From patchwork Thu Dec 13 22:37:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Hanselmann X-Patchwork-Id: 10730027 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DC1DE112E for ; Thu, 13 Dec 2018 22:38:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BE7D62C9E0 for ; Thu, 13 Dec 2018 22:38:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id AC6652C9E4; Thu, 13 Dec 2018 22:38:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id BD27F2C9E0 for ; Thu, 13 Dec 2018 22:38:48 +0000 (UTC) Received: from localhost ([::1]:57209 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXZd1-0004o8-5O for patchwork-qemu-devel@patchwork.kernel.org; Thu, 13 Dec 2018 17:38:47 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41583) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gXZbu-0004mm-BU for qemu-devel@nongnu.org; Thu, 13 Dec 2018 17:37:39 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gXZbp-0002EE-95 for qemu-devel@nongnu.org; Thu, 13 Dec 2018 17:37:38 -0500 Received: from mail-gateway-shared14.cyon.net ([194.126.200.67]:42576) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1gXZbo-00025h-Tm for qemu-devel@nongnu.org; Thu, 13 Dec 2018 17:37:33 -0500 Received: from s013.cyon.net ([149.126.4.22]) by mail-gateway-shared14.cyon.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim) (envelope-from ) id 1gXZbc-0007Is-0G for qemu-devel@nongnu.org; Thu, 13 Dec 2018 23:37:30 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=hansmi.ch; s=default; h=Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To:MIME-Version :Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=DmNc4gLtNCvUyFw/eCWFGjw+QthdUd+re0N18+pag6o=; b=3yHA62j9CieWacCPSUeuuklYQ3 2KFnSyCt7D94yMbyW3BTdZ1ofCje4la3lrT/kGddFfJzex3m+gFTjMYHC55sf2tFK/VifQG3+b1qD QcGHR+4Epd+ncVxLYGXwv9zptRCZxnNpemxtzjWfglK0PMNQfWFvKHuobqTERxh81oOo=; Received: from [10.20.10.233] (port=9174 helo=mail.cyon.ch) by s013.cyon.net with esmtpa (Exim 4.91) (envelope-from ) id 1gXZba-00AfPD-Ql; Thu, 13 Dec 2018 23:37:18 +0100 Received: from hansmi by lepus.hansmi.ch with local (Exim 4.89) (envelope-from ) id 1gXZba-00045l-FF; Thu, 13 Dec 2018 22:37:18 +0000 From: Michael Hanselmann To: qemu-devel@nongnu.org Date: Thu, 13 Dec 2018 22:37:06 +0000 Message-Id: X-Mailer: git-send-email 2.11.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - s013.cyon.net X-AntiAbuse: Original Domain - nongnu.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - hansmi.ch X-Get-Message-Sender-Via: s013.cyon.net: authenticated_id: mailrelay-cervus@hansmi.ch X-Authenticated-Sender: s013.cyon.net: mailrelay-cervus@hansmi.ch X-Source: X-Source-Args: X-Source-Dir: X-OutGoing-Spam-Status: No, score= X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 194.126.200.67 Subject: [Qemu-devel] [PATCH] usb-mtp: Limit filename to object information size X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Hanselmann , kraxel@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP The filename length in MTP metadata is specified by the guest. By trusting it directly it'd theoretically be possible to get the host to write memory parts outside the filename buffer into a filename. In practice though there are usually NUL bytes stopping the string operations. Also use the opportunity to not assign the filename member twice. Signed-off-by: Michael Hanselmann --- hw/usb/dev-mtp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c index 100b7171f4..360ca65ee4 100644 --- a/hw/usb/dev-mtp.c +++ b/hw/usb/dev-mtp.c @@ -1705,7 +1705,7 @@ free: s->write_pending = false; } -static void usb_mtp_write_metadata(MTPState *s) +static void usb_mtp_write_metadata(MTPState *s, uint64_t dlen) { MTPData *d = s->data_out; ObjectInfo *dataset = (ObjectInfo *)d->data; @@ -1717,7 +1717,8 @@ static void usb_mtp_write_metadata(MTPState *s) assert(!s->write_pending); assert(p != NULL); - filename = utf16_to_str(dataset->length, dataset->filename); + filename = utf16_to_str(MIN(dataset->length, dlen - offsetof(ObjectInfo, filename)), + dataset->filename); if (strchr(filename, '/')) { usb_mtp_queue_result(s, RES_PARAMETER_NOT_SUPPORTED, d->trans, @@ -1733,7 +1734,6 @@ static void usb_mtp_write_metadata(MTPState *s) s->dataset.filename = filename; s->dataset.format = dataset->format; s->dataset.size = dataset->size; - s->dataset.filename = filename; s->write_pending = true; if (s->dataset.format == FMT_ASSOCIATION) { @@ -1802,7 +1802,7 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container, if (d->offset == d->length) { /* The operation might have already failed */ if (!s->result) { - usb_mtp_write_metadata(s); + usb_mtp_write_metadata(s, dlen); } usb_mtp_data_free(s->data_out); s->data_out = NULL;