Michael S. Tsirkin 2003205fd2 virtio: validate config_len on load ... Malformed input can have config_len in migration stream exceed the array size allocated on destination, the result will be heap overflow. To fix, that config_len matches on both sides. CVE-2014-0182 Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Juan Quintela <quintela@redhat.com> -- v2: use %ix and %zx to print config_len values Signed-off-by: Juan Quintela <quintela@redhat.com> (cherry picked from commit a890a2f913) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>		2014-06-26 14:31:48 -05:00
..
dataplane	virtio: clear signalled_used_valid when switching from dataplane	2013-08-12 12:19:04 +03:00
Makefile.objs	virtio: Implement MMIO based virtio transport	2013-07-19 12:58:47 +01:00
vhost.c	vhost: clear signalled_used_valid on vhost stop	2013-08-12 12:25:17 +03:00
virtio-balloon.c	virtio-balloon: switch exit callback to VirtioDeviceClass	2014-02-20 21:36:15 -06:00
virtio-bus.c	virtio-bus: cleanup plug/unplug interface	2014-02-20 21:36:15 -06:00
virtio-mmio.c	virtio-bus: remove vdev field	2014-02-20 21:36:14 -06:00
virtio-pci.c	virtio-pci: add device_unplugged callback	2014-02-20 21:36:15 -06:00
virtio-pci.h	virtio-pci: remove vdev field	2014-02-20 21:36:15 -06:00
virtio-rng.c	virtio-rng: switch exit callback to VirtioDeviceClass	2014-02-20 21:36:15 -06:00
virtio.c	virtio: validate config_len on load	2014-06-26 14:31:48 -05:00