Asias He 846424350b scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344] ...

r->buf is hardcoded to 2056 which is (256 + 1) * 8, allowing 256 luns at
most. If more than 256 luns are specified by user, we have buffer
overflow in scsi_target_emulate_report_luns.

To fix, we allocate the buffer dynamically.

Signed-off-by: Asias He <asias@redhat.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2013-10-09 17:24:18 +02:00

..

acpi

aio / timers: Switch entire codebase to the new timer API

2013-08-22 19:14:24 +02:00

arm

hw/arm/pic_cpu: Remove the now-unneeded arm_pic_init_cpu()

2013-08-20 14:54:31 +01:00

audio

isa: QOM'ify ISADevice

2013-06-07 14:55:33 +02:00

block

fdc: QOM'ify ISA floppy controller

2013-04-29 08:27:47 -05:00

char

lm32_juart: QOM cast cleanup

2013-07-29 21:06:28 +02:00

cpu

target-i386: Move APIC to ICC bus

2013-05-01 13:06:07 +02:00

cris

…

i2c

…

i386

smbios: Make multiple -smbios type= accumulate sanely

2013-09-28 23:49:39 +03:00

input

input: introduce keyboard handler list

2013-04-24 11:50:18 -05:00

isa

isa: Fix documentation of isa_register_portio_list()

2013-08-30 21:15:44 +02:00

kvm

…

lm32

lm32_juart: Relocate and tidy header

2013-07-29 21:06:27 +02:00

m68k

…

mips

hw/mips: align initrd to 64KB to avoid kernel error

2013-07-29 00:27:35 +02:00

misc

…

nvram

fw_cfg: add API to find FW cfg object

2013-06-02 18:14:14 +03:00

pci

pc,pci,virtio fixes and cleanups

2013-09-30 17:15:01 -05:00

pci-host

q35: Fix typo in constant DEFUALT -> DEFAULT.

2013-09-20 20:09:23 +04:00

ppc

pseries: Add H_SET_MODE hcall to change guest exception endianness

2013-09-02 10:06:42 +02:00

s390x

s390/sclplmconsole: Add support for SCLP line-mode console

2013-09-20 13:55:30 +02:00

scsi

scsi: Allocate SCSITargetReq r->buf dynamically [CVE-2013-4344]

2013-10-09 17:24:18 +02:00

sh4

…

sparc

firmware_abi: move to include/hw/nvram/

2013-06-02 18:13:54 +03:00

timer

m48t59: QOM cast cleanup for M48t59SysBusState

2013-07-29 21:07:01 +02:00

unicore32

…

virtio

virtio-blk: do not relay a previous driver's WCE configuration to the current

2013-09-20 19:27:48 +02:00

xen

pc: Initializing ram_memory under Xen.

2013-09-09 16:22:19 +00:00

boards.h

hw: Clean up bogus default boot order

2013-08-28 10:16:47 +03:00

bt.h

Preparation for usb-bt-dongle conditional build

2013-09-10 11:14:41 +02:00

devices.h

arm: fix location of some include files

2013-04-15 15:16:01 +02:00

elf_ops.h

…

empty_slot.h

…

hw.h

linux-user: Fix compilation failure

2013-06-27 15:38:35 -05:00

ide.h

…

irq.h

…

loader.h

loader: store FW CFG ROM files in RAM

2013-08-21 00:18:39 +03:00

pcmcia.h

…

ptimer.h

…

qdev-core.h

qdev: Pass size to qbus_create_inplace()

2013-08-30 21:15:35 +02:00

qdev-dma.h

…

qdev-properties.h

qdev: Add SIZE type to qdev properties

2013-07-29 19:33:33 -05:00

qdev.h

…

sd.h

…

ssi.h

…

stream.h

Trivial grammar and spelling fixes

2013-05-01 20:55:21 +04:00

sysbus.h

sysbus: QOM parent field cleanup for SysBusDevice

2013-07-29 21:07:03 +02:00

usb.h

Remove dev-bluetooth.c dependency from vl.c

2013-09-10 11:14:42 +02:00

xilinx.h

stream: Remove app argument hack

2013-04-16 10:04:23 +02:00