| commit | 719ffe1f5f72b1c7ace4afe9ba2815bcb53a829e | |
| author | Michael S. Tsirkin <mst@redhat.com> | |
| Tue, 13 May 2014 09:33:16 +0000 (13 12:33 +0300) | ||
| committer | Juan Quintela <quintela@trasno.org> | |
| Wed, 14 May 2014 13:24:52 +0000 (14 15:24 +0200) | ||
| tree | f3a928ff50a684a2d630338c454b4627d5e13b36 | treesnapshot (tar.gz zip) |
| parent | d6ed7312d11995409bd53ef8f1a743d8877880d2 | commitdiff |
usb: fix up post load checks
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
First of the issues was reported by dgilbert.
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
First of the issues was reported by dgilbert.
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
| hw/usb/bus.c | diffblobblamehistory |