aboutsummaryrefslogtreecommitdiff
path: root/hw/serial.c
diff options
context:
space:
mode:
authorRoland Dreier <rdreier@cisco.com>2010-01-05 20:43:34 -0800
committerAnthony Liguori <aliguori@us.ibm.com>2010-01-11 09:56:30 -0600
commitf2d928d44ebc918750c94f3605c1417f1f653ec9 (patch)
tree7f1e6940b95b59320d1aea373681f7138be1d985 /hw/serial.c
parente73223a5849d9e695b5f3b5a4a2a812e68e3735d (diff)
vmware_vga: Check cursor dimensions passed from guest to avoid buffer overflow
Check that the cursor dimensions passed from the guest for the DEFINE_CURSOR command don't overflow the available space in the cursor.image[] or cursor.mask[] arrays before copying data from the guest into those arrays. Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw/serial.c')
0 files changed, 0 insertions, 0 deletions