dfaggioli/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

audio: intel-hda: check stream entry count during transfer

Browse Source 
Intel HDA emulator uses stream of buffers during DMA data
transfers. Each entry has buffer length and buffer pointer
position, which are used to derive bytes to 'copy'. If this
length and buffer pointer were to be same, 'copy' could be
set to zero(0), leading to an infinite loop. Add check to
avoid it.

Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Prasad J Pandit
2016-10-20 13:10:24 +05:30
committed by Gerd Hoffmann
parent ede0cbeb78
commit e02b54e4f9
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
hw/audio/intel-hda.c
View File

@@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
} }
left = len; left = len;
while (left > 0) { s = st->bentries;
while (left > 0 && s-- > 0) {
copy = left; copy = left;
if (copy > st->bsize - st->lpib) if (copy > st->bsize - st->lpib)
copy = st->bsize - st->lpib; copy = st->bsize - st->lpib;