| Message ID | 20190628161358.10400-1-liq3ea@163.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | virtio-gpu: check if the resource already exists in virtio_gpu_load() | expand |
On Fri, Jun 28, 2019 at 8:53 PM Li Qiang <liq3ea@163.com> wrote: > > While loading virtio-gpu, the data can be malicious, we > should check if the resource already exists. > > Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> > --- > hw/display/virtio-gpu.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c > index 2b0f66b1d6..f1ebed9959 100644 > --- a/hw/display/virtio-gpu.c > +++ b/hw/display/virtio-gpu.c > @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, > > resource_id = qemu_get_be32(f); > while (resource_id != 0) { > + res = virtio_gpu_find_resource(g, resource_id); > + if (res) { > + return -EINVAL; > + } > + > res = g_new0(struct virtio_gpu_simple_resource, 1); > res->resource_id = resource_id; > res->width = qemu_get_be32(f); > -- > 2.17.1 > > >
28.06.2019 19:13, Li Qiang wrote: > While loading virtio-gpu, the data can be malicious, we > should check if the resource already exists. > > Signed-off-by: Li Qiang <liq3ea@163.com> > --- > hw/display/virtio-gpu.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c > index 2b0f66b1d6..f1ebed9959 100644 > --- a/hw/display/virtio-gpu.c > +++ b/hw/display/virtio-gpu.c > @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, > > resource_id = qemu_get_be32(f); > while (resource_id != 0) { > + res = virtio_gpu_find_resource(g, resource_id); > + if (res) { > + return -EINVAL; EEXIST? /mjt
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 2b0f66b1d6..f1ebed9959 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, resource_id = qemu_get_be32(f); while (resource_id != 0) { + res = virtio_gpu_find_resource(g, resource_id); + if (res) { + return -EINVAL; + } + res = g_new0(struct virtio_gpu_simple_resource, 1); res->resource_id = resource_id; res->width = qemu_get_be32(f);
While loading virtio-gpu, the data can be malicious, we should check if the resource already exists. Signed-off-by: Li Qiang <liq3ea@163.com> --- hw/display/virtio-gpu.c | 5 +++++ 1 file changed, 5 insertions(+)