diff options
| author | Michael S. Tsirkin <mst@redhat.com> | 2014-04-03 19:52:09 +0300 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2014-06-26 14:21:02 -0500 |
| commit | c75e43b871fb0a777ae1101a26a42ea213f7aff6 (patch) | |
| tree | 6366164210d0ac57d73ca54ed41a1604ce59b218 /hw/gpio/zaurus.c | |
| parent | af443645c3383f26a309d200413649ecac9ac58f (diff) | |
tsc210x: fix buffer overrun on invalid state load
CVE-2013-4539
s->precision, nextprecision, function and nextfunction
come from wire and are used
as idx into resolution[] in TSC_CUT_RESOLUTION.
Validate after load to avoid buffer overrun.
Cc: Andreas Färber <afaerber@suse.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit 5193be3be35f29a35bc465036cd64ad60d43385f)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw/gpio/zaurus.c')
0 files changed, 0 insertions, 0 deletions