Wolfgang Bumiller 24fe899c3c hmp: fix sendkey out of bounds write (CVE-2015-8619) ... When processing 'sendkey' command, hmp_sendkey routine null terminates the 'keyname_buf' array. This results in an OOB write issue, if 'keyname_len' was to fall outside of 'keyname_buf' array. Since the keyname's length is known the keyname_buf can be removed altogether by adding a length parameter to index_from_key() and using it for the error output as well. Reported-by: Ling Liu <liuling-it@360.cn> Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com> Message-Id: <20160113080958.GA18934@olga> [Comparison with "<" dumbed down, test for junk after strtoul() tweaked] Signed-off-by: Markus Armbruster <armbru@redhat.com> (cherry picked from commit 64ffbe04ea) Conflicts: hmp.c *removed dependency on 7fb1cf16 Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>		2016-03-22 17:38:16 -05:00
..
block	block: set device_list.tqe_prev to NULL on BDS removal	2016-03-17 16:51:48 -05:00
crypto	…
disas	…
exec	translate-all: ensure host page mask is always extended with 1's	2015-12-02 13:12:30 +01:00
fpu	…
hw	migration: allow machine to enforce configuration section migration	2016-03-22 17:20:12 -05:00
libdecnumber	…
migration	…
monitor	…
net	…
qapi	qjson: surprise, allocating 6 QObjects per token is expensive	2015-11-26 10:07:07 +01:00
qemu	typedefs: Put them back into alphabetical order	2015-12-04 09:39:55 +03:00
qom	qom: Update documentation comment of struct Object	2015-12-03 20:10:22 +01:00
standard-headers	…
sysemu	oslib-win32: Change return type of function getpagesize	2015-11-30 06:47:02 +01:00
ui	hmp: fix sendkey out of bounds write (CVE-2015-8619)	2016-03-22 17:38:16 -05:00
config.h	…
elf.h	…
glib-compat.h	…
qemu-common.h	…
qemu-io.h	…
qjson.h	…
trace-tcg.h	…
trace.h	…