david.venhoff/QEMU-Nyx-fork
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
QEMU-Nyx-fork/hw
History
Prasad J Pandit 97f4ed3b71 sd: limit 'req.cmd' while using as an array index 
While processing standard SD commands, the 'req.cmd' value could
lead to OOB read when used as an index into 'sd_cmd_type' or
'sd_cmd_class' arrays. Limit 'req.cmd' value to avoid such an
access.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1453315857-1352-1-git-send-email-ppandit@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2016-02-11 11:17:32 +00:00
..
9pfs
virtio: move allocation to virtqueue_pop/vring_pop
2016-02-06 20:39:07 +02:00
acpi
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
alpha
alpha: Clean up includes
2016-01-29 15:07:23 +00:00
arm
Use error_fatal to simplify obvious fatal errors (again)
2016-02-08 17:22:00 +01:00
audio
sb16: use IsaDma interface instead of global DMA_* functions
2016-02-03 11:28:58 -05:00
block
pc and misc cleanups and fixes, virtio optimizations
2016-02-08 11:25:31 +00:00
bt
hw: Clean up includes
2016-01-29 15:07:25 +00:00
char
virtio: introduce qemu_get/put_virtqueue_element
2016-02-06 20:44:08 +02:00
core
qapi: Drop unused 'kind' for struct/enum visit
2016-02-08 17:29:57 +01:00
cpu
hw: Clean up includes
2016-01-29 15:07:25 +00:00
cris
cris: Clean up includes
2016-01-29 15:07:24 +00:00
display
virtio: move allocation to virtqueue_pop/vring_pop
2016-02-06 20:39:07 +02:00
dma
dma: remove now useless DMA_* functions
2016-02-03 11:28:58 -05:00
gpio
hw: Clean up includes
2016-01-29 15:07:25 +00:00
i2c
hw: Clean up includes
2016-01-29 15:07:25 +00:00
i386
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
ide
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
input
virtio: move allocation to virtqueue_pop/vring_pop
2016-02-06 20:39:07 +02:00
intc
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
ipack
hw: Clean up includes
2016-01-29 15:07:25 +00:00
ipmi
ipmi_bmc_sim: Add break to correct watchdog NMI check
2016-02-09 15:46:54 +01:00
isa
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
lm32
lm32: Clean up includes
2016-01-29 15:07:22 +00:00
m68k
m68k: Clean up includes
2016-01-29 15:07:24 +00:00
mem
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
microblaze
microblaze: Clean up includes
2016-01-28 11:13:13 +00:00
mips
magnum: disable floppy DMA for now
2016-02-03 11:28:57 -05:00
misc
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
moxie
moxie: Clean up includes
2016-01-29 15:07:25 +00:00
net
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
nvram
hw: Clean up includes
2016-01-29 15:07:25 +00:00
openrisc
openrisc: Clean up includes
2016-01-29 15:07:24 +00:00
pci
fix MSI injection on Xen
2016-02-06 20:44:10 +02:00
pci-bridge
hw/pxb: add pxb devices to the bridge category
2016-02-06 20:44:08 +02:00
pci-host
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
pcmcia
hw: Clean up includes
2016-01-29 15:07:25 +00:00
ppc
qapi: Drop unused error argument for list and implicit struct
2016-02-08 17:29:57 +01:00
s390x
s390: Clean up includes
2016-01-29 15:07:22 +00:00
scsi
hw: Add support for LSI SAS1068 (mptsas) device
2016-02-09 15:45:26 +01:00
sd
sd: limit 'req.cmd' while using as an array index
2016-02-11 11:17:32 +00:00
sh4
sh4: Clean up includes
2016-01-29 15:07:24 +00:00
smbios
hw: Clean up includes
2016-01-29 15:07:25 +00:00
sparc
dma: remove now useless DMA_* functions
2016-02-03 11:28:58 -05:00
sparc64
dma: remove now useless DMA_* functions
2016-02-03 11:28:58 -05:00
ssi
hw: Clean up includes
2016-01-29 15:07:25 +00:00
timer
log: do not unnecessarily include qom/cpu.h
2016-02-03 09:19:10 +00:00
tpm
hw: Clean up includes
2016-01-29 15:07:25 +00:00
tricore
tricore: Clean up includes
2016-01-29 15:07:25 +00:00
unicore32
unicore: Clean up includes
2016-01-29 15:07:22 +00:00
usb
qom: Swap 'name' next to visitor in ObjectPropertyAccessor
2016-02-08 17:29:56 +01:00
vfio
hw/vfio: Clean up includes
2016-01-29 15:07:24 +00:00
virtio
qapi: Drop unused 'kind' for struct/enum visit
2016-02-08 17:29:57 +01:00
watchdog
hw: Clean up includes
2016-01-29 15:07:25 +00:00
xen
fix MSI injection on Xen
2016-02-06 20:44:10 +02:00
xenpv
xen: Clean up includes
2016-01-29 15:07:23 +00:00
xtensa
xtensa: Clean up includes
2016-01-29 15:07:24 +00:00
Makefile.objs
Add a base IPMI interface
2015-12-22 18:39:19 +02:00