@samitouri / QOSamiQemu / commits / 14808578cc

riscv_htif: reject invalid signature ranges (end <= begin)

Prevents huge allocations and crashes caused by malformed HTIF signature addresses. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3205 Signed-off-by: Munkhbaatar Enkhbaatar <munkhuu0825@gmail.com> Reviewed-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20251209085349.61510-1-munkhuu0825@gmail.com> [ Squashed with following commit to fix build failures hw/char/riscv_htif: Fix format specifier for uint64_t Message-ID: <20260415134826.1742308-1-chao.liu.zevorn@gmail.com> Signed-off-by: Chao Liu <chao.liu.zevorn@gmail.com> ] Tested-by: Tao Tang <tangtao1634@phytium.com.cn> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Signed-off-by: Chao Liu <chao.liu.zevorn@gmail.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Munkhbaatar Enkhbaatar committed Dec 9, 2025 at 16:53 UTC 14808578ccbcd17d474c98bb53b60452888f8529

1 file changed +6

hw/char/riscv_htif.c

@@ -171,6 +171,12 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)

171 * begin/end_signature symbols exist.

172 */

173 if (sig_file && begin_sig_addr && end_sig_addr) {

174 + if (end_sig_addr <= begin_sig_addr) {

175 + error_report("Invalid HTIF signature range:"

176 + " begin=0x%" PRIx64 " end=0x%" PRIx64,

177 + begin_sig_addr, end_sig_addr);

178 + return;

179 + }

180 uint64_t sig_len = end_sig_addr - begin_sig_addr;

181 char *sig_data = g_malloc(sig_len);

182 dma_memory_read(&address_space_memory, begin_sig_addr,