Michael S. Tsirkin a890a2f913 virtio: validate config_len on load ... Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com>		2014-05-05 22:15:03 +02:00
..
dataplane	dataplane: fix shadowed return value	2014-01-22 13:48:18 +01:00
Makefile.objs
vhost.c
virtio-balloon.c	virtio-balloon: don't hardcode config size value	2014-01-15 23:34:17 +04:00
virtio-bus.c	virtio-bus: cleanup plug/unplug interface	2013-12-09 21:46:48 +01:00
virtio-mmio.c	virtio-bus: remove vdev field	2013-12-09 21:46:48 +01:00
virtio-pci.c	qom: Add check() argument to object_property_add_link()	2014-03-19 22:23:13 +01:00
virtio-pci.h	virtio-pci: remove vdev field	2013-12-09 21:46:48 +01:00
virtio-rng.c	virtio-rng: Avoid default_backend refcount leak	2014-03-19 22:23:47 +01:00
virtio.c	virtio: validate config_len on load	2014-05-05 22:15:03 +02:00