2ebafc854d
After reading the extension header, offset is incremented, but not checked against end_offset any more. This way an integer overflow could happen when checking whether the extension end is within the allowed range, effectively disabling the check. This patch adds the missing check and a test case for it. Cc: qemu-stable@nongnu.org Reported-by: Max Reitz <mreitz@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> Reviewed-by: Max Reitz <mreitz@redhat.com> Message-id: 1416935562-7760-2-git-send-email-kwolf@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> |
||
---|---|---|
.. | ||
acpi-test-data | ||
image-fuzzer | ||
libqos | ||
multiboot | ||
qapi-schema | ||
qemu-iotests | ||
tcg | ||
vmstate-static-checker-data | ||
.gitignore | ||
ac97-test.c | ||
ahci-test.c | ||
bios-tables-test.c | ||
boot-order-test.c | ||
check-block.sh | ||
check-qdict.c | ||
check-qfloat.c | ||
check-qint.c | ||
check-qjson.c | ||
check-qlist.c | ||
check-qom-interface.c | ||
check-qstring.c | ||
display-vga-test.c | ||
drive_del-test.c | ||
e1000-test.c | ||
eepro100-test.c | ||
endianness-test.c | ||
es1370-test.c | ||
fdc-test.c | ||
fw_cfg-test.c | ||
hd-geo-test.c | ||
i440fx-test.c | ||
i82801b11-test.c | ||
ide-test.c | ||
intel-hda-test.c | ||
ioh3420-test.c | ||
ipoctal232-test.c | ||
libqtest.c | ||
libqtest.h | ||
m48t59-test.c | ||
Makefile | ||
ne2000-test.c | ||
nvme-test.c | ||
pcnet-test.c | ||
pvpanic-test.c | ||
qemu-iotests-quick.sh | ||
qom-test.c | ||
rtc-test.c | ||
rtl8139-test.c | ||
spapr-phb-test.c | ||
test-aio.c | ||
test-bitops.c | ||
test-coroutine.c | ||
test-cutils.c | ||
test-hbitmap.c | ||
test-int128.c | ||
test-iov.c | ||
test-mul64.c | ||
test-opts-visitor.c | ||
test-qdev-global-props.c | ||
test-qemu-opts.c | ||
test-qmp-commands.c | ||
test-qmp-event.c | ||
test-qmp-input-strict.c | ||
test-qmp-input-visitor.c | ||
test-qmp-output-visitor.c | ||
test-rfifolock.c | ||
test-string-input-visitor.c | ||
test-string-output-visitor.c | ||
test-thread-pool.c | ||
test-throttle.c | ||
test-visitor-serialization.c | ||
test-vmstate.c | ||
test-x86-cpuid.c | ||
test-xbzrle.c | ||
tmp105-test.c | ||
tpci200-test.c | ||
usb-hcd-ehci-test.c | ||
usb-hcd-ohci-test.c | ||
usb-hcd-uhci-test.c | ||
usb-hcd-xhci-test.c | ||
vhost-user-test.c | ||
virtio-9p-test.c | ||
virtio-balloon-test.c | ||
virtio-blk-test.c | ||
virtio-console-test.c | ||
virtio-net-test.c | ||
virtio-rng-test.c | ||
virtio-scsi-test.c | ||
virtio-serial-test.c | ||
vmxnet3-test.c | ||
wdt_ib700-test.c |