Code: static void rng_egd_request_entropy(RngBackend *b, size_t size,
                                    EntropyReceiveFunc *receive_entropy,
                                    void *opaque)
 {
     RngEgd *s = RNG_EGD(b);
    RngRequest *req;
    req = g_malloc(sizeof(*req));
    req->offset = 0;
    req->size = size;
    req->receive_entropy = receive_entropy;
    req->opaque = opaque;
    req->data = g_malloc(req->size);
 
     while (size > 0) {
         uint8_t header[2];
    req = g_malloc(sizeof(*req));

    req->offset = 0;
    req->size = size;
    req->receive_entropy = receive_entropy;
    req->opaque = opaque;
    req->data = g_malloc(req->size);
 
         size -= len;
     }
    s->parent.requests = g_slist_append(s->parent.requests, req);
 }

Vulnerability Type: DoS Overflow Mem. Corr.
CWE ID: CWE-119
Summary: QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.
Commit Message: 