hw/audio/sb16: validate VMState fields in post_load
The SB16 VMState loads in_index and out_data_len as raw INT32 values with no bounds validation. A crafted migration stream or VM snapshot can set these to values exceeding their respective buffer sizes (in2_data[10] and out_data[50]), causing heap OOB write in dsp_write() and heap OOB read in dsp_read(). Add bounds checks in sb16_post_load() to reject invalid values before they can be used as array indices. Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3326 Reported-by: Jenny Guanni Qu <qguanni@gmail.com> Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com> Link: https://lore.kernel.org/r/20260318192918.65481-1-qguanni@gmail.com Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Jenny Guanni Qu committed
Mar 18, 2026 at 19:29 UTC
cb1e8c18df625dc9aed7f5fd5c8b961e8e4d1023
1 file changed
+7
hw/audio/sb16.c
+7
@@ -1286,6 +1286,13 @@ static int sb16_post_load (void *opaque, int version_id)
1286
{
1287
SB16State *s = opaque;
1288
1289
+
1290
+ if (s->in_index < 0 || s->in_index > (int)sizeof(s->in2_data)) {
1291
+ return -1;
1292
+ }
1293
+ if (s->out_data_len < 0 || s->out_data_len > (int)sizeof(s->out_data)) {
1294
+ return -1;
1295
+ }
1296
if (s->voice) {
1297
audio_be_close_out(s->audio_be, s->voice);
1298
s->voice = NULL;