]> git.ipfire.org Git - thirdparty/qemu.git/commit
ahci: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 3 Apr 2014 16:51:18 +0000 (19:51 +0300)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 26 Jun 2014 19:00:54 +0000 (14:00 -0500)
commitd34e6f796097bd46d1bf8b26916df757d54aba03
treeaa176079b8fc71082a3493bf5e48afe8f778c7f0
parent5544b7e419fd47f6ad4552d30189e3a922acdfb1
ahci: fix buffer overrun on invalid state load

CVE-2013-4526

Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded.  So
we use the old version of ports to read the array but then allow any
value for ports.  This can cause the code to overflow.

There's no reason to migrate ports - it never changes.
So just make sure it matches.

Reported-by: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit ae2158ad6ce0845b2fae2a22aa7f19c0d7a71ce5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/ide/ahci.c