Commit 14808578cc for qemu.org

commit 14808578ccbcd17d474c98bb53b60452888f8529
Author: Munkhbaatar Enkhbaatar <munkhuu0825@gmail.com>
Date:   Tue Dec 9 16:53:49 2025 +0800

    riscv_htif: reject invalid signature ranges (end <= begin)

    Prevents huge allocations and crashes caused by malformed HTIF signature
    addresses.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3205
    Signed-off-by: Munkhbaatar Enkhbaatar <munkhuu0825@gmail.com>
    Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
    Message-ID: <20251209085349.61510-1-munkhuu0825@gmail.com>
    [ Squashed with following commit to fix build failures
        hw/char/riscv_htif: Fix format specifier for uint64_t

        Message-ID: <20260415134826.1742308-1-chao.liu.zevorn@gmail.com>
        Signed-off-by: Chao Liu <chao.liu.zevorn@gmail.com>
    ]
    Tested-by: Tao Tang <tangtao1634@phytium.com.cn>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Signed-off-by: Chao Liu <chao.liu.zevorn@gmail.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/hw/char/riscv_htif.c b/hw/char/riscv_htif.c
index e9efab16e9..a53d2ace02 100644
--- a/hw/char/riscv_htif.c
+++ b/hw/char/riscv_htif.c
@@ -171,6 +171,12 @@ static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
                  * begin/end_signature symbols exist.
                  */
                 if (sig_file && begin_sig_addr && end_sig_addr) {
+                    if (end_sig_addr <= begin_sig_addr) {
+                        error_report("Invalid HTIF signature range:"
+                                     " begin=0x%" PRIx64 " end=0x%" PRIx64,
+                                     begin_sig_addr, end_sig_addr);
+                        return;
+                    }
                     uint64_t sig_len = end_sig_addr - begin_sig_addr;
                     char *sig_data = g_malloc(sig_len);
                     dma_memory_read(&address_space_memory, begin_sig_addr,