From: Li Qiang <liq3ea@163.com>
Date: Fri, 28 Jun 2019 16:13:58 +0000 (-0700)
Subject: virtio-gpu: check if the resource already exists in virtio_gpu_load()
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=b0ee78ff31617937f44161bde7515a67c88748c7;p=qemu.git

virtio-gpu: check if the resource already exists in virtio_gpu_load()

While loading virtio-gpu, the data can be malicious, we
should check if the resource already exists.

Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20190628161358.10400-1-liq3ea@163.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 475a018c02..25d9e327fc 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1002,6 +1002,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
 
     resource_id = qemu_get_be32(f);
     while (resource_id != 0) {
+        res = virtio_gpu_find_resource(g, resource_id);
+        if (res) {
+            return -EINVAL;
+        }
+
         res = g_new0(struct virtio_gpu_simple_resource, 1);
         res->resource_id = resource_id;
         res->width = qemu_get_be32(f);