diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2018-10-27 01:13:14 +0530 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2018-11-06 21:35:05 +0100 |
| commit | e58ccf039650065a9442de43c9816f81e88f27f6 (patch) | |
| tree | 5f5849f8c32a89d97a874594c7c335074ab227a9 /hw/usb/dev-hid.c | |
| parent | 7f135356564bc776083b7ecee81096ab49e670e4 (diff) | |
lsi53c895a: check message length value is valid
While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.
Discovered by Deja vu Security. Reported by Oracle.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20181026194314.18663-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/usb/dev-hid.c')
0 files changed, 0 insertions, 0 deletions