]> xenbits.xensource.com Git - qemu-upstream-4.4-testing.git/commit
projects / qemu-upstream-4.4-testing.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 755a427) | patch
virtio: validate config_len on load
authorMichael S. Tsirkin <mst@redhat.com>
Mon, 28 Apr 2014 13:08:23 +0000 (16:08 +0300)
committerStefano Stabellini <stefano.stabellini@eu.citrix.com>
Thu, 5 Mar 2015 14:53:21 +0000 (14:53 +0000)
commita86ea88b50d6a2931efcebdc2c3a350451f69b02
treea7a329eafa0ce8f5871f7156c63f334466737499tree
parent755a427b8badc74fbc992043184c2013bd12aed2commit | diff
virtio: validate config_len on load

Malformed input can have config_len in migration stream
exceed the array size allocated on destination, the
result will be heap overflow.

To fix, that config_len matches on both sides.

CVE-2014-0182

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
--

v2: use %ix and %zx to print config_len values
Signed-off-by: Juan Quintela <quintela@redhat.com>
hw/virtio/virtio.c diff | blob | history
Obsolete Upstream Qemu based repository for xen-4.4-testing