]> git.ipfire.org Git - thirdparty/qemu.git/commit
tsc210x: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 3 Apr 2014 16:52:09 +0000 (19:52 +0300)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Mon, 21 Jul 2014 03:05:55 +0000 (22:05 -0500)
commit894f179e8d206b8ef544ea3680c6b433e7a9e3f9
tree665ef648cbc7266c55d4e54b3201e0f8cbb3ee47
parent2265c71b3548913becbd1f6427e715dbbe3b0d2e
tsc210x: fix buffer overrun on invalid state load

CVE-2013-4539

s->precision, nextprecision, function and nextfunction
come from wire and are used
as idx into resolution[] in TSC_CUT_RESOLUTION.

Validate after load to avoid buffer overrun.

Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/input/tsc210x.c