diff options
| author | Li Qiang <liq3ea@163.com> | 2019-06-28 09:13:58 -0700 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2019-07-03 10:51:06 +0200 |
| commit | b0ee78ff31617937f44161bde7515a67c88748c7 (patch) | |
| tree | 75ca8a94c3546ff2643c16f2494313edf485bf7e /hw/display | |
| parent | a7f85e03b94ffaca75332cddf06426fc85ac611a (diff) | |
| download | focaccia-qemu-b0ee78ff31617937f44161bde7515a67c88748c7.tar.gz focaccia-qemu-b0ee78ff31617937f44161bde7515a67c88748c7.zip | |
virtio-gpu: check if the resource already exists in virtio_gpu_load()
While loading virtio-gpu, the data can be malicious, we should check if the resource already exists. Signed-off-by: Li Qiang <liq3ea@163.com> Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Message-id: 20190628161358.10400-1-liq3ea@163.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/display')
| -rw-r--r-- | hw/display/virtio-gpu.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c index 475a018c02..25d9e327fc 100644 --- a/hw/display/virtio-gpu.c +++ b/hw/display/virtio-gpu.c @@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size, resource_id = qemu_get_be32(f); while (resource_id != 0) { + res = virtio_gpu_find_resource(g, resource_id); + if (res) { + return -EINVAL; + } + res = g_new0(struct virtio_gpu_simple_resource, 1); res->resource_id = resource_id; res->width = qemu_get_be32(f); |