uefi-ref/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu.git synced 2026-08-26 22:23:12 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
qemu/include/hw
History
Exact
Alex Bennée 81ce9b1a30 hw/elf_ops: defend against weird elf headers 
According to the ELF spec:

  PT_LOAD

  The array element specifies a loadable segment, described by
  p_filesz and p_memsz. The bytes from the file are mapped to the
  beginning of the memory segment. If the segment's memory
  size (p_memsz) is larger than the file size (p_filesz), the
  ``extra'' bytes are defined to hold the value 0 and to follow the
  segment's initialized area. The file size may not be larger than the
  memory size. Loadable segment entries in the program header table
  appear in ascending order, sorted on the p_vaddr member.

which implies while both p_filesz and p_memsz can be zero we should
never see a case where p_filesz is greater than the in memory size.
Indeed it has been reported such a hand crafted ELF can blow up, for
example during rom_reset():

  address_space_set(rom->as, rom->addr + rom->datasize, 0,
                    rom->romsize - rom->datasize,
                    MEMTXATTRS_UNSPECIFIED);

which could trigger and underflow leaving QEMU slowly filling a very
large buffer.

Cc: qemu-stable@nongnu.org
Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4056
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-ID: <20260812081405.3811787-1-alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
(cherry picked from commit 260d49d8e2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2026-08-17 19:23:02 +03:00
..
acpi hw/acpi: Introduce acpi_builtin() helper 2025-03-11 20:03:26 +01:00
adc hw/adc: Remove MAX111X device 2024-10-15 15:16:17 +01:00
arm hw/arm/stm32f205_soc: Don't leak TYPE_OR_IRQ objects 2025-08-31 08:08:30 +03:00
audio virtio-snd: rewrite invalid tx/rx message handling 2024-04-09 02:31:16 -04:00
block block: Add more defaults to DEFAULT_BLOCK_CONF 2026-05-20 11:23:08 +03:00
char hw/char: sifive_uart: Implement txctrl.txen and rxctrl.rxen 2026-05-26 17:14:50 +03:00
core physmem: Destroy all CPU AddressSpaces on unrealize 2025-10-05 09:39:24 +03:00
cpu
cxl hw/cxl: Introduce CXL_T3_MSIX_VECTOR enumeration 2025-02-21 07:18:42 -05:00
display hw/display: Remove Blizzard display device 2024-10-01 14:40:29 +01:00
dma include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
firmware hw/smbios: Remove 'uuid_encoded' argument from smbios_set_defaults() 2024-06-19 12:40:49 +02:00
fsi hw/fsi: Aspeed APB2OPB & On-chip peripheral bus 2024-02-01 08:33:18 +01:00
gpio hw/gpio/aspeed: Support different memory region ops 2024-10-24 07:57:47 +02:00
hyperv hw/hyperv/hyperv-proto: Move SYNDBG definitions from target/i386 2025-03-11 20:03:27 +01:00
i2c hw/i2c/bcm2835_i2c: Correct CLKT register offset 2026-07-31 11:08:41 +03:00
i386 hw/i386/pc: Remove unused pc_compat_2_3 declarations 2025-01-30 13:01:22 +03:00
ide include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
input hw/input: Remove lm832x device 2024-10-01 14:41:10 +01:00
intc hw/intc/arm_gicv3_kvm: preserve pending interrupts during cpr 2025-08-31 07:47:10 +03:00
ipack hw/ipack: Remove legacy qemu_allocate_irqs() use 2025-01-31 19:36:44 +01:00
ipmi
isa include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
loongarch hw/loongarch/virt: Update the ACPI table for hotplug cpu 2025-03-05 09:39:18 +08:00
m68k m68k: Clean up includes 2024-01-30 21:20:20 +03:00
mem hw/mem/memory-device: Remove legacy_align from memory_device_pre_plug() 2024-06-19 12:40:49 +02:00
mips hw/mips/cps: Set the vCPU 'cpu-big-endian' property 2024-10-15 12:21:06 -03:00
misc hw/misc/stm32_rcc: Correct offset-to-irq calculation 2026-07-15 15:34:37 +03:00
net hw/net/npcm_gmac: Catch accesses off the end of the register array 2026-03-11 16:39:16 +03:00
nubus hw/nubus: add nubus-virtio-mmio device 2024-02-27 09:36:39 +01:00
nvram include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
openrisc hw/openrisc: Support monitor dumpdtb command 2025-02-24 15:03:42 +00:00
pci hw/pci: Make msix_init take a uint32_t for nentries 2025-11-26 17:06:16 +03:00
pci-bridge hw/pci-bridge/cxl-upstream: Add properties to control link speed and width 2024-11-04 16:03:24 -05:00
pci-host hw/pci-host: Remove unused pci_host_data_be_ops 2025-05-22 16:09:32 +03:00
ppc ppc/pnv: generate dtb after machine initialization is complete 2026-03-31 20:04:50 +03:00
remote remote: Remove unused remote_iohub_finalize 2024-10-03 17:26:06 +03:00
riscv target/riscv: Handle Smrnmi interrupt and exception 2025-01-19 09:44:34 +10:00
rtc hw/i386: move rtc-reset-reinjection command out of hw/rtc 2024-05-10 15:45:15 +02:00
rx hw/rx/rx62n: Only call qdev_get_gpio_in() when necessary 2024-02-15 16:58:46 +01:00
s390x s390x/css: firm up handling of chained TIC CCWs 2026-07-15 15:34:37 +03:00
scsi virtio-scsi: fix SCSIRequest leak on a bad request 2026-07-31 11:08:41 +03:00
sd hw/sd/sdhci: Remove need for SDHCI_VENDOR_IMX definition 2025-03-12 11:11:42 +01:00
sensor
sh4 hw/sh4: Remove sh7750_register_io_device() helper 2024-09-13 20:10:49 +02:00
southbridge hw/acpi/ich9: Add periodic and swsmi timer 2024-09-11 09:46:14 -04:00
sparc hw/sparc/grlib: split out the headers for each peripherals 2024-02-15 16:58:46 +01:00
ssi hw/ssi/pnv_spi: Put a limit to RDR match failures 2025-03-11 22:43:31 +10:00
timer hw/arm/fsl-imx8mp: Implement general purpose timers 2025-02-25 17:03:46 +00:00
tricore include: Rename sysemu/ -> system/ 2024-12-20 17:44:56 +01:00
uefi hw/uefi: add include/hw/uefi/var-service.h 2025-03-04 12:01:42 +01:00
usb hw/usb/hcd-dwc3: Align global registers size with Linux 2025-02-25 15:32:58 +00:00
vfio vfio/migration: Add x-migration-multifd-transfer VFIO property 2025-03-06 06:47:34 +01:00
virtio hw/display/virtio-gpu: Always reject invalid scanout bounds 2026-08-05 10:52:02 +03:00
vmapple hw/vmapple/virtio-blk: Add support for apple virtio-blk 2025-03-04 14:45:34 +01:00
watchdog aspeed/wdt: Add AST2700 support 2024-06-16 21:08:54 +02:00
xen hw/xen/hvm: Fix Aarch64 typo 2025-03-11 20:03:26 +01:00
xtensa
boards.h i386/cpu: add has_caches flag to check smp_cache configuration 2025-02-25 16:18:12 +01:00
clock.h clock: clear callback on unparent 2024-12-10 18:49:24 +01:00
elf_ops.h.inc hw/elf_ops: defend against weird elf headers 2026-08-17 19:23:02 +03:00
fw-path-provider.h
hotplug.h pci: fix 'hotplugglable' property behavior 2023-03-07 12:38:59 -05:00
hw.h
irq.h hw/irq: Introduce qemu_init_irqs() helper 2025-01-31 19:36:44 +01:00
loader-fit.h hw/mips/boston: Support dumpdtb monitor commands 2025-02-24 15:03:42 +00:00
loader.h load_aout: replace bswap_needed with big_endian 2025-03-21 12:51:16 +01:00
nmi.h
or-irq.h hw: Replace qemu_or_irq typedef by OrIRQState 2023-02-27 13:27:05 +00:00
platform-bus.h
ptimer.h
qdev-clock.h
qdev-core.h hw/qdev: Factor qdev_hotunplug_allowed() out 2025-01-13 17:16:03 +01:00
qdev-dma.h
qdev-properties-system.h hw/vmapple/virtio-blk: Add support for apple virtio-blk 2025-03-04 14:45:34 +01:00
qdev-properties.h qdev, rust/hpet: fix type of HPET "timers" property 2025-03-20 12:14:45 +01:00
register.h
registerfields.h
resettable.h reset: Add RESET_TYPE_WAKEUP 2024-09-24 11:33:35 +02:00
stream.h
sysbus.h hw/sysbus: Introduce TYPE_DYNAMIC_SYS_BUS_DEVICE 2025-02-16 14:25:07 +01:00
usb.h hw/usb: Inline usb_new() 2025-01-13 17:07:00 +01:00
vmstate-if.h