Re: [Qemu-devel] [PATCH v5 05/24] virtio-net: out-of-bounds buffer write on load

On 3 April 2014 17:50, Michael S. Tsirkin wrote: > CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in > virtio_net_load()@hw/net/virtio-net.c > >> } else if (n->mac_table.in_use) { >> uint8_t *buf = g_malloc0(n->mac_table.in_use); > > We are allocating buffer of size n->mac

[Qemu-devel] [PATCH v5 05/24] virtio-net: out-of-bounds buffer write on load

CVE-2013-4149 QEMU 1.3.0 out-of-bounds buffer write in virtio_net_load()@hw/net/virtio-net.c > } else if (n->mac_table.in_use) { > uint8_t *buf = g_malloc0(n->mac_table.in_use); We are allocating buffer of size n->mac_table.in_use > qemu_get_buffer(f, buf, n->mac_