Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ahci: fix buffer overrun on invalid state load
CVE-2013-4526 Within hw/ide/ahci.c, VARRAY refers to ports which is also loaded. So we use the old version of ports to read the array but then allow any value for ports. This can cause the code to overflow. There's no reason to migrate ports - it never changes. So just make sure it matches. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit ae2158a) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
- Loading branch information