mirror of https://github.com/proxmox/mirror_qemu
0f0f8b611e
The rom_ptr() function allows direct access to the ROM blobs that we load during startup. However, there are currently no checks for the size of the accesses, so it's currently possible to crash QEMU for example with: $ echo "Insane in the mainframe" > /tmp/test.txt $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -append xyz Segmentation fault (core dumped) $ s390x-softmmu/qemu-system-s390x -kernel /tmp/test.txt -initrd /tmp/test.txt Segmentation fault (core dumped) $ echo -n HdrS > /tmp/hdr.txt $ sparc64-softmmu/qemu-system-sparc64 -kernel /tmp/hdr.txt -initrd /tmp/hdr.txt Segmentation fault (core dumped) We need a possibility to check the size of the ROM area that we want to access, thus let's add a size parameter to the rom_ptr() function to avoid these problems. Acked-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-Id: <1530005740-25254-1-git-send-email-thuth@redhat.com> Signed-off-by: Cornelia Huck <cohuck@redhat.com> |
||
|---|---|---|
| .. | ||
| Makefile.objs | ||
| arch_dump.c | ||
| arm-powerctl.c | ||
| arm-powerctl.h | ||
| arm-semi.c | ||
| arm_ldst.h | ||
| cpu-qom.h | ||
| cpu.c | ||
| cpu.h | ||
| cpu64.c | ||
| crypto_helper.c | ||
| gdbstub.c | ||
| gdbstub64.c | ||
| helper-a64.c | ||
| helper-a64.h | ||
| helper-sve.h | ||
| helper.c | ||
| helper.h | ||
| idau.h | ||
| internals.h | ||
| iwmmxt_helper.c | ||
| kvm-consts.h | ||
| kvm-stub.c | ||
| kvm.c | ||
| kvm32.c | ||
| kvm64.c | ||
| kvm_arm.h | ||
| machine.c | ||
| monitor.c | ||
| neon_helper.c | ||
| op_addsub.h | ||
| op_helper.c | ||
| psci.c | ||
| sve.decode | ||
| sve_helper.c | ||
| trace-events | ||
| translate-a64.c | ||
| translate-a64.h | ||
| translate-sve.c | ||
| translate.c | ||
| translate.h | ||
| vec_helper.c | ||