From patchwork Fri Aug 2 07:18:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Volker_R=C3=BCmelin?= X-Patchwork-Id: 13751180 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1DD1FC52D71 for ; Fri, 2 Aug 2024 07:18:38 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sZmYM-0000zO-SJ; Fri, 02 Aug 2024 03:18:18 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sZmYK-0000yD-SX for qemu-devel@nongnu.org; Fri, 02 Aug 2024 03:18:16 -0400 Received: from mailout04.t-online.de ([194.25.134.18]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sZmYI-0000V4-KM for qemu-devel@nongnu.org; Fri, 02 Aug 2024 03:18:16 -0400 Received: from fwd87.aul.t-online.de (fwd87.aul.t-online.de [10.223.144.113]) by mailout04.t-online.de (Postfix) with SMTP id 5ECCA1F10F; Fri, 2 Aug 2024 09:18:06 +0200 (CEST) Received: from linpower.localnet ([79.208.28.154]) by fwd87.t-online.de with (TLSv1.3:TLS_AES_256_GCM_SHA384 encrypted) esmtp id 1sZmY9-3pYbZp0; Fri, 2 Aug 2024 09:18:05 +0200 Received: by linpower.localnet (Postfix, from userid 1000) id 29AED200200; Fri, 2 Aug 2024 09:18:05 +0200 (CEST) From: =?utf-8?q?Volker_R=C3=BCmelin?= To: Gerd Hoffmann , Manos Pitsidianakis , "Michael S. Tsirkin" Cc: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , Zheyu Ma , qemu-devel@nongnu.org Subject: [PATCH] hw/audio/virtio-snd: fix invalid param check Date: Fri, 2 Aug 2024 09:18:05 +0200 Message-Id: <20240802071805.7123-1-vr_qemu@t-online.de> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 X-TOI-EXPURGATEID: 150726::1722583085-467EC20D-16985D7C/0/0 CLEAN NORMAL X-TOI-MSGID: 19101feb-ea67-43a7-9b8e-1e58f4105566 Received-SPF: pass client-ip=194.25.134.18; envelope-from=volker.ruemelin@t-online.de; helo=mailout04.t-online.de X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Commit 9b6083465f ("virtio-snd: check for invalid param shift operands") tries to prevent invalid parameters specified by the guest. However, the code is not correct. Change the code so that the parameters format and rate, which are a bit numbers, are compared with the bit size of the data type. Fixes: 9b6083465f ("virtio-snd: check for invalid param shift operands") Signed-off-by: Volker Rümelin Reviewed-by: Manos Pitsidianakis --- hw/audio/virtio-snd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index e5196aa4bb..d1cf5eb445 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -282,12 +282,12 @@ uint32_t virtio_snd_set_pcm_params(VirtIOSound *s, error_report("Number of channels is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->format) > sizeof(supported_formats) || + if (params->format >= sizeof(supported_formats) * BITS_PER_BYTE || !(supported_formats & BIT(params->format))) { error_report("Stream format is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP); } - if (BIT(params->rate) > sizeof(supported_rates) || + if (params->rate >= sizeof(supported_rates) * BITS_PER_BYTE || !(supported_rates & BIT(params->rate))) { error_report("Stream rate is not supported."); return cpu_to_le32(VIRTIO_SND_S_NOT_SUPP);