[PULL,2/4] virtio-gpu: check if the resource already exists in virtio_gpu_load()

Commit Message

Gerd Hoffmann July 3, 2019, 8:54 a.m. UTC

From: Li Qiang <[e-mail]>

While loading virtio-gpu, the data can be malicious, we
should check if the resource already exists.

Signed-off-by: Li Qiang <[e-mail]>
Reviewed-by: Marc-André Lureau <[e-mail]>
Message-id: [e-mail]
Signed-off-by: Gerd Hoffmann <[e-mail]>
---
 hw/display/virtio-gpu.c | 5 +++++
 1 file changed, 5 insertions(+)

Patch

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 475a018c027c..25d9e327fc69 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1002,6 +1002,11 @@  static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
 
     resource_id = qemu_get_be32(f);
     while (resource_id != 0) {
+        res = virtio_gpu_find_resource(g, resource_id);
+        if (res) {
+            return -EINVAL;
+        }
+
         res = g_new0(struct virtio_gpu_simple_resource, 1);
         res->resource_id = resource_id;
         res->width = qemu_get_be32(f);