]> git.ipfire.org Git - thirdparty/qemu.git/commit
projects / thirdparty / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: eb55958) | patch
ssi-sd: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Mon, 28 Apr 2014 13:08:14 +0000 (16:08 +0300)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Mon, 21 Jul 2014 03:05:55 +0000 (22:05 -0500)
commit95d9149ed3d0edfbb5223ceee03022498bc86155
tree9ff5d9de1dec4a2f82713accb9afaef334e22e52tree
parenteb55958e189aecc2c52b08e1aeb11715b668a5abcommit | diff
ssi-sd: fix buffer overrun on invalid state load

CVE-2013-4537

s->arglen is taken from wire and used as idx
in ssi_sd_transfer().

Validate it before access.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit a9c380db3b8c6af19546a68145c8d1438a09c92b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/sd/ssi-sd.c diff | blob | blame | history
Mirror of https://git.qemu.org/git/qemu.git