diff options
| author | Alistair Francis <alistair.francis@xilinx.com> | 2015-10-06 10:40:41 -0700 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2015-10-12 11:17:45 +0100 |
| commit | 9201bb9a8c7cd3ba2382b7db5b2e40f603e61528 (patch) | |
| tree | 131b06da5d5ab464f77a00bd67704c0234989b2d /docs/qmp-intro.txt | |
| parent | c84b31926f018af6fea2ab37a1fc47060b4bcfa1 (diff) | |
| download | hqemu-9201bb9a8c7cd3ba2382b7db5b2e40f603e61528.zip hqemu-9201bb9a8c7cd3ba2382b7db5b2e40f603e61528.tar.gz | |
sdhci.c: Limit the maximum block size
It is possible for the guest to set an invalid block
size which is larger then the fifo_buffer[] array. This
could cause a buffer overflow.
To avoid this limit the maximum size of the blksize variable.
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Peter Crosthwaite <crosthwaite.peter@gmail.com>
Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com
Suggested-by: Igor Mitsyanko <i.mitsyanko@gmail.com>
Reported-by: Intel Security ATR <secure@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'docs/qmp-intro.txt')
0 files changed, 0 insertions, 0 deletions
