[Qemu-devel] [ Patch ] for CVE-2015-3242

[罗大龙]

/qemu-2.3.0/hw/arm/pxa2xx.c

--- pxa2xx.c.new    2015-06-15 17:40:59.285002592 +0800
+++ pxa2xx.c    2015-06-15 17:43:47.001002592 +0800
@@ -1986,6 +1986,10 @@
 
     s->rx_len = qemu_get_byte(f);
     s->rx_start = 0;
+   if (s->rx_len < 0 || s->rx_len > ARRAY_SIZE(s->rx_fifo)) {
+       return -EINVAL;
+   }
+
     for (i = 0; i < s->rx_len; i ++)
         s->rx_fifo[i] = qemu_get_byte(f);