)]}'
{
  "commit": "3c3ce981423e0d6c18af82ee62f1850c2cda5976",
  "tree": "12f422b21500202e9e270287615edf098bb73072",
  "parents": [
    "52f91c3723932f8340fe36c8ec8b18a757c37b2b"
  ],
  "author": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Thu Apr 03 19:52:17 2014 +0300"
  },
  "committer": {
    "name": "Juan Quintela",
    "email": "quintela@redhat.com",
    "time": "Mon May 05 22:15:02 2014 +0200"
  },
  "message": "virtio-scsi: fix buffer overrun on invalid state load\n\nCVE-2013-4542\n\nhw/scsi/scsi-bus.c invokes load_request.\n\n virtio_scsi_load_request does:\n    qemu_get_buffer(f, (unsigned char *)\u0026req-\u003eelem, sizeof(req-\u003eelem));\n\nthis probably can make elem invalid, for example,\nmake in_num or out_num huge, then:\n\n    virtio_scsi_parse_req(s, vs-\u003ecmd_vqs[n], req);\n\nwill do:\n\n    if (req-\u003eelem.out_num \u003e 1) {\n        qemu_sgl_init_external(req, \u0026req-\u003eelem.out_sg[1],\n                               \u0026req-\u003eelem.out_addr[1],\n                               req-\u003eelem.out_num - 1);\n    } else {\n        qemu_sgl_init_external(req, \u0026req-\u003eelem.in_sg[1],\n                               \u0026req-\u003eelem.in_addr[1],\n                               req-\u003eelem.in_num - 1);\n    }\n\nand this will access out of array bounds.\n\nNote: this adds security checks within assert calls since\nSCSIBusInfo\u0027s load_request cannot fail.\nFor now simply disable builds with NDEBUG - there seems\nto be little value in supporting these.\n\nCc: Andreas Färber \u003cafaerber@suse.de\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Juan Quintela \u003cquintela@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b0d7517cb1273b453498ec7fa096ef754bd8b9d1",
      "old_mode": 33188,
      "old_path": "hw/scsi/virtio-scsi.c",
      "new_id": "175219376c91c9f866ff1f338474d85cd6c37977",
      "new_mode": 33188,
      "new_path": "hw/scsi/virtio-scsi.c"
    }
  ]
}