[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 07/36] ahci: fix buffer overrun on invalid state loa
From: |
Juan Quintela |
Subject: |
[Qemu-devel] [PATCH 07/36] ahci: fix buffer overrun on invalid state load |
Date: |
Mon, 5 May 2014 22:30:05 +0200 |
From: "Michael S. Tsirkin" <address@hidden>
CVE-2013-4526
Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So
we use the old version of ports to read the array but then allow any
value for ports. This can cause the code to overflow.
There's no reason to migrate ports - it never changes.
So just make sure it matches.
Reported-by: Anthony Liguori <address@hidden>
Signed-off-by: Michael S. Tsirkin <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Juan Quintela <address@hidden>
---
hw/ide/ahci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 50327ff..e57c583 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1293,7 +1293,7 @@ const VMStateDescription vmstate_ahci = {
VMSTATE_UINT32(control_regs.impl, AHCIState),
VMSTATE_UINT32(control_regs.version, AHCIState),
VMSTATE_UINT32(idp_index, AHCIState),
- VMSTATE_INT32(ports, AHCIState),
+ VMSTATE_INT32_EQUAL(ports, AHCIState),
VMSTATE_END_OF_LIST()
},
};
--
1.9.0
- [Qemu-devel] [PULL 00/36] migration queue, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 05/36] virtio-net: out-of-bounds buffer write on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 07/36] ahci: fix buffer overrun on invalid state load,
Juan Quintela <=
- [Qemu-devel] [PATCH 04/36] virtio-net: fix buffer overflow on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 03/36] vmstate: add VMSTATE_VALIDATE, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 01/36] vmstate: reduce code duplication, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 06/36] virtio: out-of-bounds buffer write on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 08/36] hpet: fix buffer overrun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 09/36] hw/pci/pcie_aer.c: fix buffer overruns on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 10/36] pl022: fix buffer overun on invalid state load, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 11/36] vmstate: fix buffer overflow in target-arm/machine.c, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 12/36] virtio: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05
- [Qemu-devel] [PATCH 14/36] pxa2xx: avoid buffer overrun on incoming migration, Juan Quintela, 2014/05/05