* Michael S. Tsirkin (m...@redhat.com) wrote:
> CVE-2013-4527 hw/timer/hpet.c buffer overrun
>
> hpet is a VARRAY with a uint8 size but static array of 32
>
> To fix, make sure num_timers is valid using VMSTATE_TEST hook.
>
> Reported-by: Anthony Liguori <anth...@codemonkey.ws>
> Signed-off-by: Michael S. Tsirkin <m...@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilb...@redhat.com>
> ---
> hw/timer/hpet.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
> index 1ee0640..7303ade 100644
> --- a/hw/timer/hpet.c
> +++ b/hw/timer/hpet.c
> @@ -248,6 +248,18 @@ static int hpet_pre_load(void *opaque)
> return 0;
> }
>
> +static bool hpet_validate_num_timers(void *opaque, int version_id)
> +{
> + HPETState *s = opaque;
> +
> + if (s->num_timers < HPET_MIN_TIMERS) {
> + return false;
> + } else if (s->num_timers > HPET_MAX_TIMERS) {
> + return false;
> + }
> + return true;
> +}
> +
> static int hpet_post_load(void *opaque, int version_id)
> {
> HPETState *s = opaque;
> @@ -318,6 +330,7 @@ static const VMStateDescription vmstate_hpet = {
> VMSTATE_UINT64(isr, HPETState),
> VMSTATE_UINT64(hpet_counter, HPETState),
> VMSTATE_UINT8_V(num_timers, HPETState, 2),
> + VMSTATE_TEST("num_timers in range", hpet_validate_num_timers),
> VMSTATE_STRUCT_VARRAY_UINT8(timer, HPETState, num_timers, 0,
> vmstate_hpet_timer, HPETTimer),
> VMSTATE_END_OF_LIST()
> --
> MST
>
--
Dr. David Alan Gilbert / dgilb...@redhat.com / Manchester, UK
