qemu-e2k/hw
Marc-André Lureau 7b84b90966 usbredir: fix buffer-overflow on vmload
If interface_count is NO_INTERFACE_INFO, let's not access the arrays
out-of-bounds.

==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40
READ of size 1 at 0x625000243930 thread T0
    #0 0x5642068086a7 in usbredir_check_bulk_receiving /home/elmarco/src/qemu/hw/usb/redirect.c:1503
    #1 0x56420681301c in usbredir_post_load /home/elmarco/src/qemu/hw/usb/redirect.c:2154
    #2 0x5642068a56c2 in vmstate_load_state /home/elmarco/src/qemu/migration/vmstate.c:168
    #3 0x56420688e2ac in vmstate_load /home/elmarco/src/qemu/migration/savevm.c:829
    #4 0x5642068980cb in qemu_loadvm_section_start_full /home/elmarco/src/qemu/migration/savevm.c:2211
    #5 0x564206899645 in qemu_loadvm_state_main /home/elmarco/src/qemu/migration/savevm.c:2395
    #6 0x5642068998cf in qemu_loadvm_state /home/elmarco/src/qemu/migration/savevm.c:2467
    #7 0x56420685f3e9 in process_incoming_migration_co /home/elmarco/src/qemu/migration/migration.c:449
    #8 0x564207106c47 in coroutine_trampoline /home/elmarco/src/qemu/util/coroutine-ucontext.c:115
    #9 0x7f0c0604e37f  (/lib64/libc.so.6+0x4d37f)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190807084048.4258-1-marcandre.lureau@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2019-08-21 10:42:00 +02:00
..
9pfs Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
acpi sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
adc Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
alpha Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
arm hw/misc: Add a config switch for the "unimplemented" device 2019-08-20 09:11:17 +02:00
audio Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
block Block layer patches: 2019-08-16 16:43:46 +01:00
bt
char sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
core hw/core: Add a config switch for the generic loader device 2019-08-20 09:11:17 +02:00
cpu Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
cris Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
display sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
dma hw/core: Add a config switch for the "register" device 2019-08-20 09:11:05 +02:00
gpio Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
hppa Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
hyperv Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
i2c Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
i386 sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
ide hw/ide/atapi: Use the ldst API 2019-08-16 19:14:04 -04:00
input sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
intc hw/intc: Only build the xlnx-iomod-intc device for the MicroBlaze PMU 2019-08-19 21:28:25 +02:00
ipack Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
ipmi sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
isa sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
lm32 Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
m68k Include qemu/main-loop.h less 2019-08-16 13:31:52 +02:00
mem numa: Move remaining NUMA declarations from sysemu.h to numa.h 2019-08-16 13:31:53 +02:00
microblaze hw/misc: Add a config switch for the "unimplemented" device 2019-08-20 09:11:17 +02:00
mips target/mips: Style improvements in mips_mipssim.c 2019-08-19 19:53:37 +02:00
misc hw/misc: Add a config switch for the "unimplemented" device 2019-08-20 09:11:17 +02:00
moxie Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
net target-arm queue: 2019-08-16 17:21:40 +01:00
nios2 Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
nvram sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
openrisc Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
pci Include sysemu/sysemu.h a lot less 2019-08-16 13:31:53 +02:00
pci-bridge Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
pci-host hw/core: Add a config switch for the "or-irq" device 2019-08-20 09:11:17 +02:00
pcmcia Include hw/hw.h exactly where needed 2019-08-16 13:31:52 +02:00
ppc sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
rdma sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
riscv Include sysemu/sysemu.h a lot less 2019-08-16 13:31:53 +02:00
s390x sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
scsi sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
sd Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
semihosting Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
sh4 sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
smbios Clean up inclusion of exec/cpu-common.h 2019-08-16 13:31:52 +02:00
sparc sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
sparc64 hw/misc: Add a config switch for the "unimplemented" device 2019-08-20 09:11:17 +02:00
ssi Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
timer hw/Kconfig: Move the generic XLNX_ZYNQMP to the root hw/Kconfig 2019-08-19 21:28:25 +02:00
tpm Include hw/qdev-properties.h less 2019-08-16 13:31:53 +02:00
tricore Clean up inclusion of sysemu/sysemu.h 2019-08-16 13:31:53 +02:00
unicore32 Include hw/irq.h a lot less 2019-08-16 13:31:52 +02:00
usb usbredir: fix buffer-overflow on vmload 2019-08-21 10:42:00 +02:00
vfio sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
virtio sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
watchdog sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
xen sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
xenpv Include sysemu/sysemu.h a lot less 2019-08-16 13:31:53 +02:00
xtensa sysemu: Split sysemu/runstate.h off sysemu/sysemu.h 2019-08-16 13:37:36 +02:00
Kconfig hw/core: Add a config switch for the "register" device 2019-08-20 09:11:05 +02:00
Makefile.objs Makefile: do not repeat $(CONFIG_SOFTMMU) in hw/Makefile.objs 2019-07-15 20:58:37 +02:00