Re: [Qemu-stable] [PATCH v4 19/30] pxa2xx: avoid buffer overrun on incoming migration

[Don Koch]

On Mon, 31 Mar 2014 17:17:08 +0300
"Michael S. Tsirkin" <address@hidden> wrote:

> CVE-2013-4533
> 
> s->rx_level is read from the wire and used to determine how many bytes
> to subsequently read into s->rx_fifo[]. If s->rx_level exceeds the
> length of s->rx_fifo[] the buffer can be overrun with arbitrary data
> from the wire.
> 
> Fix this by validating rx_level against the size of s->rx_fifo.
> 
> Cc: Don Koch <address@hidden>
> Reported-by: Michael Roth <address@hidden>
> Signed-off-by: Michael S. Tsirkin <address@hidden>

Reviewed-by: Don Koch <address@hidden>

-d