Fix OOB read in has_padding()

Posted by Jamin Lin 2 weeks, 4 days ago

> Subject: [PATCH] hw/misc/aspeed_hace: Fix OOB read in has_padding()
> 
> When total_msg_len equals total_req_len, padding_size is 0, making
> pad_offset equal to req_len. The subsequent padding[pad_offset] read
> accesses one byte past the buffer. Return false early when padding_size is zero.
> 
> Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
> Reported-by: Christopher Boker <Chris@cveasyai.com>
> Signed-off-by: Cédric Le Goater <clg@redhat.com>
> ---
>  hw/misc/aspeed_hace.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index
> 8de05a9d98b3..bf8af710335d 100644
> --- a/hw/misc/aspeed_hace.c
> +++ b/hw/misc/aspeed_hace.c
> @@ -225,7 +225,7 @@ static bool has_padding(AspeedHACEState *s, struct
> iovec *iov,
>          uint32_t padding_size = s->total_req_len - *total_msg_len;
>          uint8_t *padding = iov->iov_base;
> 
> -        if (padding_size > req_len) {
> +        if (padding_size == 0 || padding_size > req_len) {
>              return false;
>          }
> 
> --
> 2.55.0

Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>

Thanks,
Jamin