Michael S. Tsirkin
3f1c49e213
hpet: fix buffer overrun on invalid state load
CVE-2013-4527 hw/timer/hpet.c buffer overrun hpet is a VARRAY with a uint8 size but static array of 32 To fix, make sure num_timers is valid using VMSTATE_VALID hook. Reported-by: Anthony Liguori <anthony@codemonkey.ws> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com>
…
…
…
…
…
…
…
…
Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org - QEMU team
Description
Languages
C
83.1%
C++
6.3%
Python
3.2%
Dylan
2.8%
Shell
1.6%
Other
2.8%