projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 767adce) | patch
ssi-sd: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Mon, 28 Apr 2014 13:08:14 +0000 (16:08 +0300)
committerJuan Quintela <quintela@redhat.com>
Mon, 5 May 2014 20:15:03 +0000 (22:15 +0200)
commita9c380db3b8c6af19546a68145c8d1438a09c92b
treef3f2b25a8591bbc8e9cfcdfdfccc291b88f6ffa2tree | snapshot
parent767adce2d9cd397de3418caa16be35ea18d56f22commit | diff
ssi-sd: fix buffer overrun on invalid state load

CVE-2013-4537

s->arglen is taken from wire and used as idx
in ssi_sd_transfer().

Validate it before access.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
hw/sd/ssi-sd.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.