starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-04-05 22:00:58 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

hw/audio/sb16: validate VMState fields in post_load

Browse Source 
The SB16 VMState loads in_index and out_data_len as raw INT32
values with no bounds validation. A crafted migration stream or
VM snapshot can set these to values exceeding their respective
buffer sizes (in2_data[10] and out_data[50]), causing heap OOB
write in dsp_write() and heap OOB read in dsp_read().

Add bounds checks in sb16_post_load() to reject invalid values
before they can be used as array indices.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3326
Reported-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
Link: https://lore.kernel.org/r/20260318192918.65481-1-qguanni@gmail.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
This commit is contained in:
Jenny Guanni Qu
2026-03-18 19:29:18 +00:00
committed by Paolo Bonzini
parent 378b1fdb1a
commit cb1e8c18df
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
hw/audio/sb16.c
View File

@@ -1286,6 +1286,13 @@ static int sb16_post_load (void *opaque, int version_id)
{
SB16State *s = opaque;
if (s->in_index < 0 || s->in_index > (int)sizeof(s->in2_data)) {
return -1;
}
if (s->out_data_len < 0 || s->out_data_len > (int)sizeof(s->out_data)) {
return -1;
}
if (s->voice) {
audio_be_close_out(s->audio_be, s->voice);
s->voice = NULL;