aboutsummaryrefslogtreecommitdiff
path: root/vmstate.c
diff options
context:
space:
mode:
authorMichael S. Tsirkin <mst@redhat.com>2014-04-03 19:52:25 +0300
committerJuan Quintela <quintela@redhat.com>2014-05-05 22:15:03 +0200
commit9f8e9895c504149d7048e9fc5eb5cbb34b16e49a (patch)
tree4d13c798595979f4650e00acfb74a03fc54047da /vmstate.c
parent3476436a44c29725efef0cabf5b3ea4e70054d57 (diff)
usb: sanity check setup_index+setup_len in post_load
CVE-2013-4541 s->setup_len and s->setup_index are fed into usb_packet_copy as size/offset into s->data_buf, it's possible for invalid state to exploit this to load arbitrary data. setup_len and setup_index should be checked to make sure they are not negative. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
Diffstat (limited to 'vmstate.c')
0 files changed, 0 insertions, 0 deletions