### Summary Fix multiple memory safety, use-after-free, buffer overflow, and migration validation bugs across UI, chardev, audio backends, serial, input, and framebuffer devices: 1. chardev/char.c, char-pty.c, char-ringbuf.c, char-udp.c, ui/console.c, clipboard.c, input.c, vnc-enc-zrle.c, vnc-jobs.c: clear freed base pointer on mux error path in do_qemu_chr_new_from_opts() to prevent UAF, fix ringbuf and UDP datagram buffer handling, clamp console resize dimensions to prevent Pixman 16-bit overflow, and guard ZRLE compression errors. 2. hw/display/ramfb.c, xenfb.c, ssd0323.c, hw/char/virtio-serial-bus.c, terminal3270.c, cadence_uart.c, exynos4210_uart.c, serial.c, escc.c: validate stride alignment and size against INT_MAX in ramfb and xenfb, validate post-migration iov_idx/iov_offset in virtio-serial-bus, fix IAC buffer size and uninitialized read in terminal3270, and enforce FIFO bounds across UART models. 3. hw/input/virtio-input.c, hid.c, adb*.c, audio/audio-mixeng-be.c, dbusaudio.c, ossaudio.c, paaudio.c, pwaudio.c, hw/audio/gusemu_mixer.c: free unpopped VirtQueueElement when virtio-input queue is full, validate hid_post_load() queue bounds, and fix audio backend buffer initialization, ringbuffer wrap-around, and GUS mixer volume underflow. ### Proposed Patch (`ui_chardev_audio_input_display.patch`) ```diff From: Pavee Hui <phui@google.com> Subject: [PATCH] ui, chardev, audio, hw/char, hw/input, hw/display: fix UAF, buffer overflows, and migration bounds Fix multiple memory safety, use-after-free, buffer overflow, and migration validation bugs across UI, chardev, audio backends, serial, input, and framebuffer devices: 1. chardev/char.c, char-pty.c, char-ringbuf.c, char-udp.c, ui/console.c, clipboard.c, input.c, vnc-enc-zrle.c, vnc-jobs.c: clear freed base pointer on mux error path in do_qemu_chr_new_from_opts() to prevent UAF, fix ringbuf and UDP datagram buffer handling, clamp console resize dimensions to prevent Pixman 16-bit overflow, and guard ZRLE compression errors. 2. hw/display/ramfb.c, xenfb.c, ssd0323.c, hw/char/virtio-serial-bus.c, terminal3270.c, cadence_uart.c, exynos4210_uart.c, serial.c, escc.c: validate stride alignment and size against INT_MAX in ramfb and xenfb, validate post-migration iov_idx/iov_offset in virtio-serial-bus, fix IAC buffer size and uninitialized read in terminal3270, and enforce FIFO bounds across UART models. 3. hw/input/virtio-input.c, hid.c, adb*.c, audio/audio-mixeng-be.c, dbusaudio.c, ossaudio.c, paaudio.c, pwaudio.c, hw/audio/gusemu_mixer.c: free unpopped VirtQueueElement when virtio-input queue is full, validate hid_post_load() queue bounds, and fix audio backend buffer initialization, ringbuffer wrap-around, and GUS mixer volume underflow. Signed-off-by: Pavee Hui <phui@google.com> --- audio/audio-mixeng-be.c | 5 +++-- audio/dbusaudio.c | 4 ++-- audio/ossaudio.c | 4 ++-- audio/paaudio.c | 6 ++++-- audio/pwaudio.c | 21 +++++++++++++++++++-- audio/wavcapture.c | 8 ++++++++ chardev/char-pty.c | 2 ++ chardev/char-ringbuf.c | 9 +++++---- chardev/char-udp.c | 8 +++++++- chardev/char.c | 1 + hw/audio/gusemu_mixer.c | 19 ++++++++++++------- hw/char/cadence_uart.c | 25 +++++++++++++++---------- hw/char/escc.c | 11 +++++++++++ hw/char/exynos4210_uart.c | 25 ++++++++++++++++++++++--- hw/char/ibex_uart.c | 8 ++++++-- hw/char/imx_serial.c | 3 +++ hw/char/serial.c | 3 +++ hw/char/sh_serial.c | 6 +++--- hw/char/terminal3270.c | 15 ++++++--------- hw/char/virtio-serial-bus.c | 6 ++++++ hw/display/ramfb.c | 5 ++++- hw/display/ssd0323.c | 11 ++++++----- hw/display/xenfb.c | 6 +++--- hw/input/adb-kbd.c | 26 +++++++++++++++++++++++++- hw/input/adb-mouse.c | 20 ++++++++++++++++++++ hw/input/adb.c | 16 ++++++++++++++++ hw/input/hid.c | 9 ++++++++- hw/input/pl050.c | 1 - hw/input/stellaris_gamepad.c | 9 ++++++++- hw/input/virtio-input.c | 2 ++ ui/clipboard.c | 4 ++++ ui/console.c | 11 ++++++++--- ui/input.c | 3 ++- ui/vnc-enc-zrle.c | 5 ++++- ui/vnc-jobs.c | 8 ++++---- 35 files changed, 254 insertions(+), 71 deletions(-) diff --git a/audio/audio-mixeng-be.c b/audio/audio-mixeng-be.c index f7d73d8560..a621bba502 100644 --- a/audio/audio-mixeng-be.c +++ b/audio/audio-mixeng-be.c @@ -78,7 +78,7 @@ static int audio_validate_settings (const struct audsettings *as) { int invalid; - invalid = as->nchannels < 1; + invalid = as->nchannels < 1 || as->nchannels > 16; switch (as->fmt) { case AUDIO_FORMAT_S8: @@ -94,7 +94,7 @@ static int audio_validate_settings (const struct audsettings *as) break; } - invalid |= as->freq <= 0; + invalid |= as->freq <= 0 || as->freq > 384000; return invalid ? -1 : 0; } @@ -382,6 +382,7 @@ static size_t audio_pcm_sw_read(SWVoiceIn *sw, void *buf, size_t buf_len) if (!AUDIO_MIXENG_BACKEND_GET_CLASS(hw->s)->volume_in) { mixeng_volume(sw->resample_buf.buffer, total_out, &sw->vol); } + memset(buf, 0, total_out * sw->info.bytes_per_frame); sw->clip(buf, sw->resample_buf.buffer, total_out); sw->total_hw_samples_acquired += total_in; diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c index e9bdf6adb5..7d762fe873 100644 --- a/audio/dbusaudio.c +++ b/audio/dbusaudio.c @@ -242,7 +242,7 @@ dbus_volume_out_listener(HWVoiceOut *hw, return; } - assert(vol->channels < sizeof(vol->vol)); + assert(vol->channels <= sizeof(vol->vol)); bytes = g_bytes_new(vol->vol, vol->channels); v_vol = g_variant_new_from_bytes(G_VARIANT_TYPE("ay"), bytes, TRUE); qemu_dbus_display1_audio_out_listener_call_set_volume( @@ -332,7 +332,7 @@ dbus_volume_in_listener(HWVoiceIn *hw, return; } - assert(vol->channels < sizeof(vol->vol)); + assert(vol->channels <= sizeof(vol->vol)); bytes = g_bytes_new(vol->vol, vol->channels); v_vol = g_variant_new_from_bytes(G_VARIANT_TYPE("ay"), bytes, TRUE); qemu_dbus_display1_audio_in_listener_call_set_volume( diff --git a/audio/ossaudio.c b/audio/ossaudio.c index 63c6e0a291..e35eab3110 100644 --- a/audio/ossaudio.c +++ b/audio/ossaudio.c @@ -204,7 +204,7 @@ static int oss_to_audfmt (int ossfmt, AudioFormat *fmt, bool *big_endian) #ifdef USE_DSP_POLICY static int oss_get_version (int fd, int *version, const char *typ) { - if (ioctl (fd, OSS_GETVERSION, &version)) { + if (ioctl(fd, OSS_GETVERSION, version)) { #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) /* * Looks like atm (20100109) FreeBSD knows OSS_GETVERSION @@ -393,7 +393,7 @@ static size_t oss_put_buffer_out(HWVoiceOut *hw, void *buf, size_t size) { OSSVoiceOut *oss = (OSSVoiceOut *) hw; if (oss->mmapped) { - assert(buf == hw->buf_emul + hw->pos_emul && size < hw->size_emul); + assert(buf == hw->buf_emul + hw->pos_emul && size <= hw->size_emul); hw->pos_emul = (hw->pos_emul + size) % hw->size_emul; return size; diff --git a/audio/paaudio.c b/audio/paaudio.c index 24327ecbf4..358595c046 100644 --- a/audio/paaudio.c +++ b/audio/paaudio.c @@ -747,6 +747,7 @@ static void qpa_validate_per_direction_opts(Audiodev *dev, static void *qpa_conn_init(const char *server) { PAConnection *c = g_new0(PAConnection, 1); + c->server = g_strdup(server); QTAILQ_INSERT_TAIL(&pa_conns, c, list); c->mainloop = pa_threaded_mainloop_new(); @@ -818,7 +819,7 @@ audio_pa_realize(AudioBackend *abe, Audiodev *dev, Error **errp) } if (!popts->server) { - char pidfile[64]; + g_autofree char *pidfile = NULL; char *runtime; struct stat st; @@ -827,7 +828,7 @@ audio_pa_realize(AudioBackend *abe, Audiodev *dev, Error **errp) error_setg(errp, "XDG_RUNTIME_DIR not set"); return false; } - snprintf(pidfile, sizeof(pidfile), "%s/pulse/pid", runtime); + pidfile = g_strdup_printf("%s/pulse/pid", runtime); if (stat(pidfile, &st) != 0) { error_setg_errno(errp, errno, "could not stat pidfile %s", pidfile); return false; @@ -875,6 +876,7 @@ static void qpa_conn_fini(PAConnection *c) } QTAILQ_REMOVE(&pa_conns, c, list); + g_free(c->server); g_free(c); } diff --git a/audio/pwaudio.c b/audio/pwaudio.c index a59c22e60b..0255bb9c0f 100644 --- a/audio/pwaudio.c +++ b/audio/pwaudio.c @@ -181,10 +181,13 @@ capture_on_process(void *data) if (filled < 0) { error_report("%p: underrun write:%u filled:%d", p, index, filled); + pw_stream_queue_buffer(v->stream, b); + return; } else { if ((uint32_t) filled + n_bytes > RINGBUFFER_SIZE) { error_report("%p: overrun write:%u filled:%d + size:%u > max:%u", p, index, filled, n_bytes, RINGBUFFER_SIZE); + n_bytes = RINGBUFFER_SIZE - (uint32_t)filled; } } spa_ringbuffer_write_data(&v->ring, @@ -243,8 +246,12 @@ qpw_read(HWVoiceIn *hw, void *data, size_t len) avail = spa_ringbuffer_get_read_index(&v->ring, &index); trace_pw_read(avail, index, len); + if (avail <= 0) { + l = 0; + goto done_unlock; + } - if (avail < (int32_t) len) { + if ((size_t)avail < len) { len = avail; } @@ -278,6 +285,9 @@ static size_t qpw_buffer_get_free(HWVoiceOut *hw) filled = spa_ringbuffer_get_write_index(&v->ring, &index); avail = v->highwater_mark - filled; + if (avail < 0) { + avail = 0; + } done_unlock: pw_thread_loop_unlock(c->thread_loop); @@ -304,17 +314,24 @@ qpw_write(HWVoiceOut *hw, void *data, size_t len) avail = v->highwater_mark - filled; trace_pw_write(filled, avail, index, len); + if (avail <= 0) { + len = 0; + goto done_unlock; + } - if (len > avail) { + if (len > (size_t)avail) { len = avail; } if (filled < 0) { error_report("%p: underrun write:%u filled:%d", pw, index, filled); + len = 0; + goto done_unlock; } else { if ((uint32_t) filled + len > RINGBUFFER_SIZE) { error_report("%p: overrun write:%u filled:%d + size:%zu > max:%u", pw, index, filled, len, RINGBUFFER_SIZE); + len = RINGBUFFER_SIZE - (uint32_t)filled; } } diff --git a/audio/wavcapture.c b/audio/wavcapture.c index 2dac946171..8a6cdfe927 100644 --- a/audio/wavcapture.c +++ b/audio/wavcapture.c @@ -76,6 +76,9 @@ static void wav_capture(void *opaque, const void *buf, int size) { WAVState *wav = opaque; + if (size <= 0) { + return; + } if (fwrite (buf, size, 1, wav->f) != 1) { error_report("wav_capture: fwrite error: %s", strerror(errno)); } @@ -131,6 +134,11 @@ int wav_start_capture(AudioBackend *state, CaptureState *s, const char *path, return -1; } + if (freq <= 0) { + error_report("invalid frequency %d, must be greater than zero", freq); + return -1; + } + stereo = nchannels == 2; bits16 = bits == 16; diff --git a/chardev/char-pty.c b/chardev/char-pty.c index 7e95132cdb..d599d582d0 100644 --- a/chardev/char-pty.c +++ b/chardev/char-pty.c @@ -215,6 +215,8 @@ static void char_pty_finalize(Object *obj) unlink(s->path); g_free(s->path); } + g_free(s->pty_name); + s->pty_name = NULL; pty_chr_state(chr, 0); object_unref(OBJECT(s->ioc)); diff --git a/chardev/char-ringbuf.c b/chardev/char-ringbuf.c index 8f998d26a4..68b77678e1 100644 --- a/chardev/char-ringbuf.c +++ b/chardev/char-ringbuf.c @@ -102,7 +102,7 @@ static bool ringbuf_chr_open(Chardev *chr, d->size = opts->has_size ? opts->size : 65536; /* The size must be power of 2 */ - if (d->size & (d->size - 1)) { + if (!d->size || (d->size & (d->size - 1))) { error_setg(errp, "size of ringbuf chardev must be power of two"); return false; } @@ -166,6 +166,7 @@ char *qmp_ringbuf_read(const char *device, int64_t size, Chardev *chr; uint8_t *read_data; size_t count; + int actual; char *data; chr = qemu_chr_find(device); @@ -188,10 +189,10 @@ char *qmp_ringbuf_read(const char *device, int64_t size, size = size > count ? count : size; read_data = g_malloc(size + 1); - ringbuf_chr_read(chr, read_data, size); + actual = ringbuf_chr_read(chr, read_data, size); if (has_format && (format == DATA_FORMAT_BASE64)) { - data = g_base64_encode(read_data, size); + data = g_base64_encode(read_data, actual); g_free(read_data); } else { /* @@ -201,7 +202,7 @@ char *qmp_ringbuf_read(const char *device, int64_t size, * when) ring buffer lost characters since last read, initial * continuation characters should be dropped. */ - read_data[size] = 0; + read_data[actual] = 0; data = (char *)read_data; } diff --git a/chardev/char-udp.c b/chardev/char-udp.c index 423000832f..548d440dc3 100644 --- a/chardev/char-udp.c +++ b/chardev/char-udp.c @@ -81,7 +81,7 @@ static int udp_chr_read_poll(void *opaque) */ udp_chr_flush_buffer(s); - return s->max_size; + return (s->bufptr < s->bufcnt) ? 0 : s->max_size; } static gboolean udp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque) @@ -93,6 +93,12 @@ static gboolean udp_chr_read(QIOChannel *chan, GIOCondition cond, void *opaque) if (s->max_size == 0) { return TRUE; } + if (s->bufptr < s->bufcnt) { + udp_chr_flush_buffer(s); + if (s->bufptr < s->bufcnt) { + return TRUE; + } + } ret = qio_channel_read( s->ioc, (char *)s->buf, sizeof(s->buf), NULL); if (ret <= 0) { diff --git a/chardev/char.c b/chardev/char.c index 9da0911e50..7daf87f036 100644 --- a/chardev/char.c +++ b/chardev/char.c @@ -747,6 +747,7 @@ static Chardev *do_qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context, mux = qemu_chardev_new(id, TYPE_CHARDEV_MUX, backend, context, errp); if (mux == NULL) { object_unparent(OBJECT(chr)); + base = NULL; chr = NULL; goto out; } diff --git a/hw/audio/gusemu_mixer.c b/hw/audio/gusemu_mixer.c index 56300de77e..2d49a28c84 100644 --- a/hw/audio/gusemu_mixer.c +++ b/hw/audio/gusemu_mixer.c @@ -68,9 +68,9 @@ void gus_mixvoices(GUSEmuState * state, unsigned int playback_freq, unsigned int int PanningPos = (GUSvoice(wVSRPanning) >> 8) & 0xf; - unsigned int Volume32 = 32 * GUSvoice(wVSRCurrVol); /* 32 times larger than original gus for maintaining precision while ramping */ - unsigned int StartVol32 = (GUSvoice(wVSRVolRampStartVol) & 0xff00) * 32; - unsigned int EndVol32 = (GUSvoice(wVSRVolRampEndVol) & 0xff00) * 32; + int Volume32 = 32 * GUSvoice(wVSRCurrVol); + int StartVol32 = (GUSvoice(wVSRVolRampStartVol) & 0xff00) * 32; + int EndVol32 = (GUSvoice(wVSRVolRampEndVol) & 0xff00) * 32; int VolumeIncrement32 = (32 * 16 * (GUSvoice(wVSRVolRampRate) & 0x3f00) >> 8) >> ((((GUSvoice(wVSRVolRampRate) & 0xc000) >> 8) >> 6) * 3); /* including 1/8/64/512 volume speed divisor */ VolumeIncrement32 = (((VolumeIncrement32 * 44100 / 2) / playback_freq) * 14) / ((GUSregb(NumVoices) & 31) + 1); /* adjust ramping speed to playback speed */ @@ -82,6 +82,7 @@ void gus_mixvoices(GUSEmuState * state, unsigned int playback_freq, unsigned int for (sample = 0; sample < numsamples; sample++) { int sample1, sample2, Volume; + Volume32 = CLAMP(Volume32, 0, 0x1fe000); if (GUSvoice(wVSRControl) & 0x400) /* 16bit */ { int offset = ((CurrPos >> 9) & 0xc0000) + (((CurrPos >> 9) & 0x1ffff) << 1); @@ -131,11 +132,13 @@ void gus_mixvoices(GUSEmuState * state, unsigned int playback_freq, unsigned int } if ((GUSvoice(wVSRVolRampControl) & 0xa000) == 0xa000) /* volramp IRQ set and enabled? */ { - GUSregd(voicevolrampirq) |= 1 << Voice; /* set irq slot */ + /* set irq slot */ + GUSregd(voicevolrampirq) |= 1U << Voice; } else { - GUSregd(voicevolrampirq) &= (~(1 << Voice)); /* clear irq slot */ + /* clear irq slot */ + GUSregd(voicevolrampirq) &= ~(1U << Voice); GUSvoice(wVSRVolRampControl) &= 0x7f00; } @@ -162,11 +165,13 @@ void gus_mixvoices(GUSEmuState * state, unsigned int playback_freq, unsigned int } if ((GUSvoice(wVSRControl) & 0xa000) == 0xa000) /* wavetable IRQ set and enabled? */ { - GUSregd(voicewavetableirq) |= 1 << Voice; /* set irq slot */ + /* set irq slot */ + GUSregd(voicewavetableirq) |= 1U << Voice; } else { - GUSregd(voicewavetableirq) &= (~(1 << Voice)); /* clear irq slot */ + /* clear irq slot */ + GUSregd(voicewavetableirq) &= ~(1U << Voice); GUSvoice(wVSRControl) &= 0x7f00; } diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index eff6a3c4d1..71e641144d 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -284,17 +284,17 @@ static void uart_write_rx_fifo(void *opaque, const uint8_t *buf, int size) return; } - if (s->rx_count == CADENCE_UART_RX_FIFO_SIZE) { - s->r[R_CISR] |= UART_INTR_ROVR; - } else { - for (i = 0; i < size; i++) { - s->rx_fifo[s->rx_wpos] = buf[i]; - s->rx_wpos = (s->rx_wpos + 1) % CADENCE_UART_RX_FIFO_SIZE; - s->rx_count++; + for (i = 0; i < size; i++) { + if (s->rx_count >= CADENCE_UART_RX_FIFO_SIZE) { + s->r[R_CISR] |= UART_INTR_ROVR; + break; } - timer_mod(s->fifo_trigger_handle, new_rx_time + - (s->char_tx_time * 4)); + s->rx_fifo[s->rx_wpos] = buf[i]; + s->rx_wpos = (s->rx_wpos + 1) % CADENCE_UART_RX_FIFO_SIZE; + s->rx_count++; } + timer_mod(s->fifo_trigger_handle, new_rx_time + + (s->char_tx_time * 4)); uart_update_status(s); } @@ -349,7 +349,7 @@ static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf, * us to here. */ qemu_log_mask(LOG_GUEST_ERROR, "cadence_uart: TxFIFO overflow"); - s->r[R_CISR] |= UART_INTR_ROVR; + s->r[R_CISR] |= UART_INTR_TOVR; } memcpy(s->tx_fifo + s->tx_count, buf, size); @@ -584,6 +584,11 @@ static int cadence_uart_post_load(void *opaque, int version_id) { CadenceUARTState *s = opaque; + if (s->tx_count > CADENCE_UART_TX_FIFO_SIZE || + s->rx_count > CADENCE_UART_RX_FIFO_SIZE || + s->rx_wpos >= CADENCE_UART_RX_FIFO_SIZE) { + return -EINVAL; + } /* Ensure these two aren't invalid numbers */ if (s->r[R_BRGR] < 1 || s->r[R_BRGR] & ~0xFFFF || s->r[R_BDIV] <= 3 || s->r[R_BDIV] & ~0xFF) { diff --git a/hw/char/escc.c b/hw/char/escc.c index 7aae627fb4..1543ca6803 100644 --- a/hw/char/escc.c +++ b/hw/char/escc.c @@ -764,10 +764,21 @@ static void serial_event(void *opaque, QEMUChrEvent event) } } +static int escc_chn_post_load(void *opaque, int version_id) +{ + ESCCChannelState *s = opaque; + + if (s->reg >= ESCC_SERIAL_REGS) { + return -EINVAL; + } + return 0; +} + static const VMStateDescription vmstate_escc_chn = { .name = "escc_chn", .version_id = 2, .minimum_version_id = 1, + .post_load = escc_chn_post_load, .fields = (const VMStateField[]) { VMSTATE_UINT32(vmstate_dummy, ESCCChannelState), VMSTATE_UINT32(reg, ESCCChannelState), diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c index 46fc4e31b8..2bcaf67f5c 100644 --- a/hw/char/exynos4210_uart.c +++ b/hw/char/exynos4210_uart.c @@ -203,7 +203,7 @@ static int fifo_elements_number(const Exynos4210UartFIFO *q) static int fifo_empty_elements_number(const Exynos4210UartFIFO *q) { - return q->size - fifo_elements_number(q); + return q->size ? (q->size - 1 - fifo_elements_number(q)) : 0; } static void fifo_reset(Exynos4210UartFIFO *q) @@ -369,7 +369,7 @@ static void exynos4210_uart_update_parameters(Exynos4210UartState *s) uclk_rate = 24000000; - speed = uclk_rate / ((16 * (s->reg[I_(UBRDIV)]) & 0xffff) + + speed = uclk_rate / ((16 * (s->reg[I_(UBRDIV)] & 0xffff)) + (s->reg[I_(UFRACVAL)] & 0x7) + 16); ssp.speed = speed; @@ -548,6 +548,10 @@ static const MemoryRegionOps exynos4210_uart_ops = { .max_access_size = 4, .unaligned = false }, + .impl = { + .min_access_size = 4, + .max_access_size = 4, + }, }; static int exynos4210_uart_can_receive(void *opaque) @@ -591,7 +595,9 @@ static void exynos4210_uart_event(void *opaque, QEMUChrEvent event) if (event == CHR_EVENT_BREAK) { /* When the RxDn is held in logic 0, then a null byte is pushed into the * fifo */ - fifo_store(&s->rx, '\0'); + if (s->rx.data && fifo_empty_elements_number(&s->rx) > 0) { + fifo_store(&s->rx, '\0'); + } s->reg[I_(UERSTAT)] |= UERSTAT_BREAK; exynos4210_uart_update_irq(s); } @@ -624,10 +630,21 @@ static int exynos4210_uart_post_load(void *opaque, int version_id) return 0; } +static int exynos4210_uart_fifo_post_load(void *opaque, int version_id) +{ + Exynos4210UartFIFO *q = opaque; + + if (!q->data || q->size == 0 || q->sp >= q->size || q->rp >= q->size) { + return -EINVAL; + } + return 0; +} + static const VMStateDescription vmstate_exynos4210_uart_fifo = { .name = "exynos4210.uart.fifo", .version_id = 1, .minimum_version_id = 1, + .post_load = exynos4210_uart_fifo_post_load, .fields = (const VMStateField[]) { VMSTATE_UINT32(sp, Exynos4210UartFIFO), VMSTATE_UINT32(rp, Exynos4210UartFIFO), @@ -696,6 +713,8 @@ static void exynos4210_uart_realize(DeviceState *dev, Error **errp) { Exynos4210UartState *s = EXYNOS4210_UART(dev); + fifo_reset(&s->rx); + fifo_reset(&s->tx); s->fifo_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, exynos4210_uart_timeout_int, s); diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c index 26ed1aea14..4c22fb4f58 100644 --- a/hw/char/ibex_uart.c +++ b/hw/char/ibex_uart.c @@ -395,7 +395,9 @@ static void ibex_uart_write(void *opaque, hwaddr addr, if (value & R_CTRL_NCO_MASK) { uint64_t baud = ibex_uart_get_baud(s); - s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10; + if (baud) { + s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10; + } } break; case R_STATUS: @@ -455,7 +457,9 @@ static void ibex_uart_clk_update(void *opaque, ClockEvent event) /* recompute uart's speed on clock change */ uint64_t baud = ibex_uart_get_baud(s); - s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10; + if (baud) { + s->char_tx_time = (NANOSECONDS_PER_SECOND / baud) * 10; + } } static void fifo_trigger_update(void *opaque) diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c index 8ac4efbb5e..7a3d575c96 100644 --- a/hw/char/imx_serial.c +++ b/hw/char/imx_serial.c @@ -324,12 +324,14 @@ static void imx_serial_write(void *opaque, hwaddr offset, } } s->ucr2 = value & 0xffff; + imx_update(s); break; case 0x25: /* USR1 */ value &= USR1_AWAKE | USR1_AIRINT | USR1_DTRD | USR1_AGTIM | USR1_FRAMERR | USR1_ESCF | USR1_RTSD | USR1_PARTYER; s->usr1 &= ~value; + imx_update(s); break; case 0x26: /* USR2 */ @@ -341,6 +343,7 @@ static void imx_serial_write(void *opaque, hwaddr offset, USR2_RIDELT | USR2_IRINT | USR2_WAKE | USR2_DCDDELT | USR2_RTSF | USR2_BRCD | USR2_ORE; s->usr2 &= ~value; + imx_update(s); break; /* diff --git a/hw/char/serial.c b/hw/char/serial.c index 4339562ab0..44bf9fa0b2 100644 --- a/hw/char/serial.c +++ b/hw/char/serial.c @@ -178,6 +178,9 @@ static void serial_update_parameters(SerialState *s) frame_size += data_bits + stop_bits; /* Zero divisor should give about 3500 baud */ speed = (s->divider == 0) ? 3500 : (float) s->baudbase / s->divider; + if (speed <= 0) { + speed = 3500; + } ssp.speed = speed; ssp.parity = parity; ssp.data_bits = data_bits; diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c index 10f96e3a44..8933af24be 100644 --- a/hw/char/sh_serial.c +++ b/hw/char/sh_serial.c @@ -175,7 +175,7 @@ static void sh_serial_write(void *opaque, hwaddr offs, } if (val & (1 << 1)) { sh_serial_clear_fifo(s); - s->sr &= ~(1 << 1); + s->flags &= ~SH_SERIAL_FLAG_RDF; } return; @@ -316,13 +316,13 @@ static uint64_t sh_serial_read(void *opaque, hwaddr offs, static int sh_serial_can_receive(SHSerialState *s) { - return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_head : 0; + return s->scr & (1 << 4) ? SH_RX_FIFO_LENGTH - s->rx_cnt : 0; } static void sh_serial_receive_break(SHSerialState *s) { if (s->feat & SH_SERIAL_FEAT_SCIF) { - s->sr |= (1 << 4); + s->flags |= SH_SERIAL_FLAG_BRK; } } diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c index 989b6f6ee1..ad7f5d9472 100644 --- a/hw/char/terminal3270.c +++ b/hw/char/terminal3270.c @@ -23,10 +23,10 @@ /* Enough spaces for different window sizes. */ #define INPUT_BUFFER_SIZE 1000 /* - * 1 for header, 1024*2 for datastream, 2 for tail + * 1*2 for header, 1024*2 for datastream, 2 for tail * Reserve enough spaces for telnet IAC escape. */ -#define OUTPUT_BUFFER_SIZE 2051 +#define OUTPUT_BUFFER_SIZE 2052 struct Terminal3270 { EmulatedCcw3270Device cdev; @@ -205,6 +205,9 @@ static int read_payload_3270(EmulatedCcw3270Device *dev) return ret; } t->in_len -= len; + if (t->in_len > 0) { + memmove(t->inv, &t->inv[len], t->in_len); + } return len; } @@ -246,13 +249,7 @@ static int write_payload_3270(EmulatedCcw3270Device *dev, uint8_t cmd) int out_len = 0; if (!t->handshake_done) { - if (!(t->outv[0] == IAC && t->outv[1] != IAC)) { - /* - * Before having finished 3270 negotiation, - * sending outbound data except protocol options is prohibited. - */ - return 0; - } + return 0; } if (!qemu_chr_fe_backend_connected(&t->chr)) { /* We just say we consumed all data if there's no backend. */ diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c index c36e18a4cf..a71fda0713 100644 --- a/hw/char/virtio-serial-bus.c +++ b/hw/char/virtio-serial-bus.c @@ -768,6 +768,12 @@ static int fetch_active_ports_list(QEMUFile *f, error_report("Failed to restore virtio-serial element"); return -EINVAL; } + if (port->iov_idx >= port->elem->out_num || + port->iov_offset > port->elem->out_sg[port->iov_idx].iov_len) { + g_free(port->elem); + port->elem = NULL; + return -EINVAL; + } /* * Port was throttled on source machine. Let's diff --git a/hw/display/ramfb.c b/hw/display/ramfb.c index f477bdcc21..785add7fc4 100644 --- a/hw/display/ramfb.c +++ b/hw/display/ramfb.c @@ -63,8 +63,11 @@ static DisplaySurface *ramfb_create_display_surface(int width, int height, if (stride == 0) { stride = linesize; } + if (stride < linesize || stride % 4 != 0 || stride > INT_MAX / height) { + return NULL; + } - mapsize = size = stride * (height - 1) + linesize; + mapsize = size = stride * height; data = physical_memory_map(addr, &mapsize, false); if (size != mapsize) { physical_memory_unmap(data, mapsize, 0, 0); diff --git a/hw/display/ssd0323.c b/hw/display/ssd0323.c index 9309d4d10c..e242b187f2 100644 --- a/hw/display/ssd0323.c +++ b/hw/display/ssd0323.c @@ -102,9 +102,10 @@ static uint32_t ssd0323_transfer(SSIPeripheral *dev, uint32_t data) break; case SSD0323_CMD: DPRINTF("cmd 0x%02x\n", data); + data &= 0xff; if (s->cmd_len == 0) { s->cmd = data; - } else { + } else if (s->cmd_len <= ARRAY_SIZE(s->cmd_data)) { s->cmd_data[s->cmd_len - 1] = data; } s->cmd_len++; @@ -112,13 +113,13 @@ static uint32_t ssd0323_transfer(SSIPeripheral *dev, uint32_t data) #define DATA(x) if (s->cmd_len <= (x)) return 0 case 0x15: /* Set column. */ DATA(2); - s->col = s->col_start = s->cmd_data[0] % 64; - s->col_end = s->cmd_data[1] % 64; + s->col = s->col_start = (uint32_t)s->cmd_data[0] % 64; + s->col_end = (uint32_t)s->cmd_data[1] % 64; break; case 0x75: /* Set row. */ DATA(2); - s->row = s->row_start = s->cmd_data[0] % 80; - s->row_end = s->cmd_data[1] % 80; + s->row = s->row_start = (uint32_t)s->cmd_data[0] % 80; + s->row_end = (uint32_t)s->cmd_data[1] % 80; break; case 0x81: /* Set contrast */ DATA(1); diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c index ae302b217f..4a55f468fd 100644 --- a/hw/display/xenfb.c +++ b/hw/display/xenfb.c @@ -521,7 +521,7 @@ static int xenfb_configure_fb(struct XenFB *xenfb, size_t fb_len_lim, depth); return -1; } - if (row_stride <= 0 || row_stride > fb_len) { + if (row_stride <= 0 || row_stride > fb_len || row_stride % 4 != 0) { xen_pv_printf(&xenfb->c.xendev, 0, "invalid frontend stride %d\n", row_stride); return -1; @@ -533,13 +533,13 @@ static int xenfb_configure_fb(struct XenFB *xenfb, size_t fb_len_lim, width, max_width); width = max_width; } - if (offset < 0 || offset >= fb_len) { + if (offset < 0 || (size_t)offset + (depth == 24 ? 1 : 0) >= fb_len) { xen_pv_printf(&xenfb->c.xendev, 0, "invalid frontend offset %d (max %zu)\n", offset, fb_len - 1); return -1; } - max_height = (fb_len - offset) / row_stride; + max_height = (fb_len - offset - (depth == 24 ? 1 : 0)) / row_stride; if (height < 0 || height > max_height) { xen_pv_printf(&xenfb->c.xendev, 0, "invalid frontend height %d limited to %d\n", diff --git a/hw/input/adb-kbd.c b/hw/input/adb-kbd.c index ece51d5df7..291687ad88 100644 --- a/hw/input/adb-kbd.c +++ b/hw/input/adb-kbd.c @@ -241,12 +241,18 @@ static int adb_kbd_request(ADBDevice *d, uint8_t *obuf, olen = 0; switch (cmd) { case ADB_WRITEREG: + if (len < 2) { + return 0; + } trace_adb_device_kbd_writereg(reg, buf[1]); switch (reg) { case 2: /* LED status */ break; case 3: + if (len != 3) { + return 0; + } switch (buf[2]) { case ADB_CMD_SELF_TEST: break; @@ -328,10 +334,23 @@ static void adb_keyboard_event(DeviceState *dev, QemuConsole *src, adb_kbd_put_keycode(s, keycode); } +static int adb_kbd_post_load(void *opaque, int version_id) +{ + KBDState *s = opaque; + + if (s->rptr < 0 || s->rptr >= sizeof(s->data) || + s->wptr < 0 || s->wptr >= sizeof(s->data) || + s->count < 0 || s->count > sizeof(s->data)) { + return -EINVAL; + } + return 0; +} + static const VMStateDescription vmstate_adb_kbd = { .name = "adb_kbd", .version_id = 2, .minimum_version_id = 2, + .post_load = adb_kbd_post_load, .fields = (const VMStateField[]) { VMSTATE_STRUCT(parent_obj, KBDState, 0, vmstate_adb_device, ADBDevice), VMSTATE_BUFFER(data, KBDState), @@ -367,6 +386,9 @@ static void adb_kbd_realizefn(DeviceState *dev, Error **errp) ADBKeyboardClass *akc = ADB_KEYBOARD_GET_CLASS(dev); akc->parent_realize(dev, errp); + if (errp && *errp) { + return; + } s->hs = qemu_input_handler_register(dev, &adb_keyboard_handler); } @@ -376,7 +398,9 @@ static void adb_kbd_unrealizefn(DeviceState *dev) ADBKeyboardClass *akc = ADB_KEYBOARD_GET_CLASS(dev); g_clear_pointer(&s->hs, qemu_input_handler_unregister); - akc->parent_unrealize(dev); + if (akc->parent_unrealize) { + akc->parent_unrealize(dev); + } } static void adb_kbd_initfn(Object *obj) diff --git a/hw/input/adb-mouse.c b/hw/input/adb-mouse.c index 5dcdc851fc..6ae95a0132 100644 --- a/hw/input/adb-mouse.c +++ b/hw/input/adb-mouse.c @@ -50,6 +50,7 @@ struct ADBMouseClass { /*< private >*/ DeviceRealize parent_realize; + DeviceUnrealize parent_unrealize; }; #define ADB_MOUSE_BUTTON_LEFT 0x01 @@ -164,6 +165,9 @@ static int adb_mouse_request(ADBDevice *d, uint8_t *obuf, olen = 0; switch (cmd) { case ADB_WRITEREG: + if (len < 2) { + return 0; + } trace_adb_device_mouse_writereg(reg, buf[1]); switch (reg) { case 2: @@ -272,10 +276,24 @@ static void adb_mouse_realizefn(DeviceState *dev, Error **errp) ADBMouseClass *amc = ADB_MOUSE_GET_CLASS(dev); amc->parent_realize(dev, errp); + if (errp && *errp) { + return; + } s->hs = qemu_input_handler_register(dev, &adb_mouse_handler); } +static void adb_mouse_unrealizefn(DeviceState *dev) +{ + MouseState *s = ADB_MOUSE(dev); + ADBMouseClass *amc = ADB_MOUSE_GET_CLASS(dev); + + g_clear_pointer(&s->hs, qemu_input_handler_unregister); + if (amc->parent_unrealize) { + amc->parent_unrealize(dev); + } +} + static void adb_mouse_initfn(Object *obj) { ADBDevice *d = ADB_DEVICE(obj); @@ -291,6 +309,8 @@ static void adb_mouse_class_init(ObjectClass *oc, const void *data) device_class_set_parent_realize(dc, adb_mouse_realizefn, &amc->parent_realize); + device_class_set_parent_unrealize(dc, adb_mouse_unrealizefn, + &amc->parent_unrealize); set_bit(DEVICE_CATEGORY_INPUT, dc->categories); adc->devreq = adb_mouse_request; diff --git a/hw/input/adb.c b/hw/input/adb.c index 29c09c7559..05e0159336 100644 --- a/hw/input/adb.c +++ b/hw/input/adb.c @@ -96,6 +96,10 @@ int adb_request(ADBBusState *s, uint8_t *obuf, const uint8_t *buf, int len) { int ret; + if (len < 1) { + return -1; + } + trace_adb_bus_request(buf[0] >> 4, adb_commands[buf[0] & 0xf], len); assert(s->autopoll_blocked); @@ -276,10 +280,21 @@ static const TypeInfo adb_bus_type_info = { .class_init = adb_bus_class_init, }; +static int adb_device_post_load(void *opaque, int version_id) +{ + ADBDevice *d = opaque; + + if (d->devaddr < 0 || d->devaddr >= MAX_ADB_DEVICES) { + return -EINVAL; + } + return 0; +} + const VMStateDescription vmstate_adb_device = { .name = "adb_device", .version_id = 0, .minimum_version_id = 0, + .post_load = adb_device_post_load, .fields = (const VMStateField[]) { VMSTATE_INT32(devaddr, ADBDevice), VMSTATE_INT32(handler, ADBDevice), @@ -293,6 +308,7 @@ static void adb_device_realizefn(DeviceState *dev, Error **errp) ADBBusState *bus = ADB_BUS(qdev_get_parent_bus(dev)); if (bus->nb_devices >= MAX_ADB_DEVICES) { + error_setg(errp, "Too many ADB devices"); return; } diff --git a/hw/input/hid.c b/hw/input/hid.c index 0f28827554..9296318e81 100644 --- a/hw/input/hid.c +++ b/hw/input/hid.c @@ -547,6 +547,13 @@ static int hid_post_load(void *opaque, int version_id) { HIDState *s = opaque; + if (s->n > QUEUE_LENGTH) { + return -EINVAL; + } + if (s->kind == HID_KEYBOARD && + (s->kbd.keys < 0 || s->kbd.keys > ARRAY_SIZE(s->kbd.key))) { + return -EINVAL; + } hid_set_next_idle(s); if (s->n == QUEUE_LENGTH && (s->kind == HID_TABLET || @@ -560,7 +567,7 @@ static int hid_post_load(void *opaque, int version_id) * mouse. */ HIDPointerEvent evt; - evt = s->ptr.queue[(s->head+s->n) & QUEUE_MASK]; + evt = s->ptr.queue[(s->head + s->n - 1) & QUEUE_MASK]; if (s->kind == HID_MOUSE) { evt.xdx = 0; evt.ydy = 0; diff --git a/hw/input/pl050.c b/hw/input/pl050.c index 48df2734e2..3731e69698 100644 --- a/hw/input/pl050.c +++ b/hw/input/pl050.c @@ -265,7 +265,6 @@ static const TypeInfo pl050_type_info = { .class_init = pl050_class_init, .class_size = sizeof(PL050DeviceClass), .abstract = true, - .class_init = pl050_class_init, }; static void pl050_register_types(void) diff --git a/hw/input/stellaris_gamepad.c b/hw/input/stellaris_gamepad.c index 376d91abad..9478da6e8e 100644 --- a/hw/input/stellaris_gamepad.c +++ b/hw/input/stellaris_gamepad.c @@ -75,7 +75,14 @@ static void stellaris_gamepad_reset_enter(Object *obj, ResetType type) { StellarisGamepad *s = STELLARIS_GAMEPAD(obj); - memset(s->pressed, 0, s->num_buttons * sizeof(uint8_t)); + if (s->pressed) { + memset(s->pressed, 0, s->num_buttons * sizeof(uint8_t)); + } + if (s->irqs) { + for (uint32_t i = 0; i < s->num_buttons; i++) { + qemu_set_irq(s->irqs[i], 0); + } + } } static const Property stellaris_gamepad_properties[] = { diff --git a/hw/input/virtio-input.c b/hw/input/virtio-input.c index 6494cfbbe8..08681c4464 100644 --- a/hw/input/virtio-input.c +++ b/hw/input/virtio-input.c @@ -49,6 +49,7 @@ void virtio_input_send(VirtIOInput *vinput, virtio_input_event *event) if (!elem) { while (--i >= 0) { virtqueue_unpop(vinput->evt, vinput->queue[i].elem, 0); + g_free(vinput->queue[i].elem); } vinput->qindex = 0; trace_virtio_input_queue_full(); @@ -216,6 +217,7 @@ static void virtio_input_reset(VirtIODevice *vdev) vic->change_active(vinput); } } + vinput->qindex = 0; } static int virtio_input_post_load(void *opaque, int version_id) diff --git a/ui/clipboard.c b/ui/clipboard.c index e3d8a31ba9..3423115be0 100644 --- a/ui/clipboard.c +++ b/ui/clipboard.c @@ -76,6 +76,10 @@ void qemu_clipboard_peer_unregister(QemuClipboardPeer *peer) qemu_clipboard_peer_release(peer, i); } notifier_remove(&peer->notifier); + if (QLIST_EMPTY(&clipboard_notifiers.notifiers) && cb_change_state_entry) { + qemu_del_vm_change_state_handler(cb_change_state_entry); + cb_change_state_entry = NULL; + } } bool qemu_clipboard_peer_owns(QemuClipboardPeer *peer, diff --git a/ui/console.c b/ui/console.c index 14f148118e..e44ca2de75 100644 --- a/ui/console.c +++ b/ui/console.c @@ -740,6 +740,9 @@ void qemu_console_update(QemuConsole *con, int x, int y, int w, int h) y = MIN(y, height); w = MIN(w, width - x); h = MIN(h, height - y); + if (w <= 0 || h <= 0) { + return; + } dpy_gfx_update_texture(con, con->surface, x, y, w, h); QLIST_FOREACH(dcl, &s->listeners, next) { @@ -825,9 +828,9 @@ bool qemu_console_check_format(QemuConsole *con, static void dpy_refresh(DisplayState *s) { - DisplayChangeListener *dcl; + DisplayChangeListener *dcl, *next_dcl; - QLIST_FOREACH(dcl, &s->listeners, next) { + QLIST_FOREACH_SAFE(dcl, &s->listeners, next, next_dcl) { if (dcl->ops->dpy_refresh) { dcl->ops->dpy_refresh(dcl); } @@ -905,7 +908,7 @@ void qemu_console_set_cursor(QemuConsole *c, QEMUCursor *cursor) DisplayChangeListener *dcl; cursor_unref(con->cursor); - con->cursor = cursor_ref(cursor); + con->cursor = cursor ? cursor_ref(cursor) : NULL; QLIST_FOREACH(dcl, &s->listeners, next) { if (c != dcl->con) { continue; @@ -1361,6 +1364,8 @@ void qemu_console_resize(QemuConsole *s, int width, int height) { DisplaySurface *surface = qemu_console_surface(s); + width = CLAMP(width, 1, 32767); + height = CLAMP(height, 1, 32767); assert(QEMU_IS_GRAPHIC_CONSOLE(s)); if ((s->scanout.kind != SCANOUT_SURFACE || diff --git a/ui/input.c b/ui/input.c index b82622c864..4ecc59d8ab 100644 --- a/ui/input.c +++ b/ui/input.c @@ -496,7 +496,8 @@ int qemu_input_scale_axis(int value, if (range_in < 1) { return min_out + range_out / 2; } - return ((int64_t)value - min_in) * range_out / range_in + min_out; + return (int64_t)((__int128)((int64_t)value - min_in) * + range_out / range_in) + min_out; } void qemu_input_queue_rel(QemuConsole *src, InputAxis axis, int value) diff --git a/ui/vnc-enc-zrle.c b/ui/vnc-enc-zrle.c index 7679014c9e..dc7165a315 100644 --- a/ui/vnc-enc-zrle.c +++ b/ui/vnc-enc-zrle.c @@ -256,7 +256,7 @@ static int zrle_send_framebuffer_update(VncState *vs, VncWorker *worker, int x, int y, int w, int h) { bool be = vs->client_endian == G_BIG_ENDIAN; - size_t bytes; + int bytes; int zywrle_level; if (worker->zrle.type == VNC_ENCODING_ZYWRLE) { @@ -337,6 +337,9 @@ static int zrle_send_framebuffer_update(VncState *vs, VncWorker *worker, vnc_zrle_stop(vs, &worker->zrle); bytes = zrle_compress_data(vs, &worker->zrle, Z_DEFAULT_COMPRESSION); + if (bytes < 0) { + return -1; + } vnc_framebuffer_update(vs, x, y, w, h, worker->zrle.type); vnc_write_u32(vs, bytes); vnc_write(vs, worker->zrle.zlib.buffer, worker->zrle.zlib.offset); diff --git a/ui/vnc-jobs.c b/ui/vnc-jobs.c index 90b68bf4cb..331ecf30a3 100644 --- a/ui/vnc-jobs.c +++ b/ui/vnc-jobs.c @@ -215,19 +215,19 @@ static bool vnc_worker_clamp_rect(VncState *vs, VncJob *job, VncRect *rect) { trace_vnc_job_clamp_rect(vs, job, rect->x, rect->y, rect->w, rect->h); - if (rect->x >= vs->client_width) { + if (rect->x < 0 || rect->x >= vs->client_width || rect->w <= 0) { goto discard; } rect->w = MIN(vs->client_width - rect->x, rect->w); - if (rect->w == 0) { + if (rect->w <= 0) { goto discard; } - if (rect->y >= vs->client_height) { + if (rect->y < 0 || rect->y >= vs->client_height || rect->h <= 0) { goto discard; } rect->h = MIN(vs->client_height - rect->y, rect->h); - if (rect->h == 0) { + if (rect->h <= 0) { goto discard; } ```