Code: static int ssi_sd_load(QEMUFile *f, void *opaque, int version_id)
{
    SSISlave *ss = SSI_SLAVE(opaque);
    ssi_sd_state *s = (ssi_sd_state *)opaque;
    int i;

    if (version_id != 1)
        return -EINVAL;

    s->mode = qemu_get_be32(f);
    s->cmd = qemu_get_be32(f);
    for (i = 0; i < 4; i++)
        s->cmdarg[i] = qemu_get_be32(f);
     for (i = 0; i < 5; i++)
         s->response[i] = qemu_get_be32(f);
     s->arglen = qemu_get_be32(f);
     s->response_pos = qemu_get_be32(f);
     s->stopping = qemu_get_be32(f);
 
     ss->cs = qemu_get_be32(f);
    s->mode = SSI_SD_CMD;
    dinfo = drive_get_next(IF_SD);
    s->sd = sd_init(dinfo ? dinfo->bdrv : NULL, true);
    if (s->sd == NULL) {
        return -1;
    }
    register_savevm(dev, "ssi_sd", -1, 1, ssi_sd_save, ssi_sd_load, s);
    return 0;
}

Vulnerability Type: Exec Code
CWE ID: CWE-94
Summary: The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.
Commit Message: 