pool/qemu
SHA256
4
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/qemu?expand=0&rev=23

Browse Source
This commit is contained in:
OBS User unknown 2008-03-11 16:56:39 +00:00 committed by Git OBS Bridge
parent 314bd315be
commit bd7498fa64
3 changed files with 121 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

108
bug-362956_qemu-block-rw-rangecheck.patch Normal file
View File

@ -0,0 +1,108 @@
diff --git a/block.c b/block.c
index 0f8ad7b..d7f1114 100644
--- a/block.c
+++ b/block.c
@@ -123,6 +123,24 @@ void path_combine(char *dest, int dest_size,
}
}
+static int bdrv_rw_badreq_sectors(BlockDriverState *bs,
+ int64_t sector_num, int nb_sectors)
+{
+ return
+ nb_sectors < 0 ||
+ nb_sectors > bs->total_sectors ||
+ sector_num > bs->total_sectors - nb_sectors;
+}
+
+static int bdrv_rw_badreq_bytes(BlockDriverState *bs,
+ int64_t offset, int count)
+{
+ int64_t size = bs->total_sectors << SECTOR_BITS;
+ return
+ count < 0 ||
+ count > size ||
+ offset > size - count;
+}
static void bdrv_register(BlockDriver *bdrv)
{
@@ -375,6 +393,7 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags,
}
bs->drv = drv;
bs->opaque = qemu_mallocz(drv->instance_size);
+ bs->total_sectors = 0; /* driver will set if it does not do getlength */
if (bs->opaque == NULL && drv->instance_size > 0)
return -1;
/* Note: for compatibility, we open disk image files as RDWR, and
@@ -440,6 +459,7 @@ void bdrv_close(BlockDriverState *bs)
bs->drv = NULL;
/* call the change callback */
+ bs->total_sectors = 0;
bs->media_changed = 1;
if (bs->change_cb)
bs->change_cb(bs->change_opaque);
@@ -505,6 +525,8 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num,
if (!drv)
return -ENOMEDIUM;
+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+ return -EDOM;
if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
memcpy(buf, bs->boot_sector_data, 512);
sector_num++;
@@ -545,6 +567,8 @@ int bdrv_write(BlockDriverState *bs, int64_t sector_num,
return -ENOMEDIUM;
if (bs->read_only)
return -EACCES;
+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+ return -EDOM;
if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
memcpy(bs->boot_sector_data, buf, 512);
}
@@ -670,6 +694,8 @@ int bdrv_pread(BlockDriverState *bs, int64_t offset,
return -ENOMEDIUM;
if (!drv->bdrv_pread)
return bdrv_pread_em(bs, offset, buf1, count1);
+ if (bdrv_rw_badreq_bytes(bs, offset, count1))
+ return -EDOM;
return drv->bdrv_pread(bs, offset, buf1, count1);
}
@@ -685,6 +711,8 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset,
return -ENOMEDIUM;
if (!drv->bdrv_pwrite)
return bdrv_pwrite_em(bs, offset, buf1, count1);
+ if (bdrv_rw_badreq_bytes(bs, offset, count1))
+ return -EDOM;
return drv->bdrv_pwrite(bs, offset, buf1, count1);
}
@@ -951,6 +979,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
return -ENOMEDIUM;
if (!drv->bdrv_write_compressed)
return -ENOTSUP;
+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+ return -EDOM;
return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
}
@@ -1097,6 +1127,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num,
if (!drv)
return NULL;
+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+ return NULL;
/* XXX: we assume that nb_sectors == 0 is suppored by the async read */
if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
@@ -1128,6 +1160,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num,
return NULL;
if (bs->read_only)
return NULL;
+ if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
+ return NULL;
if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
memcpy(bs->boot_sector_data, buf, 512);
}

5
qemu.changes
View File

@ -1,3 +1,8 @@
-------------------------------------------------------------------
Tue Mar 11 14:02:54 CET 2008 - uli@suse.de
- secfix (unchecked block read/write vulnerability, bug #362956)
-------------------------------------------------------------------
Thu Jan 17 15:19:54 CET 2008 - uli@suse.de

11
qemu.spec
View File

@ -10,6 +10,7 @@
# norootforbuild
Name: qemu
BuildRequires: SDL-devel bison e2fsprogs-devel
Url: http://fabrice.bellard.free.fr/qemu/
@ -17,7 +18,7 @@ License: BSD 3-Clause; GPL v2 or later; LGPL v2.1 or later; X11/MIT
Group: System/Emulators/PC
Summary: Universal CPU emulator
Version: 0.9.1
Release: 1
Release: 22
Source: %name-%version.tar.bz2
#Patch400: qemu-0.7.0-gcc4-dot-syms.patch
#Patch401: qemu-0.8.0-gcc4-hacks.patch
@ -58,6 +59,7 @@ Patch71: qemu-s390.patch
Patch82: qemu-cvs-svm2.patch
Patch83: qemu-cvs-ppcspe.patch
Patch84: qemu-s390dis-license.patch
Patch85: bug-362956_qemu-block-rw-rangecheck.patch
Source200: kvm_bios.bin
Source201: zx-rom.bin
Source202: COPYING.zx-rom
@ -161,6 +163,7 @@ Authors:
%endif
%patch83
%patch84
%patch85 -p1
%if 1
cd gcc-3.3.5
%patch600
@ -313,6 +316,8 @@ rm -rf %{gcc33tmp}
%endif
%changelog
* Tue Mar 11 2008 uli@suse.de
- secfix (unchecked block read/write vulnerability, bug #362956)
* Thu Jan 17 2008 uli@suse.de
- update -> 0.9.1
- TFTP booting from host directory (Anthony Liguori, Erwan Velu)
@ -472,7 +477,7 @@ rm -rf %{gcc33tmp}
- added NWFPE glue code fix
* Tue Mar 07 2006 schwab@suse.de
- More fixes for ia64 port.
* Mon Mar 06 2006 schwab@suse.de
* Tue Mar 07 2006 schwab@suse.de
- Remove obsolete hunk from ia64 patch.
* Wed Jan 25 2006 mls@suse.de
- converted neededforbuild to BuildRequires
@ -488,7 +493,7 @@ rm -rf %{gcc33tmp}
- updated linker scripts for new binutils release
* Sat Sep 17 2005 dmueller@suse.de
- update to 0.7.2
* Mon Aug 15 2005 schwab@suse.de
* Tue Aug 16 2005 schwab@suse.de
- Don't package /emul/ia32-linux on ia64.
* Mon Aug 15 2005 schwab@suse.de
- Fix compilation on ia64.