From 8e789901f99e201cc7042f71941f192ab34e5235 Mon Sep 17 00:00:00 2001 From: "Michael S. Tsirkin" Date: Thu, 3 Apr 2014 19:52:25 +0300 Subject: [PATCH] usb: sanity check setup_index+setup_len in post_load CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann Signed-off-by: Michael S. Tsirkin Reviewed-by: Gerd Hoffmann Signed-off-by: Juan Quintela Signed-off-by: Stefano Stabellini --- hw/usb/bus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/usb/bus.c b/hw/usb/bus.c index 55d0edd5c..aaee451e9 100644 --- a/hw/usb/bus.c +++ b/hw/usb/bus.c @@ -46,6 +46,12 @@ static int usb_device_post_load(void *opaque, int version_id) } else { dev->attached = 1; } + if (dev->setup_index < 0 || + dev->setup_len < 0 || + dev->setup_index >= sizeof(dev->data_buf) || + dev->setup_len >= sizeof(dev->data_buf)) { + return -EINVAL; + } return 0; } -- 2.39.5