From 7e62255a4b3e0e2ab84a3ec7398640e8ed58620a Mon Sep 17 00:00:00 2001 From: Markus Armbruster Date: Mon, 28 Nov 2011 20:27:37 +0100 Subject: ccid: Fix buffer overrun in handling of VSC_ATR message ATR size exceeding the limit is diagnosed, but then we merrily use it anyway, overrunning card->atr[]. The message is read from a character device. Obvious security implications unless the other end of the character device is trusted. Spotted by Coverity. CVE-2011-4111. Signed-off-by: Markus Armbruster Signed-off-by: Anthony Liguori --- hw/ccid-card-passthru.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/ccid-card-passthru.c b/hw/ccid-card-passthru.c index 2cbc81b9f..9f51c6cb0 100644 --- a/hw/ccid-card-passthru.c +++ b/hw/ccid-card-passthru.c @@ -150,6 +150,7 @@ static void ccid_card_vscard_handle_message(PassthruState *card, error_report("ATR size exceeds spec, ignoring"); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_GENERAL_ERROR); + break; } memcpy(card->atr, data, scr_msg_header->length); card->atr_length = scr_msg_header->length; -- cgit v1.2.3