| commit | e58ccf039650065a9442de43c9816f81e88f27f6 | |
| author | Prasad J Pandit <pjp@fedoraproject.org> | |
| Fri, 26 Oct 2018 19:43:14 +0000 (27 01:13 +0530) | ||
| committer | Paolo Bonzini <pbonzini@redhat.com> | |
| Tue, 6 Nov 2018 20:35:05 +0000 (6 21:35 +0100) | ||
| tree | 5f5849f8c32a89d97a874594c7c335074ab227a9 | treesnapshot (tar.gz zip) |
| parent | 7f135356564bc776083b7ecee81096ab49e670e4 | commitdiff |
lsi53c895a: check message length value is valid
While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.
Discovered by Deja vu Security. Reported by Oracle.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20181026194314.18663-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.
Discovered by Deja vu Security. Reported by Oracle.
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20181026194314.18663-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| hw/scsi/lsi53c895a.c | diffblobblamehistory |