e498311693
Fix incorrect use of sizeof() rather than ARRAY_SIZE() to guard
accesses into the mb_clock[] array, which was allowing a malicious
guest to overwrite the end of the array.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Message-id: 1392647854-8067-2-git-send-email-peter.maydell@linaro.org
Cc: qemu-stable@nongnu.org
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| macio | ||
| Makefile.objs | ||
| a9scu.c | ||
| applesmc.c | ||
| arm11scu.c | ||
| arm_integrator_debug.c | ||
| arm_l2x0.c | ||
| arm_sysctl.c | ||
| cbus.c | ||
| debugexit.c | ||
| eccmemctl.c | ||
| exynos4210_pmu.c | ||
| imx_ccm.c | ||
| ivshmem.c | ||
| lm32_sys.c | ||
| max111x.c | ||
| milkymist-hpdmc.c | ||
| milkymist-pfpu.c | ||
| mst_fpga.c | ||
| omap_clk.c | ||
| omap_gpmc.c | ||
| omap_l4.c | ||
| omap_sdrc.c | ||
| omap_tap.c | ||
| pc-testdev.c | ||
| pci-testdev.c | ||
| puv3_pm.c | ||
| pvpanic.c | ||
| sga.c | ||
| slavio_misc.c | ||
| tmp105.c | ||
| tmp105.h | ||
| vfio.c | ||
| vmport.c | ||
| zynq_slcr.c | ||