]> git.ipfire.org Git - thirdparty/qemu.git/commit
zaurus: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 3 Apr 2014 16:52:13 +0000 (19:52 +0300)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Thu, 26 Jun 2014 19:21:17 +0000 (14:21 -0500)
commit8d948a000d4963fe5ef20ba8478a0119b659c4ad
treee3818edb7904803d984d22575d4890a842d0e12c
parentc75e43b871fb0a777ae1101a26a42ea213f7aff6
zaurus: fix buffer overrun on invalid state load

CVE-2013-4540

Within scoop_gpio_handler_update, if prev_level has a high bit set, then
we get bit > 16 and that causes a buffer overrun.

Since prev_level comes from wire indirectly, this can
happen on invalid state load.

Similarly for gpio_level and gpio_dir.

To fix, limit to 16 bit.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit 52f91c3723932f8340fe36c8ec8b18a757c37b2b)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/gpio/zaurus.c