zaurus: fix buffer overrun on invalid state load
authorMichael S. Tsirkin <mst@redhat.com>
Thu, 3 Apr 2014 16:52:13 +0000 (19:52 +0300)
committerJuan Quintela <quintela@redhat.com>
Mon, 5 May 2014 20:15:02 +0000 (22:15 +0200)
commit52f91c3723932f8340fe36c8ec8b18a757c37b2b
treef331a24f6d414648c3994cc0a25e3bc6ae3059e4
parent5193be3be35f29a35bc465036cd64ad60d43385f
zaurus: fix buffer overrun on invalid state load

CVE-2013-4540

Within scoop_gpio_handler_update, if prev_level has a high bit set, then
we get bit > 16 and that causes a buffer overrun.

Since prev_level comes from wire indirectly, this can
happen on invalid state load.

Similarly for gpio_level and gpio_dir.

To fix, limit to 16 bit.

Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Juan Quintela <quintela@redhat.com>
hw/gpio/zaurus.c