xemu-project/xemu
1
0
Fork 0
mirror of https://github.com/xemu-project/xemu.git synced 2024-11-30 23:10:38 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hw/xen/xen_pt_graphics: Don't trust the BIOS ROM contents so much

Browse Source 
Coverity (CID 796599) points out that xen_pt_setup_vga() trusts
the rom->size field in the BIOS ROM from a PCI passthrough VGA
device, and uses it as an index into the memory which contains
the BIOS image. A corrupt BIOS ROM could therefore cause us to
index off the end of the buffer.

Check that the size is within bounds before we use it.

We are also trusting the pcioffset field, and assuming that
the whole rom_header is present; Coverity doesn't notice these,
but check them too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Anthony PERARD <anthony.perard@citrix.com>
Signed-off-by: Anthony PERARD <anthony.perard@citrix.com>
This commit is contained in:
Peter Maydell 2018-11-19 16:26:58 +00:00 committed by Anthony PERARD
parent 7260438b70
commit 6c4f984463
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hw/xen/xen_pt_graphics.c
View File

@ -185,8 +185,19 @@ void xen_pt_setup_vga(XenPCIPassthroughState *s, XenHostPCIDevice *dev,
return;
}
if (bios_size < sizeof(struct rom_header)) {
error_setg(errp, "VGA: VBIOS image corrupt (too small)");
return;
}
/* Currently we fixed this address as a primary. */
rom = (struct rom_header *)bios;
if (rom->pcioffset + sizeof(struct pci_data) > bios_size) {
error_setg(errp, "VGA: VBIOS image corrupt (bad pcioffset field)");
return;
}
pd = (void *)(bios + (unsigned char)rom->pcioffset);
/* We may need to fixup Device Identification. */
@ -194,6 +205,11 @@ void xen_pt_setup_vga(XenPCIPassthroughState *s, XenHostPCIDevice *dev,
pd->device = s->real_device.device_id;
len = rom->size * 512;
if (len > bios_size) {
error_setg(errp, "VGA: VBIOS image corrupt (bad size field)");
return;
}
/* Then adjust the bios checksum */
for (c = (char *)bios; c < ((char *)bios + len); c++) {
checksum += *c;