diff options
| author | Alistair Francis | 2015-10-06 19:40:41 +0200 |
|---|---|---|
| committer | Stefan Hajnoczi | 2015-10-12 12:17:45 +0200 |
| commit | 9201bb9a8c7cd3ba2382b7db5b2e40f603e61528 (patch) | |
| tree | 131b06da5d5ab464f77a00bd67704c0234989b2d /docs | |
| parent | block: switch from g_slice allocator to malloc (diff) | |
| download | qemu-9201bb9a8c7cd3ba2382b7db5b2e40f603e61528.tar.gz qemu-9201bb9a8c7cd3ba2382b7db5b2e40f603e61528.tar.xz qemu-9201bb9a8c7cd3ba2382b7db5b2e40f603e61528.zip | |
sdhci.c: Limit the maximum block size
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com
Suggested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'docs')
0 files changed, 0 insertions, 0 deletions