mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
qemu/hw
History
Michael S. Tsirkin a890a2f913 virtio: validate config_len on load 
Malformed input can have config_len in migration stream
exceed the array size allocated on destination, the
result will be heap overflow.

To fix, that config_len matches on both sides.

CVE-2014-0182

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>

--

v2: use %ix and %zx to print config_len values
Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-05 22:15:03 +02:00
..
9pfs
qerror.h: Remove QERR defines that are only used once
2014-04-25 09:19:59 -04:00
acpi
acpi: Assert sts array limit on AcpiCpuHotplug_add()
2014-03-18 16:08:43 +02:00
alpha
exec: Make stq_*_phys input an AddressSpace
2014-02-11 22:57:12 +10:00
arm
pxa2xx: avoid buffer overrun on incoming migration
2014-05-05 22:15:02 +02:00
audio
hda-audio: fix non-mixer codecs
2014-04-29 10:46:29 +02:00
block
block: Add errp to bdrv_new()
2014-04-22 12:00:20 +02:00
bt
…
char
char/serial: Fix emptyness handling
2014-04-07 14:51:32 +01:00
core
qerror.h: Remove QERR defines that are only used once
2014-04-25 09:19:59 -04:00
cpu
icc_bus: QOM'ify ICC
2013-12-24 18:02:18 +01:00
cris
cris: Remove the CRIS PIC glue
2014-02-03 14:04:00 +00:00
display
ssd0323: fix buffer overun on invalid state load
2014-05-05 22:15:02 +02:00
dma
qom: Add check() argument to object_property_add_link()
2014-03-19 22:23:13 +01:00
gpio
zaurus: fix buffer overrun on invalid state load
2014-05-05 22:15:02 +02:00
i2c
Fix grammar in comment
2014-04-18 10:33:36 +04:00
i386
misc: Use cpu_physical_memory_read and cpu_physical_memory_write
2014-04-27 13:04:18 +04:00
ide
ahci: fix buffer overrun on invalid state load
2014-05-05 22:15:02 +02:00
input
tsc210x: fix buffer overrun on invalid state load
2014-05-05 22:15:02 +02:00
intc
openpic: avoid buffer overrun on incoming migration
2014-05-05 22:15:03 +02:00
ipack
ipack: Move IndustryPack out of hw/char/
2014-02-14 21:11:53 +01:00
isa
QOM infrastructure fixes and device conversions
2014-02-20 13:05:48 +00:00
lm32
hw/lm32: print error if cpu model is not found
2014-02-04 19:47:39 +01:00
m68k
…
microblaze
xilinx: Delete hw/include/xilinx.h
2014-02-26 14:54:45 +10:00
mips
i2c: Rename i2c_bus to I2CBus
2014-02-14 16:22:31 +01:00
misc
qerror.h: Remove QERR defines that are only used once
2014-04-25 09:19:59 -04:00
moxie
moxie: fix load_elf() usage
2014-03-05 03:06:46 +01:00
net
virtio-net: out-of-bounds buffer write on load
2014-05-05 22:15:03 +02:00
nvram
vl.c: Extend get_boot_devices_list() to ignore suffixes
2014-03-20 02:40:07 +01:00
openrisc
…
pci
vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/
2014-05-05 22:15:03 +02:00
pci-bridge
pci/shpc: convert SHPC hotplug to use hotplug-handler API
2014-02-10 10:27:00 +02:00
pci-host
hw/pci-host/prep: Don't reverse IO accesses on bigendian hosts
2014-04-08 18:37:45 +01:00
pcmcia
qom: Add check() argument to object_property_add_link()
2014-03-19 22:23:13 +01:00
ppc
ppce500_spin: Initialize struct properly
2014-04-08 11:20:05 +02:00
s390x
qom: Add check() argument to object_property_add_link()
2014-03-19 22:23:13 +01:00
scsi
virtio-scsi: fix buffer overrun on invalid state load
2014-05-05 22:15:02 +02:00
sd
ssi-sd: fix buffer overrun on invalid state load
2014-05-05 22:15:03 +02:00
sh4
cputlb: Change tlb_flush() argument to CPUState
2014-03-13 19:52:47 +01:00
sparc
sun4m: Add Sun CG3 framebuffer initialisation function
2014-02-27 10:01:41 +00:00
sparc64
…
ssi
pl022: fix buffer overun on invalid state load
2014-05-05 22:15:02 +02:00
timer
hpet: fix buffer overrun on invalid state load
2014-05-05 22:15:02 +02:00
tpm
…
unicore32
console: add head to index to qemu consoles.
2014-03-05 09:52:04 +01:00
usb
usb: sanity check setup_index+setup_len in post_load
2014-05-05 22:15:03 +02:00
virtio
virtio: validate config_len on load
2014-05-05 22:15:03 +02:00
watchdog
qemu-option: Remove qemu_opts_create_nofail
2014-01-06 15:02:30 -05:00
xen
Call pci_piix3_xen_ide_unplug from unplug_disks
2014-02-20 17:28:08 +00:00
xtensa
hw/xtensa: add support for ML605 and KC705 FPGA board
2014-02-24 04:47:01 +04:00
Makefile.objs
hw/9pfs: Include virtio-9p-device.o in build
2014-03-04 09:20:49 +05:30