]> git.ipfire.org Git - thirdparty/qemu.git/commit
hmp: fix sendkey out of bounds write (CVE-2015-8619)
authorWolfgang Bumiller <w.bumiller@proxmox.com>
Wed, 13 Jan 2016 08:09:58 +0000 (09:09 +0100)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Tue, 22 Mar 2016 22:38:16 +0000 (17:38 -0500)
commit24fe899c3c9d5c4d2a156a26e08e905ab8e98384
treeeedaf68b0e240fa9449ce5edaf71ef16924f0080
parentaaf4fb6afb4653c86059255811886a5c4ea271f3
hmp: fix sendkey out of bounds write (CVE-2015-8619)

When processing 'sendkey' command, hmp_sendkey routine null
terminates the 'keyname_buf' array. This results in an OOB
write issue, if 'keyname_len' was to fall outside of
'keyname_buf' array.

Since the keyname's length is known the keyname_buf can be
removed altogether by adding a length parameter to
index_from_key() and using it for the error output as well.

Reported-by: Ling Liu <liuling-it@360.cn>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Message-Id: <20160113080958.GA18934@olga>
[Comparison with "<" dumbed down, test for junk after strtoul()
tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
(cherry picked from commit 64ffbe04eaafebf4045a3ace52a360c14959d196)

Conflicts:
hmp.c

*removed dependency on 7fb1cf16

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hmp.c
include/ui/console.h
ui/input-legacy.c