OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
d7f053652f
qemu-e2k/hw
History
Michael S. Tsirkin d7f053652f cadence_gem: fix buffer overflow 
gem_transmit copies a packet from guest into an tx_packet[2048]
array on stack, with size limited by descriptor length set by guest.  If
guest is malicious and specifies a descriptor length that is too large,
and should packet size exceed array size, this results in a buffer
overflow.

Reported-by: 刘令 <liuling-it@360.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
2016-02-04 13:22:06 +08:00
..
9pfs 9pfs: Clean up includes 2016-01-29 15:07:23 +00:00
acpi x86: Clean up includes 2016-01-29 15:07:22 +00:00
alpha alpha: Clean up includes 2016-01-29 15:07:23 +00:00
arm hw/arm/virt: Add always-on property to the virt board timer 2016-01-21 14:15:07 +00:00
audio audio: Clean up includes 2016-02-02 13:57:31 +01:00
block virtio-blk: Functions for op blocker management 2016-02-02 17:50:46 +01:00
bt hw: Clean up includes 2016-01-29 15:07:25 +00:00
char hw: Clean up includes 2016-01-29 15:07:25 +00:00
core hw/core: Clean up includes 2016-01-29 15:07:25 +00:00
cpu hw: Clean up includes 2016-01-29 15:07:25 +00:00
cris cris: Clean up includes 2016-01-29 15:07:24 +00:00
display virtio-gpu: block any rendering until client (ui) is done 2016-02-03 10:41:36 +01:00
dma hw: Clean up includes 2016-01-29 15:07:25 +00:00
gpio hw: Clean up includes 2016-01-29 15:07:25 +00:00
i2c hw: Clean up includes 2016-01-29 15:07:25 +00:00
i386 x86: Clean up includes 2016-01-29 15:07:22 +00:00
ide macio: add dma_active to VMStateDescription 2016-01-30 23:37:36 +11:00
input hw: Clean up includes 2016-01-29 15:07:25 +00:00
intc hw/intc: Clean up includes 2016-01-29 15:07:24 +00:00
ipack hw: Clean up includes 2016-01-29 15:07:25 +00:00
ipmi hw: Clean up includes 2016-01-29 15:07:25 +00:00
isa hw: Clean up includes 2016-01-29 15:07:25 +00:00
lm32 lm32: Clean up includes 2016-01-29 15:07:22 +00:00
m68k m68k: Clean up includes 2016-01-29 15:07:24 +00:00
mem hw: Clean up includes 2016-01-29 15:07:25 +00:00
microblaze microblaze: Clean up includes 2016-01-28 11:13:13 +00:00
mips mips: Clean up includes 2016-01-23 14:30:04 +00:00
misc ivshmem: use a single eventfd callback, get rid of CharDriver 2016-02-02 13:28:58 +01:00
moxie moxie: Clean up includes 2016-01-29 15:07:25 +00:00
net cadence_gem: fix buffer overflow 2016-02-04 13:22:06 +08:00
nvram hw: Clean up includes 2016-01-29 15:07:25 +00:00
openrisc openrisc: Clean up includes 2016-01-29 15:07:24 +00:00
pci pci: Clean up includes 2016-01-29 15:07:24 +00:00
pci-bridge pci: Clean up includes 2016-01-29 15:07:24 +00:00
pci-host uninorth.c: add support for UniNorth kMacRISCPCIAddressSelect (0x48) register 2016-01-30 23:37:38 +11:00
pcmcia hw: Clean up includes 2016-01-29 15:07:25 +00:00
ppc target-ppc: Helper to determine page size information from hpte alone 2016-01-30 23:49:27 +11:00
s390x s390: Clean up includes 2016-01-29 15:07:22 +00:00
scsi virtio-scsi: Catch BDS-BB removal/insertion 2016-02-02 17:50:46 +01:00
sd hw: Clean up includes 2016-01-29 15:07:25 +00:00
sh4 sh4: Clean up includes 2016-01-29 15:07:24 +00:00
smbios hw: Clean up includes 2016-01-29 15:07:25 +00:00
sparc sparc: Clean up includes 2016-01-29 15:07:22 +00:00
sparc64 sparc: Clean up includes 2016-01-29 15:07:22 +00:00
ssi hw: Clean up includes 2016-01-29 15:07:25 +00:00
timer hw/timer: Clean up includes 2016-01-29 15:07:24 +00:00
tpm hw: Clean up includes 2016-01-29 15:07:25 +00:00
tricore tricore: Clean up includes 2016-01-29 15:07:25 +00:00
unicore32 unicore: Clean up includes 2016-01-29 15:07:22 +00:00
usb ehci: update irq on reset 2016-02-02 14:11:01 +01:00
vfio hw/vfio: Clean up includes 2016-01-29 15:07:24 +00:00
virtio virtio: Clean up includes 2016-01-29 15:07:23 +00:00
watchdog hw: Clean up includes 2016-01-29 15:07:25 +00:00
xen xen: Clean up includes 2016-01-29 15:07:23 +00:00
xenpv xen: Clean up includes 2016-01-29 15:07:23 +00:00
xtensa xtensa: Clean up includes 2016-01-29 15:07:24 +00:00
Makefile.objs Add a base IPMI interface 2015-12-22 18:39:19 +02:00