ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio-snd: add max size bounds check in input cb 

When reading input audio in the virtio-snd input callback,
virtio_snd_pcm_in_cb(), we do not check whether the iov can actually fit
the data buffer. This is because we use the buffer->size field as a
total-so-far accumulator instead of byte-size-left like in TX buffers.

This triggers an out of bounds write if the size of the virtio queue
element is equal to virtio_snd_pcm_status, which makes the available
space for audio data zero. This commit adds a check for reaching the
maximum buffer size before attempting any writes.

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2427
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <virtio-snd-fuzz-2427-fix-v1-manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Manos Pitsidianakis 2024-07-08 10:09:49 +03:00 committed by Michael S. Tsirkin
parent e3f15732c4
commit 98e77e3dd8
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
hw/audio/virtio-snd.c
View File

@ -1261,7 +1261,7 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
{ {
VirtIOSoundPCMStream *stream = data; VirtIOSoundPCMStream *stream = data;
VirtIOSoundPCMBuffer *buffer; VirtIOSoundPCMBuffer *buffer;
size_t size; size_t size, max_size;
WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) { WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {
while (!QSIMPLEQ_EMPTY(&stream->queue)) { while (!QSIMPLEQ_EMPTY(&stream->queue)) {
@ -1275,7 +1275,12 @@ static void virtio_snd_pcm_in_cb(void *data, int available)
continue; continue;
} }
max_size = iov_size(buffer->elem->in_sg, buffer->elem->in_num);
for (;;) { for (;;) {
if (buffer->size >= max_size) {
return_rx_buffer(stream, buffer);
break;
}
size = AUD_read(stream->voice.in, size = AUD_read(stream->voice.in,
buffer->data + buffer->size, buffer->data + buffer->size,
MIN(available, (stream->params.period_bytes - MIN(available, (stream->params.period_bytes -