Skip to content
Snippets Groups Projects
user avatar
chaojianhu authored
The .receive callback of xlnx.xps-ethernetlite doesn't check the length
of data before calling memcpy. As a result, the NetClientState object in
heap will be overflowed. All versions of qemu with xlnx.xps-ethernetlite
will be affected.

Reported-by: default avatarchaojianhu <chaojianhu@hotmail.com>
Signed-off-by: default avatarchaojianhu <chaojianhu@hotmail.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
a0d1cbda
History