]> git.ipfire.org Git - thirdparty/qemu.git/commit
projects / thirdparty / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d92a768) | patch
ssi-sd: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Mon, 28 Apr 2014 13:08:14 +0000 (16:08 +0300)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 26 Jun 2014 19:19:48 +0000 (14:19 -0500)
commit45edb0ca7a8a527ecf9fb36180df4b9664a9227c
tree9166e788c7d3deb4314326b04f5b2b0915f35923tree
parentd92a7683e8cc4d3daab1ae9197f9311a72c9d1e6commit | diff
ssi-sd: fix buffer overrun on invalid state load

CVE-2013-4537

s->arglen is taken from wire and used as idx
in ssi_sd_transfer().

Validate it before access.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit a9c380db3b8c6af19546a68145c8d1438a09c92b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/sd/ssi-sd.c diff | blob | blame | history
Mirror of https://git.qemu.org/git/qemu.git