aboutsummaryrefslogtreecommitdiffstats
path: root/hw
diff options
context:
space:
mode:
authorDavid S. Ahern <daahern@cisco.com>2010-02-03 09:00:54 -0700
committerAnthony Liguori <aliguori@us.ibm.com>2010-02-10 12:45:11 -0600
commit4ab4183d766f10f9fc35cd9ef4acee39f241986f (patch)
treefe08cdf3b851f07c72eb46146e63cfebed1984cd /hw
parent8e65b7c04965c8355e4ce43211582b6b83054e3d (diff)
segfault due to buffer overrun in usb-serial
This fixes a segfault due to buffer overrun in the usb-serial device. The memcpy was incrementing the start location by recv_used yet, the computation of first_size (how much to write at the end of the buffer before wrapping to the front) was not accounting for it. This causes the next element after the receive buffer (recv_ptr) to get overwritten with random data. Signed-off-by: David Ahern <daahern@cisco.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw')
-rw-r--r--hw/usb-serial.c28
1 files changed, 22 insertions, 6 deletions
diff --git a/hw/usb-serial.c b/hw/usb-serial.c
index 37293ea41..c3f340137 100644
--- a/hw/usb-serial.c
+++ b/hw/usb-serial.c
@@ -497,12 +497,28 @@ static int usb_serial_can_read(void *opaque)
static void usb_serial_read(void *opaque, const uint8_t *buf, int size)
{
USBSerialState *s = opaque;
- int first_size = RECV_BUF - s->recv_ptr;
- if (first_size > size)
- first_size = size;
- memcpy(s->recv_buf + s->recv_ptr + s->recv_used, buf, first_size);
- if (size > first_size)
- memcpy(s->recv_buf, buf + first_size, size - first_size);
+ int first_size, start;
+
+ /* room in the buffer? */
+ if (size > (RECV_BUF - s->recv_used))
+ size = RECV_BUF - s->recv_used;
+
+ start = s->recv_ptr + s->recv_used;
+ if (start < RECV_BUF) {
+ /* copy data to end of buffer */
+ first_size = RECV_BUF - start;
+ if (first_size > size)
+ first_size = size;
+
+ memcpy(s->recv_buf + start, buf, first_size);
+
+ /* wrap around to front if needed */
+ if (size > first_size)
+ memcpy(s->recv_buf, buf + first_size, size - first_size);
+ } else {
+ start -= RECV_BUF;
+ memcpy(s->recv_buf + start, buf, size);
+ }
s->recv_used += size;
}