4) CVE-2013-4529 hw/pci/pcie_aer.c pcie aer log can overrun the buffer if log_num is too large There are two issues in this file: 1. log_max from remote can be larger than on local then buffer will overrun with data coming from state file. 2. log_num can be larger then we get data corruption again with an overflow but not adversary controlled. Fix both issues. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Reported-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> |
||
---|---|---|
.. | ||
Makefile.objs | ||
msi.c | ||
msix.c | ||
pci-hotplug-old.c | ||
pci-stub.c | ||
pci.c | ||
pci_bridge.c | ||
pci_host.c | ||
pcie.c | ||
pcie_aer.c | ||
pcie_host.c | ||
pcie_port.c | ||
shpc.c | ||
slotid_cap.c |