On Fri, Jun 28, 2019 at 8:53 PM Li Qiang <liq...@163.com> wrote:
>
> While loading virtio-gpu, the data can be malicious, we
> should check if the resource already exists.
>
> Signed-off-by: Li Qiang <liq...@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
> ---
> hw/display/virtio-gpu.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
> index 2b0f66b1d6..f1ebed9959 100644
> --- a/hw/display/virtio-gpu.c
> +++ b/hw/display/virtio-gpu.c
> @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque,
> size_t size,
>
> resource_id = qemu_get_be32(f);
> while (resource_id != 0) {
> + res = virtio_gpu_find_resource(g, resource_id);
> + if (res) {
> + return -EINVAL;
> + }
> +
> res = g_new0(struct virtio_gpu_simple_resource, 1);
> res->resource_id = resource_id;
> res->width = qemu_get_be32(f);
> --
> 2.17.1
>
>
>
--
Marc-André Lureau
