diff options
| author | Markus Armbruster <armbru@redhat.com> | 2011-11-28 20:27:37 +0100 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2011-11-28 16:20:53 -0600 |
| commit | 7e62255a4b3e0e2ab84a3ec7398640e8ed58620a (patch) | |
| tree | 2e5ccd7d2f972ddb3cde2a977ab592f2a02f1f3e /fsdev/qemu-fsdev.c | |
| parent | aea317aaa5d92ee8789f976ccf105be67d956f5e (diff) | |
| download | focaccia-qemu-7e62255a4b3e0e2ab84a3ec7398640e8ed58620a.tar.gz focaccia-qemu-7e62255a4b3e0e2ab84a3ec7398640e8ed58620a.zip | |
ccid: Fix buffer overrun in handling of VSC_ATR message
ATR size exceeding the limit is diagnosed, but then we merrily use it anyway, overrunning card->atr[]. The message is read from a character device. Obvious security implications unless the other end of the character device is trusted. Spotted by Coverity. CVE-2011-4111. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'fsdev/qemu-fsdev.c')
0 files changed, 0 insertions, 0 deletions