From: Munkhbaatar Enkhbaatar <[email protected]> Prevents huge allocations and crashes caused by malformed HTIF signature addresses. Fixes: link to issue #3205
Signed-off-by: Munkhbaatar Enkhbaatar <[email protected]> --- hw/char/riscv_htif.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c index a78ea9b01c..aa205c84c0 100644 --- a/hw/char/riscv_htif.c +++ b/hw/char/riscv_htif.c @@ -170,6 +170,11 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) * begin/end_signature symbols exist. */ if (sig_file && begin_sig_addr && end_sig_addr) { + if (end_sig_addr <= begin_sig_addr) { + error_report("Invalid HTIF signature range: begin=0x%llx end=0x%llx", + begin_sig_addr, end_sig_addr); + return; + } uint64_t sig_len = end_sig_addr - begin_sig_addr; char *sig_data = g_malloc(sig_len); dma_memory_read(&address_space_memory, begin_sig_addr, -- 2.50.1 (Apple Git-155)
