From: Jamin Lin Date: Fri, 21 Mar 2025 09:25:58 +0000 (+0800) Subject: hw/misc/aspeed_hace: Fix buffer overflow in has_padding function X-Git-Tag: v8.2.10~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a2d22778addb41facaa7553386c4c39dc4c47499;p=thirdparty%2Fqemu.git hw/misc/aspeed_hace: Fix buffer overflow in has_padding function The maximum padding size is either 64 or 128 bytes and should always be smaller than "req_len". If "padding_size" exceeds "req_len", then "req_len - padding_size" underflows due to "uint32_t" data type, leading to a large incorrect value (e.g., `0xFFXXXXXX`). This causes an out-of-bounds memory access, potentially leading to a buffer overflow. Added a check to ensure "padding_size" does not exceed "req_len" before computing "pad_offset". This prevents "req_len - padding_size" from underflowing and avoids accessing invalid memory. Signed-off-by: Jamin Lin Reviewed-by: Cédric Le Goater Fixes: 5cd7d8564a8b563da724b9e6264c967f0a091afa ("aspeed/hace: Support AST2600 HACE ") Link: https://lore.kernel.org/qemu-devel/20250321092623.2097234-3-jamin_lin@aspeedtech.com Signed-off-by: Cédric Le Goater (cherry picked from commit 78877b2e06464f49f777e086845e094ea7bc82ef) Signed-off-by: Michael Tokarev --- diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c index b07506ec04e..8706e3d3764 100644 --- a/hw/misc/aspeed_hace.c +++ b/hw/misc/aspeed_hace.c @@ -123,6 +123,11 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov, if (*total_msg_len <= s->total_req_len) { uint32_t padding_size = s->total_req_len - *total_msg_len; uint8_t *padding = iov->iov_base; + + if (padding_size > req_len) { + return false; + } + *pad_offset = req_len - padding_size; if (padding[*pad_offset] == 0x80) { return true;