From 93761787b29f37fa627dea9082cdfc1a1ec608d6 Mon Sep 17 00:00:00 2001 From: Li Qiang Date: Sat, 7 Jan 2017 06:21:09 -0500 Subject: [PATCH] renderer: fix integer overflow in create shader As the 'pkt_length' and 'offlen' can be malicious from guest, the vrend_create_shader function has an integer overflow, this will make the next 'memcpy' oob access. This patch avoid this. Signed-off-by: Li Qiang Signed-off-by: Dave Airlie --- src/vrend_renderer.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/vrend_renderer.c b/src/vrend_renderer.c index ad68f71..0af91ae 100644 --- a/src/vrend_renderer.c +++ b/src/vrend_renderer.c @@ -2215,6 +2215,15 @@ int vrend_create_shader(struct vrend_context *ctx, ret = EINVAL; goto error; } + + /*make sure no overflow */ + if (pkt_length * 4 < pkt_length || + pkt_length * 4 + sel->buf_offset < pkt_length * 4 || + pkt_length * 4 + sel->buf_offset < sel->buf_offset) { + ret = EINVAL; + goto error; + } + if ((pkt_length * 4 + sel->buf_offset) > sel->buf_len) { fprintf(stderr, "Got too large shader continuation %d vs %d\n", pkt_length * 4 + sel->buf_offset, sel->buf_len);