You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Thomas Huth
e423455c4f
hw/core/loader: Fix possible crash in rom_copy() Both, "rom->addr" and "addr" are derived from the binary image
that can be loaded with the "-kernel" paramer. The code in
rom_copy() then calculates:
d = dest + (rom->addr - addr);
and uses "d" as destination in a memcpy() some lines later. Now with
bad kernel images, it is possible that rom->addr is smaller than addr,
thus "rom->addr - addr" gets negative and the memcpy() then tries to
copy contents from the image to a bad memory location. This could
maybe be used to inject code from a kernel image into the QEMU binary,
so we better fix it with an additional sanity check here.
Cc: qemu-stable@nongnu.org
Reported-by: Guangming Liu
Buglink: https://bugs.launchpad.net/qemu/+bug/1844635
Message-Id: <20190925130331.27825-1-thuth@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
7 years ago
..
Kconfig
hw/core: Add a config switch for the generic loader device
7 years ago
Makefile.objs
hw/core: Move cpu.c, cpu.h from qom/ to hw/core/
7 years ago
bus.c
Include hw/qdev-properties.h less
7 years ago
cpu.c
cputlb: Remove cpu->mem_io_vaddr
7 years ago
empty_slot.c
Include hw/hw.h exactly where needed
7 years ago
fw-path-provider.c
Include qemu/module.h where needed, drop it from qemu-common.h
7 years ago
generic-loader.c
hw/core: Move cpu.c, cpu.h from qom/ to hw/core/
7 years ago
hotplug.c
call HotplugHandler->plug() as the last step in device realization
8 years ago
irq.c
Include qemu-common.h exactly where needed
7 years ago
loader-fit.c
Clean up inclusion of sysemu/sysemu.h
7 years ago
loader.c
hw/core/loader: Fix possible crash in rom_copy()
7 years ago
machine-hmp-cmds.c
numa: move numa global variable nb_numa_nodes into MachineState
7 years ago
machine-qmp-cmds.c
qapi: report the default CPU type for each machine
7 years ago
machine.c
virtio,vhost: fixes, features, cleanups.
7 years ago
nmi.c
Include qemu/module.h where needed, drop it from qemu-common.h
7 years ago
null-machine.c
hw/core: Move cpu.c, cpu.h from qom/ to hw/core/
7 years ago
numa.c
numa: move numa global variable numa_info into MachineState
7 years ago
or-irq.c
Include hw/qdev-properties.h less
7 years ago
platform-bus.c
Clean up inclusion of sysemu/sysemu.h
7 years ago
ptimer.c
Include hw/hw.h exactly where needed
7 years ago
qdev-fw.c
Include hw/qdev-properties.h less
7 years ago
qdev-properties-system.c
audio: add audiodev properties to frontends
7 years ago
qdev-properties.c
Include hw/qdev-properties.h less
7 years ago
qdev.c
qdev/machine: Introduce hotplug_allowed hook
7 years ago
register.c
Include hw/qdev-properties.h less
7 years ago
reset.c
qemu/queue.h: leave head structs anonymous unless necessary
8 years ago
split-irq.c
Include hw/qdev-properties.h less
7 years ago
stream.c
Include qemu/module.h where needed, drop it from qemu-common.h
7 years ago
sysbus.c
Include qemu/module.h where needed, drop it from qemu-common.h
7 years ago
trace-events
loader: Trace loaded images
7 years ago
uboot_image.h
Support u-boot noload images for arm as used by, NetBSD/evbarm GENERIC kernel.
8 years ago
vm-change-state-handler.c
sysemu: Split sysemu/runstate.h off sysemu/sysemu.h
7 years ago
Thomas Huth
e423455c4f