]> git.proxmox.com Git - mirror_qemu.git/commit
virtio-serial: fix heap-over-flow
authorlinzhecheng <linzhecheng@huawei.com>
Wed, 28 Mar 2018 13:34:35 +0000 (21:34 +0800)
committerMichael S. Tsirkin <mst@redhat.com>
Mon, 9 Apr 2018 14:35:46 +0000 (17:35 +0300)
commitd434e5ac5d70e9da7d20e50246af9251a125bdad
tree52220b1e922e7b615d38b109f820025275c1ec06
parente7b94a84b6cb4a632c558ed24e8d6f4baa3f75eb
virtio-serial: fix heap-over-flow

Check device having the feature of VIRTIO_CONSOLE_F_EMERG_WRITE before
get config->emerg_wr. It is neccessary because sizeof(virtio_console_config)
is 8 byte if VirtIOSerial doesn't have the feature of
VIRTIO_CONSOLE_F_EMERG_WRITE(see virtio_serial_device_realize),
read/write emerg_wr will lead to heap-over-flow.

Signed-off-by: linzhecheng <linzhecheng@huawei.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
hw/char/virtio-serial-bus.c