From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:45879)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lersek@redhat.com>) id 1UVgsN-0000oQ-1z
	for qemu-devel@nongnu.org; Fri, 26 Apr 2013 07:31:42 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <lersek@redhat.com>) id 1UVgsJ-0004vy-CJ
	for qemu-devel@nongnu.org; Fri, 26 Apr 2013 07:31:38 -0400
Received: from mx1.redhat.com ([209.132.183.28]:52041)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <lersek@redhat.com>) id 1UVgsJ-0004vq-5E
	for qemu-devel@nongnu.org; Fri, 26 Apr 2013 07:31:35 -0400
Message-ID: <517A661E.1000309@redhat.com>
Date: Fri, 26 Apr 2013 13:33:50 +0200
From: Laszlo Ersek <lersek@redhat.com>
MIME-Version: 1.0
References: <1366875807-3491-1-git-send-email-jasowang@redhat.com>
	<87fvyebbwb.fsf@codemonkey.ws> <20130425210242.GB2908@redhat.com>
	<878v461c1k.fsf@codemonkey.ws> <517A0B3D.1020202@redhat.com>
	<517A57AB.60804@redhat.com>
In-Reply-To: <517A57AB.60804@redhat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] virtio: abort on zero config length
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Eric Blake <eblake@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>, Anthony Liguori <aliguori@us.ibm.com>, qemu-devel@nongnu.org

On 04/26/13 12:32, Eric Blake wrote:
> On 04/25/2013 11:06 PM, Jason Wang wrote:
>>>>     if (addr > (vdev->config_len - sizeof(val)))
>>>>
>>>> ^^^^^^^^^ quiz: spot a bug above if config_len is 0    :)
>>> Then we need to fix these bugs and allocate a CVE.  virtio-rng has
>>> shipped.  This code is also dumb.
>>
>> Ok, but since the discussion is in public list, no need for CVE then.
> 
> Wrong.  CVEs are useful even for publicly disclosed bugs.  It tells
> people whether they need to upgrade in order to avoid a vulnerability.

Small addition (since my English parser turns "whether" into "whether or
not"): a CVE tells people *that* (not "if") they should upgrade. Lack of
a CVE mention in a commit doesn't imply -- at least in, ugh, another big
project -- that the fix is without security consequences ("no CVE fix, I
don't need it").

(Apologies for hair-splitting.)

Laszlo