Re: [Qemu-devel] [PATCH] usbredir: fix buffer-overflow on vmload

[Gerd Hoffmann]

On Wed, Aug 07, 2019 at 12:40:48PM +0400, Marc-André Lureau wrote:
> If interface_count is NO_INTERFACE_INFO, let's not access the arrays
> out-of-bounds.
> 
> ==994==ERROR: AddressSanitizer: heap-buffer-overflow on address 
> 0x625000243930 at pc 0x5642068086a8 bp 0x7f0b6f9ffa50 sp 0x7f0b6f9ffa40
> READ of size 1 at 0x625000243930 thread T0
>     #0 0x5642068086a7 in usbredir_check_bulk_receiving 
> /home/elmarco/src/qemu/hw/usb/redirect.c:1503
>     #1 0x56420681301c in usbredir_post_load 
> /home/elmarco/src/qemu/hw/usb/redirect.c:2154
>     #2 0x5642068a56c2 in vmstate_load_state 
> /home/elmarco/src/qemu/migration/vmstate.c:168
>     #3 0x56420688e2ac in vmstate_load 
> /home/elmarco/src/qemu/migration/savevm.c:829
>     #4 0x5642068980cb in qemu_loadvm_section_start_full 
> /home/elmarco/src/qemu/migration/savevm.c:2211
>     #5 0x564206899645 in qemu_loadvm_state_main 
> /home/elmarco/src/qemu/migration/savevm.c:2395
>     #6 0x5642068998cf in qemu_loadvm_state 
> /home/elmarco/src/qemu/migration/savevm.c:2467
>     #7 0x56420685f3e9 in process_incoming_migration_co 
> /home/elmarco/src/qemu/migration/migration.c:449
>     #8 0x564207106c47 in coroutine_trampoline 
> /home/elmarco/src/qemu/util/coroutine-ucontext.c:115
>     #9 0x7f0c0604e37f  (/lib64/libc.so.6+0x4d37f)
> 
> Signed-off-by: Marc-André Lureau <address@hidden>

Added to usb queue.

thanks,
  Gerd