diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2025-03-17 20:24:19 +1100 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2025-03-20 20:33:18 +0100 |
| commit | 37d9f374d9f0c47c092f80a5d85d4505ae4a9af7 (patch) | |
| tree | f1c2a67f9f4ccd512d6d8a2f97cc4c0cfff50e87 /contrib/qemu | |
| parent | c48331ca51399fe1779529511be395b576aaf0af (diff) | |
| download | passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar.gz passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar.bz2 passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar.lz passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar.xz passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.tar.zst passt-37d9f374d9f0c47c092f80a5d85d4505ae4a9af7.zip | |
packet: Avoid integer overflows in packet_get_do()
In packet_get_do() both offset and len are essentially untrusted. We do
some validation of len (check it's < PACKET_MAX_LEN), but that's not enough
to ensure that (len + offset) doesn't overflow. Rearrange our calculation
to make sure it's safe regardless of the given offset & len values.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/qemu')
0 files changed, 0 insertions, 0 deletions