Google Git
Sign in
qemu / qemu / c8eac1cfa1e9104a658b4614ada758861b8d823a
commitc8eac1cfa1e9104a658b4614ada758861b8d823a[log] [tgz]
authorMichael S. Tsirkin <mst@redhat.com>Mon Jun 20 13:42:27 2011 +0300
committerMichael S. Tsirkin <mst@redhat.com>Sun Jul 17 18:47:34 2011 +0300
tree6f8207e0e7a006386d6cec4d7aa1634f4282254d
parent0d2b962d16feaf1eb1a4658a4c1b85642418cd07 [diff]
virtio: fix indirect descriptor buffer overflow

We were previously allowing arbitrarily-long indirect descriptors, which
could lead to a buffer overflow in qemu-kvm process.

CVE-2011-2212

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
1 file changed
tree: 6f8207e0e7a006386d6cec4d7aa1634f4282254d
  1. audio/
  2. block/
  3. bsd-user/
  4. darwin-user/
  5. default-configs/
  6. docs/
  7. fpu/
  8. fsdev/
  9. gdb-xml/
  10. hw/
  11. libcacard/
  12. linux-headers/
  13. linux-user/
  14. net/
  15. pc-bios/
  16. QMP/
  17. roms/
  18. scripts/
  19. slirp/
  20. sysconfigs/
  21. target-alpha/
  22. target-arm/
  23. target-cris/
  24. target-i386/
  25. target-lm32/
  26. target-m68k/
  27. target-microblaze/
  28. target-mips/
  29. target-ppc/
  30. target-s390x/
  31. target-sh4/
  32. target-sparc/
  33. target-unicore32/
  34. tcg/
  35. tests/
  36. ui/
  37. .gitignore
  38. .gitmodules
  39. a.out.h
  40. acl.c
  41. acl.h
  42. aes.c
  43. aes.h
  44. aio.c
  45. alpha-dis.c
  46. alpha.ld
  47. arch_init.c
  48. arch_init.h
  49. arm-dis.c
  50. arm-semi.c
  51. arm.ld
  52. async.c
  53. balloon.c
  54. balloon.h
  55. bitmap.c
  56. bitmap.h
  57. bitops.c
  58. bitops.h
  59. block-migration.c
  60. block-migration.h
  61. block.c
  62. block.h
  63. block_int.h
  64. blockdev.c
  65. blockdev.h
  66. bswap.h
  67. bt-host.c
  68. bt-host.h
  69. bt-vhci.c
  70. buffered_file.c
  71. buffered_file.h
  72. cache-utils.c
  73. cache-utils.h
  74. Changelog
  75. check-qdict.c
  76. check-qfloat.c
  77. check-qint.c
  78. check-qjson.c
  79. check-qlist.c
  80. check-qstring.c
  81. cmd.c
  82. cmd.h
  83. CODING_STYLE
  84. compatfd.c
  85. compatfd.h
  86. config.h
  87. configure
  88. console.c
  89. console.h
  90. COPYING
  91. COPYING.LIB
  92. cpu-all.h
  93. cpu-common.h
  94. cpu-defs.h
  95. cpu-exec.c
  96. cpus.c
  97. cpus.h
  98. cris-dis.c
  99. cursor.c
  100. cursor_hidden.xpm
  101. cursor_left_ptr.xpm
  102. cutils.c
  103. def-helper.h
  104. device_tree.c
  105. device_tree.h
  106. dis-asm.h
  107. disas.c
  108. disas.h
  109. dma-helpers.c
  110. dma.h
  111. dyngen-exec.h
  112. elf.h
  113. envlist.c
  114. envlist.h
  115. error.c
  116. error.h
  117. error_int.h
  118. exec-all.h
  119. exec.c
  120. gdbstub.c
  121. gdbstub.h
  122. gen-icount.h
  123. HACKING
  124. hmp-commands.hx
  125. host-utils.c
  126. host-utils.h
  127. hpet.h
  128. hppa-dis.c
  129. hppa.ld
  130. i386-dis.c
  131. i386.ld
  132. ia64-dis.c
  133. ia64.ld
  134. input.c
  135. iohandler.c
  136. ioport-user.c
  137. ioport.c
  138. ioport.h
  139. iorange.h
  140. iov.c
  141. iov.h
  142. json-lexer.c
  143. json-lexer.h
  144. json-parser.c
  145. json-parser.h
  146. json-streamer.c
  147. json-streamer.h
  148. kvm-all.c
  149. kvm-stub.c
  150. kvm.h
  151. libfdt_env.h
  152. LICENSE
  153. linux-aio.c
  154. m68k-dis.c
  155. m68k-semi.c
  156. m68k.ld
  157. MAINTAINERS
  158. Makefile
  159. Makefile.dis
  160. Makefile.hw
  161. Makefile.objs
  162. Makefile.target
  163. Makefile.user
  164. microblaze-dis.c
  165. migration-exec.c
  166. migration-fd.c
  167. migration-tcp.c
  168. migration-unix.c
  169. migration.c
  170. migration.h
  171. mips-dis.c
  172. mips.ld
  173. module.c
  174. module.h
  175. monitor.c
  176. monitor.h
  177. nbd.c
  178. nbd.h
  179. net.c
  180. net.h
  181. notify.c
  182. notify.h
  183. os-posix.c
  184. os-win32.c
  185. osdep.c
  186. osdep.h
  187. oslib-posix.c
  188. oslib-win32.c
  189. path.c
  190. pci-ids.txt
  191. pflib.c
  192. pflib.h
  193. poison.h
  194. posix-aio-compat.c
  195. ppc-dis.c
  196. ppc.ld
  197. ppc64.ld
  198. qbool.c
  199. qbool.h
  200. qdict-test-data.txt
  201. qdict.c
  202. qdict.h
  203. qemu-aio.h
  204. qemu-barrier.h
  205. qemu-char.c
  206. qemu-char.h
  207. qemu-common.h
  208. qemu-config.c
  209. qemu-config.h
  210. qemu-doc.texi
  211. qemu-error.c
  212. qemu-error.h
  213. qemu-img-cmds.hx
  214. qemu-img.c
  215. qemu-img.texi
  216. qemu-io.c
  217. qemu-lock.h
  218. qemu-log.h
  219. qemu-malloc.c
  220. qemu-nbd.c
  221. qemu-nbd.texi
  222. qemu-objects.h
  223. qemu-option.c
  224. qemu-option.h
  225. qemu-options.h
  226. qemu-options.hx
  227. qemu-os-posix.h
  228. qemu-os-win32.h
  229. qemu-progress.c
  230. qemu-queue.h
  231. qemu-sockets.c
  232. qemu-tech.texi
  233. qemu-thread-posix.c
  234. qemu-thread-posix.h
  235. qemu-thread-win32.c
  236. qemu-thread-win32.h
  237. qemu-thread.h
  238. qemu-timer-common.c
  239. qemu-timer.c
  240. qemu-timer.h
  241. qemu-tool.c
  242. qemu-x509.h
  243. qemu.sasl
  244. qemu_socket.h
  245. qerror.c
  246. qerror.h
  247. qfloat.c
  248. qfloat.h
  249. qint.c
  250. qint.h
  251. qjson.c
  252. qjson.h
  253. qlist.c
  254. qlist.h
  255. qmp-commands.hx
  256. qobject.h
  257. qstring.c
  258. qstring.h
  259. range.h
  260. readline.c
  261. readline.h
  262. README
  263. rules.mak
  264. rwhandler.c
  265. rwhandler.h
  266. s390-dis.c
  267. s390.ld
  268. savevm.c
  269. sh4-dis.c
  270. simpletrace.c
  271. simpletrace.h
  272. softmmu-semi.h
  273. softmmu_defs.h
  274. softmmu_exec.h
  275. softmmu_header.h
  276. softmmu_template.h
  277. sparc-dis.c
  278. sparc.ld
  279. sparc64.ld
  280. spice-qemu-char.c
  281. sysemu.h
  282. targphys.h
  283. tcg-runtime.c
  284. thunk.c
  285. thunk.h
  286. TODO
  287. trace-events
  288. translate-all.c
  289. uboot_image.h
  290. usb-bsd.c
  291. usb-linux.c
  292. usb-stub.c
  293. user-exec.c
  294. VERSION
  295. version.rc
  296. vgafont.h
  297. vl.c
  298. x86_64.ld
  299. xen-all.c
  300. xen-mapcache-stub.c
  301. xen-mapcache.c
  302. xen-mapcache.h
  303. xen-stub.c