|
 |
169b9a |
From 9ea892729b9c77eaf7b923da8a3e370dbb022e6e Mon Sep 17 00:00:00 2001
|
|
|
6e672b |
From: Kevin Wolf <kwolf@redhat.com>
|
|
|
6e672b |
Date: Thu, 26 Jul 2018 16:24:48 +0200
|
|
|
6e672b |
Subject: [PATCH 6/8] multiboot: Check validity of mh_header_addr
|
|
|
6e672b |
|
|
|
6e672b |
RH-Author: Kevin Wolf <kwolf@redhat.com>
|
|
|
6e672b |
Message-id: <20180726162448.22072-7-kwolf@redhat.com>
|
|
|
6e672b |
Patchwork-id: 81515
|
|
|
6e672b |
O-Subject: [RHEL-7.6/7.5.z qemu-kvm PATCH 6/6] multiboot: Check validity of mh_header_addr
|
|
|
169b9a |
Bugzilla: 1549822
|
|
|
6e672b |
RH-Acked-by: John Snow <jsnow@redhat.com>
|
|
|
6e672b |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
6e672b |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
6e672b |
|
|
|
6e672b |
I couldn't find a case where this prevents something bad from happening
|
|
|
6e672b |
that isn't already caught by other checks, but let's err on the safe
|
|
|
6e672b |
side and check that mh_header_addr is as expected.
|
|
|
6e672b |
|
|
|
6e672b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
6e672b |
Reviewed-by: Jack Schwartz <jack.schwartz@oracle.com>
|
|
|
6e672b |
(cherry picked from commit dbf2dce7aabb7723542bd182175904846d70b0f9)
|
|
|
6e672b |
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
|
|
|
6e672b |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
6e672b |
---
|
|
|
6e672b |
hw/i386/multiboot.c | 4 ++++
|
|
|
6e672b |
1 file changed, 4 insertions(+)
|
|
|
6e672b |
|
|
|
6e672b |
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
|
|
|
6e672b |
index 6f489a5..e1f6e56 100644
|
|
|
6e672b |
--- a/hw/i386/multiboot.c
|
|
|
6e672b |
+++ b/hw/i386/multiboot.c
|
|
|
6e672b |
@@ -208,6 +208,10 @@ int load_multiboot(FWCfgState *fw_cfg,
|
|
|
6e672b |
error_report("invalid load_addr address");
|
|
|
6e672b |
exit(1);
|
|
|
6e672b |
}
|
|
|
6e672b |
+ if (mh_header_addr - mh_load_addr > i) {
|
|
|
6e672b |
+ error_report("invalid header_addr address");
|
|
|
6e672b |
+ exit(1);
|
|
|
6e672b |
+ }
|
|
|
6e672b |
|
|
|
6e672b |
uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
|
|
|
6e672b |
uint32_t mb_load_size = 0;
|
|
|
6e672b |
--
|
|
|
6e672b |
1.8.3.1
|
|
|
6e672b |
|