+-- On Wed, 14 Dec 2016, P J P wrote --+
| From: Prasad J Pandit <p...@fedoraproject.org>
|
| Virtio GPU device while processing 'VIRTIO_GPU_CMD_GET_CAPSET'
| command, retrieves the maximum capabilities size to fill in the
| response object. It continues to fill in capabilities even if
| retrieved 'max_size' is zero(0), thus resulting in OOB access.
| Add check to avoid it.
|
| Reported-by: Zhenhao Hong <zhenhaoh...@gmail.com>
| Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
| ---
| hw/display/virtio-gpu-3d.c | 6 +++++-
| 1 file changed, 5 insertions(+), 1 deletion(-)
|
| diff --git a/hw/display/virtio-gpu-3d.c b/hw/display/virtio-gpu-3d.c
| index 758d33a..6ceeba3 100644
| --- a/hw/display/virtio-gpu-3d.c
| +++ b/hw/display/virtio-gpu-3d.c
| @@ -370,8 +370,12 @@ static void virgl_cmd_get_capset(VirtIOGPU *g,
|
| virgl_renderer_get_cap_set(gc.capset_id, &max_ver,
| &max_size);
| + if (!max_size) {
| + cmd->error = VIRTIO_GPU_RESP_ERR_INVALID_PARAMETER;
| + return;
| + }
| +
| resp = g_malloc(sizeof(*resp) + max_size);
| -
| resp->hdr.type = VIRTIO_GPU_RESP_OK_CAPSET;
| virgl_renderer_fill_caps(gc.capset_id,
| gc.capset_version,
|
Ping..!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
