| commit | 363ba1c72fed4425e7917afc36722584aaeaad8a | |
| author | Stefan Hajnoczi <stefanha@redhat.com> | |
| Mon, 15 Sep 2014 16:40:06 +0000 (15 18:40 +0200) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Fri, 31 Oct 2014 16:01:59 +0000 (31 17:01 +0100) | ||
| tree | fa244724f2f8ce9b94b696c730a418af9f3c8780 | treesnapshot (tar.gz zip) |
| parent | a2e9011b4164894594bf0b2a2a59e9c55c58c17b | commitdiff |
ivshmem: validate incoming_posn value from server
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem
server on the host sends invalid values.
Cc: Cam Macdonell <cam@cs.ualberta.ca>
Reported-by: Sebastian Krahmer <krahmer@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
[AF: Tighten upper bound check for posn in close_guest_eventfds()]
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Check incoming_posn to avoid out-of-bounds array accesses if the ivshmem
server on the host sends invalid values.
Cc: Cam Macdonell <cam@cs.ualberta.ca>
Reported-by: Sebastian Krahmer <krahmer@suse.de>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
[AF: Tighten upper bound check for posn in close_guest_eventfds()]
Cc: qemu-stable@nongnu.org
Signed-off-by: Andreas Färber <afaerber@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/misc/ivshmem.c | diffblobblamehistory |