From 813212288970c39b1800f63e83ac6e96588095c6 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 1 Dec 2020 13:09:26 +0100 Subject: [PATCH] ide: atapi: assert that the buffer pointer is in range A case was reported where s->io_buffer_index can be out of range. The report skimped on the details but it seems to be triggered by s->lba == -1 on the READ/READ CD paths (e.g. by sending an ATAPI command with LBA = 0xFFFFFFFF). For now paper over it with assertions. The first one ensures that there is no overflow when incrementing s->io_buffer_index, the second checks for the buffer overrun. Note that the buffer overrun is only a read, so I am not sure if the assertion failure is actually less harmful than the overrun. Signed-off-by: Paolo Bonzini Message-id: 20201201120926.56559-1-pbonzini@redhat.com Reviewed-by: Kevin Wolf Signed-off-by: Peter Maydell Upstream-Status: Backport CVE: CVE-2020-29443 Signed-off-by: Armin Kuster --- hw/ide/atapi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c index 14a2b0bb2f..e79157863f 100644 --- a/hw/ide/atapi.c +++ b/hw/ide/atapi.c @@ -276,6 +276,8 @@ void ide_atapi_cmd_reply_end(IDEState *s) s->packet_transfer_size -= size; s->elementary_transfer_size -= size; s->io_buffer_index += size; + assert(size <= s->io_buffer_total_len); + assert(s->io_buffer_index <= s->io_buffer_total_len); /* Some adapters process PIO data right away. In that case, we need * to avoid mutual recursion between ide_transfer_start -- 2.25.1