ShuriZma
/
xqemu
mirror of https://github.com/xqemu/xqemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

virtio-serial: Don't copy over guest buffer to host 

When the guest writes something to a host, we copied over the entire
buffer first into the host and then processed it.  Do away with that, it
could result in a malicious guest causing a DoS on the host.

Reported-by: Paul Brook <paul@codesourcery.com>
Signed-off-by: Amit Shah <amit.shah@redhat.com>
This commit is contained in:
Amit Shah 2010-12-10 17:29:49 +05:30
parent 6bff86560d
commit 471344db88
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hw/virtio-serial-bus.c
View File

@ -132,16 +132,17 @@ static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq,
assert(virtio_queue_ready(vq)); assert(virtio_queue_ready(vq));
while (!port->throttled && virtqueue_pop(vq, &elem)) { while (!port->throttled && virtqueue_pop(vq, &elem)) {
uint8_t *buf; unsigned int i;
size_t ret, buf_size;
buf_size = iov_size(elem.out_sg, elem.out_num); for (i = 0; i < elem.out_num; i++) {
buf = qemu_malloc(buf_size); size_t buf_size;
ret = iov_to_buf(elem.out_sg, elem.out_num, buf, 0, buf_size);
port->info->have_data(port, buf, ret); buf_size = elem.out_sg[i].iov_len;
qemu_free(buf);
port->info->have_data(port,
elem.out_sg[i].iov_base,
buf_size);
}
virtqueue_push(vq, &elem, 0); virtqueue_push(vq, &elem, 0);
} }
virtio_notify(vdev, vq); virtio_notify(vdev, vq);