diff options
| author | Igor Mammedov | 2013-01-28 12:49:26 +0100 |
|---|---|---|
| committer | Gleb Natapov | 2013-01-29 07:57:56 +0100 |
| commit | f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c (patch) | |
| tree | 6ed3ddd6099dd6ee8b7be7aa47a0d2958d97f528 /scripts | |
| parent | vmxcap: bit 9 of VMX_PROCBASED_CTLS2 is 'virtual interrupt delivery' (diff) | |
| download | qemu-f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c.tar.gz qemu-f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c.tar.xz qemu-f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c.zip | |
target-i386: kvm: prevent buffer overflow if -cpu foo, [x]level is too big
Stack corruption may occur if too big 'level' or 'xlevel' values passed
on command line with KVM enabled, due to limited size of cpuid_data
in kvm_arch_init_vcpu().
reproduces with:
qemu -enable-kvm -cpu qemu64,level=4294967295
or
qemu -enable-kvm -cpu qemu64,xlevel=4294967295
Check if there is space in cpuid_data before passing it to cpu_x86_cpuid()
or abort() if there is not space.
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Andreas Faerber <afaerber@suse.de>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Diffstat (limited to 'scripts')
0 files changed, 0 insertions, 0 deletions