]> Git Repo - qemu.git/commit
segfault due to buffer overrun in usb-serial
authorDavid S. Ahern <[email protected]>
Wed, 3 Feb 2010 16:00:54 +0000 (09:00 -0700)
committerAnthony Liguori <[email protected]>
Wed, 10 Feb 2010 18:45:11 +0000 (12:45 -0600)
commit4ab4183d766f10f9fc35cd9ef4acee39f241986f
treefe08cdf3b851f07c72eb46146e63cfebed1984cd
parent8e65b7c04965c8355e4ce43211582b6b83054e3d
segfault due to buffer overrun in usb-serial

This fixes a segfault due to buffer overrun in the usb-serial device.
The memcpy was incrementing the start location by recv_used yet, the
computation of first_size (how much to write at the end of the buffer
before wrapping to the front) was not accounting for it. This causes the
next element after the receive buffer (recv_ptr) to get overwritten with
random data.

Signed-off-by: David Ahern <[email protected]>
Signed-off-by: Anthony Liguori <[email protected]>
hw/usb-serial.c
This page took 0.02713 seconds and 4 git commands to generate.