qemu/include/hw
Asias He 846424350b scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]
r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at
most. If more than 256 luns are specified by user, we have buffer
overflow in scsi_target_emulate_report_luns.

To fix, we allocate the buffer dynamically.

Signed-off-by: Asias He <asias@redhat.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2013-10-09 17:24:18 +02:00
..
acpi aio / timers: Switch entire codebase to the new timer API 2013-08-22 19:14:24 +02:00
arm hw/arm/pic_cpu: Remove the now-unneeded arm_pic_init_cpu() 2013-08-20 14:54:31 +01:00
audio isa: QOM'ify ISADevice 2013-06-07 14:55:33 +02:00
block fdc: QOM'ify ISA floppy controller 2013-04-29 08:27:47 -05:00
char lm32_juart: QOM cast cleanup 2013-07-29 21:06:28 +02:00
cpu target-i386: Move APIC to ICC bus 2013-05-01 13:06:07 +02:00
cris
i2c
i386 smbios: Make multiple -smbios type= accumulate sanely 2013-09-28 23:49:39 +03:00
input input: introduce keyboard handler list 2013-04-24 11:50:18 -05:00
isa isa: Fix documentation of isa_register_portio_list() 2013-08-30 21:15:44 +02:00
kvm
lm32 lm32_juart: Relocate and tidy header 2013-07-29 21:06:27 +02:00
m68k
mips hw/mips: align initrd to 64KB to avoid kernel error 2013-07-29 00:27:35 +02:00
misc
nvram fw_cfg: add API to find FW cfg object 2013-06-02 18:14:14 +03:00
pci pc,pci,virtio fixes and cleanups 2013-09-30 17:15:01 -05:00
pci-host q35: Fix typo in constant DEFUALT -> DEFAULT. 2013-09-20 20:09:23 +04:00
ppc pseries: Add H_SET_MODE hcall to change guest exception endianness 2013-09-02 10:06:42 +02:00
s390x s390/sclplmconsole: Add support for SCLP line-mode console 2013-09-20 13:55:30 +02:00
scsi scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344] 2013-10-09 17:24:18 +02:00
sh4
sparc firmware_abi: move to include/hw/nvram/ 2013-06-02 18:13:54 +03:00
timer m48t59: QOM cast cleanup for M48t59SysBusState 2013-07-29 21:07:01 +02:00
unicore32
virtio virtio-blk: do not relay a previous driver's WCE configuration to the current 2013-09-20 19:27:48 +02:00
xen pc: Initializing ram_memory under Xen. 2013-09-09 16:22:19 +00:00
boards.h hw: Clean up bogus default boot order 2013-08-28 10:16:47 +03:00
bt.h Preparation for usb-bt-dongle conditional build 2013-09-10 11:14:41 +02:00
devices.h arm: fix location of some include files 2013-04-15 15:16:01 +02:00
elf_ops.h
empty_slot.h
hw.h linux-user: Fix compilation failure 2013-06-27 15:38:35 -05:00
ide.h
irq.h
loader.h loader: store FW CFG ROM files in RAM 2013-08-21 00:18:39 +03:00
pcmcia.h
ptimer.h
qdev-core.h qdev: Pass size to qbus_create_inplace() 2013-08-30 21:15:35 +02:00
qdev-dma.h
qdev-properties.h qdev: Add SIZE type to qdev properties 2013-07-29 19:33:33 -05:00
qdev.h
sd.h
ssi.h
stream.h Trivial grammar and spelling fixes 2013-05-01 20:55:21 +04:00
sysbus.h sysbus: QOM parent field cleanup for SysBusDevice 2013-07-29 21:07:03 +02:00
usb.h Remove dev-bluetooth.c dependency from vl.c 2013-09-10 11:14:42 +02:00
xilinx.h stream: Remove app argument hack 2013-04-16 10:04:23 +02:00