Re: [Qemu-stable] [PATCH v4 19/30] pxa2xx: avoid buffer overrun on incoming migration

[Peter Maydell]

On 31 March 2014 15:17, Michael S. Tsirkin <address@hidden> wrote:
> CVE-2013-4533
>
> s->rx_level is read from the wire and used to determine how many bytes
> to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the
> length of s->rx_fifo[] the buffer can be overrun with arbitrary data
> from the wire.
>
> Fix this by validating rx_level against the size of s->rx_fifo.
>
> Cc: Don Koch <address@hidden>
> Reported-by: Michael Roth <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>

Reviewed-by: Peter Maydell <address@hidden>

thanks
-- PMM