Michael S. Tsirkin f217f379a8 pl022: fix buffer overun on invalid state load ... CVE-2013-4530 pl022.c did not bounds check tx_fifo_head and rx_fifo_head after loading them from file and before they are used to dereference array. Reported-by: Michael S. Tsirkin <mst@redhat.com Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit d8d0a0bc7e) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>		2014-06-26 14:02:16 -05:00
..
9pfs	hw/9pfs: Fix errno value for xattr functions	2013-10-05 13:05:28 +04:00
acpi	bswap.h: Remove le16_to_cpupu()	2013-11-05 19:57:46 -08:00
alpha	hw/alpha: Fix compiler warning (integer constant is too large)	2013-10-02 22:55:28 +04:00
arm	hw/arm/musicpal: Remove nonexistent CDTP2, CDTP3 registers	2014-02-27 09:38:31 -06:00
audio	adlib: fix patching of port I/O addresses	2014-02-21 14:15:35 -06:00
block	virtio-blk: switch exit callback to VirtioDeviceClass	2014-02-20 21:36:15 -06:00
bt	Preparation for usb-bt-dongle conditional build	2013-09-10 11:14:41 +02:00
char	virtio-serial: switch exit callback to VirtioDeviceClass	2014-02-20 21:36:15 -06:00
core	qdev-properties-system.c: Allow vlan or netdev for -device, not both	2013-11-22 09:47:00 +01:00
cpu	arm11mpcore: Split off RealView MPCore	2013-11-05 17:47:30 +01:00
cris	axis_dev88: Don't enforce use of kernel for qtest	2013-11-05 17:47:29 +01:00
display	sun4m: Add FCode ROM for TCX framebuffer	2013-11-21 17:38:52 +01:00
dma	qom: Pass available size to object_initialize()	2013-08-30 21:15:44 +02:00
gpio	gpio/zaurus: QOM cast cleanup	2013-07-29 21:06:57 +02:00
i2c	exynos4210_i2c: QOM cast cleanup	2013-07-29 21:07:02 +02:00
i386	acpi: fix tables for no-hpet configuration	2014-06-25 17:10:19 -05:00
ide	ahci: fix buffer overrun on invalid state load	2014-06-26 14:00:54 -05:00
input	aio / timers: Switch entire codebase to the new timer API	2013-08-22 19:14:24 +02:00
intc	hw/intc/arm_gic: Fix GIC_SET_LEVEL	2014-02-27 09:38:42 -06:00
isa	ich9: APIs for pc guest info	2013-10-14 17:48:52 +03:00
lm32	milkymist: Suppress -kernel/-bios/-drive error for qtest	2013-11-05 17:47:29 +01:00
m68k	an5206: Don't enforce use of kernel for qtest	2013-11-05 17:47:29 +01:00
microblaze	hw/microblaze: Add support for loading initrd images	2013-10-24 22:56:48 +02:00
mips	mips jazz: do not raise data bus exception when accessing invalid addresses	2013-11-21 17:39:22 +01:00
misc	hw/misc/arm_sysctl: Fix bad boundary check on mb clock accesses	2014-02-27 09:37:43 -06:00
moxie	memory: add owner argument to initialization functions	2013-07-04 17:42:44 +02:00
net	virtio-net: out-of-bounds buffer write on load	2014-06-26 13:59:56 -05:00
nvram	spapr: add vio-bus devices to categories	2013-11-08 04:33:18 +01:00
openrisc	openrisc-timer: Reduce overhead, Separate clock update functions	2013-11-20 21:46:45 +08:00
pci	hw/pci/pcie_aer.c: fix buffer overruns on invalid state load	2014-06-26 14:01:51 -05:00
pci-bridge	hw/pci-bridge: set PCI_INTERRUPT_PIN register before shpc init	2013-10-14 17:11:45 +03:00
pci-host	piix: fix 32bit pci hole	2014-02-20 21:59:18 -06:00
pcmcia	pcmcia/pxa2xx: QOM'ify PXA2xxPCMCIAState	2013-11-05 18:06:52 +01:00
ppc	PPC: BookE: Make FIT/WDT timers at best millisecond grained	2013-11-25 20:35:12 -08:00
s390x	s390x/virtio-hcall: Add range check for hypervisor call	2014-06-25 11:11:45 -05:00
scsi	megasas: Implement LD_LIST_QUERY	2014-06-25 16:02:25 -05:00
sd	sd: Avoid access to NULL BlockDriverState	2013-10-17 10:15:18 +02:00
sh4	shix: Don't require firmware presence for qtest	2013-11-05 17:47:29 +01:00
sparc	sun4m: Add FCode ROM for TCX framebuffer	2013-11-21 17:38:52 +01:00
sparc64	pc,pci,virtio fixes and cleanups	2013-09-03 12:31:07 -05:00
ssi	pl022: fix buffer overun on invalid state load	2014-06-26 14:02:16 -05:00
timer	hpet: fix buffer overrun on invalid state load	2014-06-26 14:01:11 -05:00
tpm	aio / timers: Untangle include files	2013-08-22 19:10:27 +02:00
unicore32	puv3: Turn puv3_load_kernel() into a no-op for qtest without -kernel	2013-11-05 17:47:28 +01:00
usb	usb: drop unused USBNetState.inpkt field	2013-11-13 15:48:38 +04:00
virtio	virtio: out-of-bounds buffer write on invalid state load	2014-06-26 14:00:35 -05:00
watchdog	aio / timers: Switch entire codebase to the new timer API	2013-08-22 19:14:24 +02:00
xen	qdev: Drop misleading qdev_free() function	2013-11-05 18:06:38 +01:00
xtensa	pc,pci,virtio fixes and cleanups	2013-09-03 12:31:07 -05:00
Makefile.objs	pcmcia: QOM'ify PCMCIACardState and MicroDriveState	2013-11-05 18:06:52 +01:00