-
由 Alistair Francis 提交于
It is possible for the guest to set an invalid block size which is larger then the fifo_buffer[] array. This could cause a buffer overflow. To avoid this limit the maximum size of the blksize variable. Signed-off-by: NAlistair Francis <alistair.francis@xilinx.com> Reported-by: NIntel Security ATR <secure@intel.com> Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com> Reviewed-by: NPeter Crosthwaite <crosthwaite.peter@gmail.com> Message-id: abe4c51f513290bbb85d1ee271cb1a3d463d7561.1444067470.git.alistair.francis@xilinx.com Suggested-by: NIgor Mitsyanko <i.mitsyanko@gmail.com> Reported-by: NIntel Security ATR <secure@intel.com> Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com> Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
9201bb9a