]> git.proxmox.com Git - mirror_qemu.git/commit
projects / mirror_qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: ae2158a) | patch
hpet: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 3 Apr 2014 16:51:23 +0000 (19:51 +0300)
committerJuan Quintela <quintela@redhat.com>
Mon, 5 May 2014 20:15:02 +0000 (22:15 +0200)
commit3f1c49e2136fa08ab1ef3183fd55def308829584
tree01e28bcbada1f1a759655926234448b5c6d8d0b0tree
parentae2158ad6ce0845b2fae2a22aa7f19c0d7a71ce5commit | diff
hpet: fix buffer overrun on invalid state load

CVE-2013-4527 hw/timer/hpet.c buffer overrun

hpet is a VARRAY with a uint8 size but static array of 32

To fix, make sure num_timers is valid using VMSTATE_VALID hook.

Reported-by: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
hw/timer/hpet.c diff | blob | blame | history
QEMU mirror