Skip to content
Commit a0d1cbda authored by chaojianhu's avatar chaojianhu Committed by Jason Wang
Browse files

hw/net: Fix a heap overflow in xlnx.xps-ethernetlite



The .receive callback of xlnx.xps-ethernetlite doesn't check the length
of data before calling memcpy. As a result, the NetClientState object in
heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite
will be affected.

Reported-by: default avatarchaojianhu <chaojianhu@hotmail.com>
Signed-off-by: default avatarchaojianhu <chaojianhu@hotmail.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent 6c352ca9
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment