ShuriZma
/
xemu
mirror of https://github.com/xemu-project/xemu.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
xemu/hw
History
Michael S. Tsirkin c4bd2e4cb0 usb: sanity check setup_index+setup_len in post_load 
CVE-2013-4541

s->setup_len and s->setup_index are fed into usb_packet_copy as
size/offset into s->data_buf, it's possible for invalid state to exploit
this to load arbitrary data.

setup_len and setup_index should be checked to make sure
they are not negative.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
(cherry picked from commit 9f8e9895c5)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
 		2014-06-26 14:22:06 -05:00
..
9pfs hw/9pfs: Fix errno value for xattr functions 2013-10-05 13:05:28 +04:00
acpi bswap.h: Remove le16_to_cpupu() 2013-11-05 19:57:46 -08:00
alpha hw/alpha: Fix compiler warning (integer constant is too large) 2013-10-02 22:55:28 +04:00
arm pxa2xx: avoid buffer overrun on incoming migration 2014-06-26 14:19:05 -05:00
audio adlib: fix patching of port I/O addresses 2014-02-21 14:15:35 -06:00
block virtio-blk: switch exit callback to VirtioDeviceClass 2014-02-20 21:36:15 -06:00
bt Preparation for usb-bt-dongle conditional build 2013-09-10 11:14:41 +02:00
char virtio-serial: switch exit callback to VirtioDeviceClass 2014-02-20 21:36:15 -06:00
core qdev-properties-system.c: Allow vlan or netdev for -device, not both 2013-11-22 09:47:00 +01:00
cpu arm11mpcore: Split off RealView MPCore 2013-11-05 17:47:30 +01:00
cris axis_dev88: Don't enforce use of kernel for qtest 2013-11-05 17:47:29 +01:00
display ssd0323: fix buffer overun on invalid state load 2014-06-26 14:20:52 -05:00
dma qom: Pass available size to object_initialize() 2013-08-30 21:15:44 +02:00
gpio zaurus: fix buffer overrun on invalid state load 2014-06-26 14:21:17 -05:00
i2c exynos4210_i2c: QOM cast cleanup 2013-07-29 21:07:02 +02:00
i386 acpi: fix tables for no-hpet configuration 2014-06-25 17:10:19 -05:00
ide ahci: fix buffer overrun on invalid state load 2014-06-26 14:00:54 -05:00
input tsc210x: fix buffer overrun on invalid state load 2014-06-26 14:21:02 -05:00
intc openpic: avoid buffer overrun on incoming migration 2014-06-26 14:18:27 -05:00
isa ich9: APIs for pc guest info 2013-10-14 17:48:52 +03:00
lm32 milkymist: Suppress -kernel/-bios/-drive error for qtest 2013-11-05 17:47:29 +01:00
m68k an5206: Don't enforce use of kernel for qtest 2013-11-05 17:47:29 +01:00
microblaze hw/microblaze: Add support for loading initrd images 2013-10-24 22:56:48 +02:00
mips mips jazz: do not raise data bus exception when accessing invalid addresses 2013-11-21 17:39:22 +01:00
misc hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses 2014-02-27 09:37:43 -06:00
moxie memory: add owner argument to initialization functions 2013-07-04 17:42:44 +02:00
net virtio-net: out-of-bounds buffer write on load 2014-06-26 13:59:56 -05:00
nvram spapr: add vio-bus devices to categories 2013-11-08 04:33:18 +01:00
openrisc openrisc-timer: Reduce overhead, Separate clock update functions 2013-11-20 21:46:45 +08:00
pci vmstate: s/VMSTATE_INT32_LE/VMSTATE_INT32_POSITIVE_LE/ 2014-06-26 14:21:46 -05:00
pci-bridge hw/pci-bridge: set PCI_INTERRUPT_PIN register before shpc init 2013-10-14 17:11:45 +03:00
pci-host piix: fix 32bit pci hole 2014-02-20 21:59:18 -06:00
pcmcia pcmcia/pxa2xx: QOM'ify PXA2xxPCMCIAState 2013-11-05 18:06:52 +01:00
ppc PPC: BookE: Make FIT/WDT timers at best millisecond grained 2013-11-25 20:35:12 -08:00
s390x s390x/virtio-hcall: Add range check for hypervisor call 2014-06-25 11:11:45 -05:00
scsi virtio-scsi: fix buffer overrun on invalid state load 2014-06-26 14:21:30 -05:00
sd ssi-sd: fix buffer overrun on invalid state load 2014-06-26 14:19:48 -05:00
sh4 shix: Don't require firmware presence for qtest 2013-11-05 17:47:29 +01:00
sparc sun4m: Add FCode ROM for TCX framebuffer 2013-11-21 17:38:52 +01:00
sparc64 pc,pci,virtio fixes and cleanups 2013-09-03 12:31:07 -05:00
ssi pl022: fix buffer overun on invalid state load 2014-06-26 14:02:16 -05:00
timer hpet: fix buffer overrun on invalid state load 2014-06-26 14:01:11 -05:00
tpm aio / timers: Untangle include files 2013-08-22 19:10:27 +02:00
unicore32 puv3: Turn puv3_load_kernel() into a no-op for qtest without -kernel 2013-11-05 17:47:28 +01:00
usb usb: sanity check setup_index+setup_len in post_load 2014-06-26 14:22:06 -05:00
virtio virtio: validate num_sg when mapping 2014-06-26 14:18:51 -05:00
watchdog aio / timers: Switch entire codebase to the new timer API 2013-08-22 19:14:24 +02:00
xen qdev: Drop misleading qdev_free() function 2013-11-05 18:06:38 +01:00
xtensa pc,pci,virtio fixes and cleanups 2013-09-03 12:31:07 -05:00
Makefile.objs pcmcia: QOM'ify PCMCIACardState and MicroDriveState 2013-11-05 18:06:52 +01:00