From: Kevin Wolf <kwolf@redhat.com>
Date: Wed, 14 Mar 2018 16:57:45 +0000 (+0100)
Subject: multiboot: Check validity of mh_header_addr
X-Git-Tag: qemu-xen-4.11.1^2~82
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=32ccaed1ae047d5d71b2d74b4cb8212e643f7d27;p=qemu-xen.git

multiboot: Check validity of mh_header_addr

I couldn't find a case where this prevents something bad from happening
that isn't already caught by other checks, but let's err on the safe
side and check that mh_header_addr is as expected.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Jack Schwartz <jack.schwartz@oracle.com>
(cherry picked from commit dbf2dce7aabb7723542bd182175904846d70b0f9)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 775aa5bfd0..36b22832cd 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -229,6 +229,10 @@ int load_multiboot(FWCfgState *fw_cfg,
             error_report("invalid load_addr address");
             exit(1);
         }
+        if (mh_header_addr - mh_load_addr > i) {
+            error_report("invalid header_addr address");
+            exit(1);
+        }
 
         uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
         uint32_t mb_load_size = 0;