175 lines
4.1 KiB
Text
175 lines
4.1 KiB
Text
$NetBSD: patch-XSA138,v 1.1 2015/08/23 17:02:58 spz Exp $
|
|
|
|
patch for CVE-2015-5154 from XSA-138 from
|
|
http://xenbits.xen.org/xsa/xsa138-qemut-1.patch
|
|
http://xenbits.xen.org/xsa/xsa138-qemut-2.patch
|
|
http://xenbits.xen.org/xsa/xsa138-qemuu-1.patch
|
|
http://xenbits.xen.org/xsa/xsa138-qemuu-2.patch
|
|
http://xenbits.xen.org/xsa/xsa138-qemuu-3.patch
|
|
|
|
--- qemu-xen/hw/ide/core.c.orig 2015-06-10 11:43:51.000000000 +0000
|
|
+++ qemu-xen/hw/ide/core.c
|
|
@@ -1901,11 +1901,17 @@ void ide_data_writew(void *opaque, uint3
|
|
}
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 2 > s->data_end) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
*(uint16_t *)p = le16_to_cpu(val);
|
|
p += 2;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
}
|
|
|
|
uint32_t ide_data_readw(void *opaque, uint32_t addr)
|
|
@@ -1922,11 +1928,17 @@ uint32_t ide_data_readw(void *opaque, ui
|
|
}
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 2 > s->data_end) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
ret = cpu_to_le16(*(uint16_t *)p);
|
|
p += 2;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
return ret;
|
|
}
|
|
|
|
@@ -1943,11 +1955,17 @@ void ide_data_writel(void *opaque, uint3
|
|
}
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 4 > s->data_end) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
*(uint32_t *)p = le32_to_cpu(val);
|
|
p += 4;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
}
|
|
|
|
uint32_t ide_data_readl(void *opaque, uint32_t addr)
|
|
@@ -1964,11 +1982,17 @@ uint32_t ide_data_readl(void *opaque, ui
|
|
}
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 4 > s->data_end) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
ret = cpu_to_le32(*(uint32_t *)p);
|
|
p += 4;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
return ret;
|
|
}
|
|
|
|
--- qemu-xen/hw/ide/atapi.c.orig 2015-06-10 11:43:51.000000000 +0000
|
|
+++ qemu-xen/hw/ide/atapi.c
|
|
@@ -879,6 +879,7 @@ static void cmd_start_stop_unit(IDEState
|
|
|
|
if (pwrcnd) {
|
|
/* eject/load only happens for power condition == 0 */
|
|
+ ide_atapi_cmd_ok(s);
|
|
return;
|
|
}
|
|
|
|
--- qemu-xen-traditional/hw/ide.c.orig 2015-08-23 15:08:13.000000000 +0000
|
|
+++ qemu-xen-traditional/hw/ide.c
|
|
@@ -3006,11 +3006,17 @@ static void ide_data_writew(void *opaque
|
|
buffered_pio_write(s, addr, 2);
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 2 > s->data_end) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
*(uint16_t *)p = le16_to_cpu(val);
|
|
p += 2;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
}
|
|
|
|
static uint32_t ide_data_readw(void *opaque, uint32_t addr)
|
|
@@ -3025,11 +3031,17 @@ static uint32_t ide_data_readw(void *opa
|
|
buffered_pio_read(s, addr, 2);
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 2 > s->data_end) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
ret = cpu_to_le16(*(uint16_t *)p);
|
|
p += 2;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
return ret;
|
|
}
|
|
|
|
@@ -3044,11 +3056,17 @@ static void ide_data_writel(void *opaque
|
|
buffered_pio_write(s, addr, 4);
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 4 > s->data_end) {
|
|
+ return;
|
|
+ }
|
|
+
|
|
*(uint32_t *)p = le32_to_cpu(val);
|
|
p += 4;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
}
|
|
|
|
static uint32_t ide_data_readl(void *opaque, uint32_t addr)
|
|
@@ -3063,11 +3081,17 @@ static uint32_t ide_data_readl(void *opa
|
|
buffered_pio_read(s, addr, 4);
|
|
|
|
p = s->data_ptr;
|
|
+ if (p + 4 > s->data_end) {
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
ret = cpu_to_le32(*(uint32_t *)p);
|
|
p += 4;
|
|
s->data_ptr = p;
|
|
- if (p >= s->data_end)
|
|
+ if (p >= s->data_end) {
|
|
+ s->status &= ~DRQ_STAT;
|
|
s->end_transfer_func(s);
|
|
+ }
|
|
return ret;
|
|
}
|
|
|