Michael S. Tsirkin
719ffe1f5f
usb: fix up post load checks
...
Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow
First of the issues was reported by dgilbert.
Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
2014-05-14 15:24:52 +02:00
..
2014-05-07 21:00:43 +04:00
2014-05-07 12:13:42 +03:00
2014-02-11 22:57:12 +10:00
2014-05-05 22:15:02 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2013-12-24 18:02:18 +01:00
2014-02-03 14:04:00 +00:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-05 22:15:02 +02:00
2014-05-14 15:24:51 +02:00
2014-05-08 14:20:00 -04:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-05 20:58:33 +02:00
2014-02-04 19:47:39 +01:00
2014-05-13 09:12:40 +10:00
2014-05-07 21:00:43 +04:00
2014-05-14 15:24:51 +02:00
2014-03-05 03:06:46 +01:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-08 14:19:59 -04:00
2014-02-10 10:27:00 +02:00
2014-05-14 15:24:51 +02:00
2014-03-19 22:23:13 +01:00
2014-05-07 21:00:43 +04:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-05-14 15:24:51 +02:00
2014-03-13 19:52:47 +01:00
2014-02-27 10:01:41 +00:00
2014-05-05 22:15:02 +02:00
2014-05-14 15:24:51 +02:00
2014-03-05 09:52:04 +01:00
2014-05-14 15:24:52 +02:00
2014-05-07 14:51:21 +01:00
2014-05-05 20:58:33 +02:00
2014-05-07 18:38:39 +01:00
2014-05-07 16:14:50 +00:00
2014-02-24 04:47:01 +04:00
2014-03-04 09:20:49 +05:30