Description:
A red hat security member has posted information about a heap overflow
in the qemu usb stack. See below for quoted message:

--------
Hello,

Correct post load checks:
1. dev->setup_len == sizeof(dev->data_buf)
seems fine, no need to fail migration
2. When state is DATA, passing index > len
will cause memcpy with negative length,
resulting in heap overflow

An user able to alter the saved VM data(either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

Upstream fix:
-------------
-> http://article.gmane.org/gmane.comp.emulators.qemu/272322

Thank you.
--
Prasad J Pandit / Red Hat Security Response Team