diff options
| author | Igor Mammedov <imammedo@redhat.com> | 2013-01-28 12:49:26 +0100 |
|---|---|---|
| committer | Gleb Natapov <gleb@redhat.com> | 2013-01-29 08:57:56 +0200 |
| commit | f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c (patch) | |
| tree | 6ed3ddd6099dd6ee8b7be7aa47a0d2958d97f528 /target-arm | |
| parent | f9e90c798dc84be2b0b988517e86b49faf79d5dc (diff) | |
| download | hqemu-f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c.zip hqemu-f8bb056564ed719b2fa5e05028bc70aeb0cc5c6c.tar.gz | |
target-i386: kvm: prevent buffer overflow if -cpu foo, [x]level is too big
Stack corruption may occur if too big 'level' or 'xlevel' values passed
on command line with KVM enabled, due to limited size of cpuid_data
in kvm_arch_init_vcpu().
reproduces with:
qemu -enable-kvm -cpu qemu64,level=4294967295
or
qemu -enable-kvm -cpu qemu64,xlevel=4294967295
Check if there is space in cpuid_data before passing it to cpu_x86_cpuid()
or abort() if there is not space.
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Andreas Faerber <afaerber@suse.de>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Diffstat (limited to 'target-arm')
0 files changed, 0 insertions, 0 deletions
