OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

fw_cfg: Fix -boot reboot-timeout error checking 

fw_cfg_reboot() gets option parameter "reboot-timeout" with
qemu_opt_get(), then converts it to an integer by hand. It neglects to
check that conversion for errors, and fails to reject negative values.
Positive values above the limit get reported and replaced by the limit.
This patch checks for conversion errors properly, and reject all values
outside 0...0xffff.

Signed-off-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <1542777026-2788-3-git-send-email-liq3ea@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
This commit is contained in:
Li Qiang 2018-11-20 21:10:25 -08:00 committed by Philippe Mathieu-Daudé
parent 6912bb0b3d
commit ee5d0f89de
2 changed files with 14 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
hw/nvram/fw_cfg.c
View File

@ -176,26 +176,25 @@ static void fw_cfg_bootsplash(FWCfgState *s)
static void fw_cfg_reboot(FWCfgState *s)
{
int reboot_timeout = -1;
char *p;
const char *temp;
const char *reboot_timeout = NULL;
int64_t rt_val = -1;
/* get user configuration */
QemuOptsList *plist = qemu_find_opts("boot-opts");
QemuOpts *opts = QTAILQ_FIRST(&plist->head);
if (opts != NULL) {
temp = qemu_opt_get(opts, "reboot-timeout");
if (temp != NULL) {
p = (char *)temp;
reboot_timeout = strtol(p, &p, 10);
reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
if (reboot_timeout) {
rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
/* validate the input */
if (rt_val < 0 || rt_val > 0xffff) {
error_report("reboot timeout is invalid,"
"it should be a value between 0 and 65535");
exit(1);
}
}
/* validate the input */
if (reboot_timeout > 0xffff) {
error_report("reboot timeout is larger than 65535, force it to 65535.");
reboot_timeout = 0xffff;
}
fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&reboot_timeout, 4), 4);
fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_val, 4), 4);
}
static void fw_cfg_write(FWCfgState *s, uint8_t value)

2
vl.c
View File

@ -341,7 +341,7 @@ static QemuOptsList qemu_boot_opts = {
.type = QEMU_OPT_NUMBER,
}, {
.name = "reboot-timeout",
.type = QEMU_OPT_STRING,
.type = QEMU_OPT_NUMBER,
}, {
.name = "strict",
.type = QEMU_OPT_BOOL,