Index: xen-3.2.1-testing/tools/ioemu/block.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/block.c
+++ xen-3.2.1-testing/tools/ioemu/block.c
@@ -583,6 +583,9 @@ int bdrv_write(BlockDriverState *bs, int
         else
             return 0;
     } else {
+        unsigned int ns = sector_num * 512;
+        if (ns < 0)
+            return -1;
         return drv->bdrv_write(bs, sector_num, buf, nb_sectors);
     }
 }
Index: xen-3.2.1-testing/tools/ioemu/hw/cirrus_vga.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/hw/cirrus_vga.c
+++ xen-3.2.1-testing/tools/ioemu/hw/cirrus_vga.c
@@ -220,6 +220,20 @@
 #define CIRRUS_HOOK_NOT_HANDLED 0
 #define CIRRUS_HOOK_HANDLED 1
 
+#define BLTUNSAFE(s) \
+    ( \
+        ( /* check dst is within bounds */ \
+            (s)->cirrus_blt_height * (s)->cirrus_blt_dstpitch \
+                + ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
+                    (s)->vram_size \
+        ) || \
+        ( /* check src is within bounds */ \
+            (s)->cirrus_blt_height * (s)->cirrus_blt_srcpitch \
+                + ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
+                    (s)->vram_size \
+        ) \
+    )
+
 struct CirrusVGAState;
 typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
                                      uint8_t * dst, const uint8_t * src,
@@ -599,7 +613,7 @@ static void cirrus_invalidate_region(Cir
 
     for (y = 0; y < lines; y++) {
 	off_cur = off_begin;
-	off_cur_end = off_cur + bytesperline;
+	off_cur_end = (off_cur + bytesperline) & s->cirrus_addr_mask;
 	off_cur &= TARGET_PAGE_MASK;
 	while (off_cur < off_cur_end) {
 	    cpu_physical_memory_set_dirty(s->vram_offset +
@@ -615,7 +629,11 @@ static int cirrus_bitblt_common_patternc
 {
     uint8_t *dst;
 
-    dst = s->vram_ptr + s->cirrus_blt_dstaddr;
+    dst = s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
+
+    if (BLTUNSAFE(s))
+        return 0;
+
     (*s->cirrus_rop) (s, dst, src,
                       s->cirrus_blt_dstpitch, 0, 
                       s->cirrus_blt_width, s->cirrus_blt_height);
@@ -631,8 +649,11 @@ static int cirrus_bitblt_solidfill(Cirru
 {
     cirrus_fill_t rop_func;
 
+    if (BLTUNSAFE(s))
+        return 0;
+
     rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
-    rop_func(s, s->vram_ptr + s->cirrus_blt_dstaddr, 
+    rop_func(s, s->vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
              s->cirrus_blt_dstpitch,
              s->cirrus_blt_width, s->cirrus_blt_height);
     cirrus_invalidate_region(s, s->cirrus_blt_dstaddr,
@@ -651,8 +672,8 @@ static int cirrus_bitblt_solidfill(Cirru
 static int cirrus_bitblt_videotovideo_patterncopy(CirrusVGAState * s)
 {
     return cirrus_bitblt_common_patterncopy(s,
-					    s->vram_ptr + 
-                                            (s->cirrus_blt_srcaddr & ~7));
+					    s->vram_ptr + ((s->cirrus_blt_srcaddr & ~7) &
+                        s->cirrus_addr_mask));
 }
 
 static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
@@ -702,8 +723,10 @@ static void cirrus_do_copy(CirrusVGAStat
     if (notify)
 	vga_hw_update();
 
-    (*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
-		      s->vram_ptr + s->cirrus_blt_srcaddr,
+    (*s->cirrus_rop) (s, s->vram_ptr +
+                (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
+		      s->vram_ptr +
+                (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
 		      s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
 		      s->cirrus_blt_width, s->cirrus_blt_height);
 
@@ -729,8 +752,14 @@ static int cirrus_bitblt_videotovideo_co
 		       s->cirrus_blt_srcaddr - s->start_addr,
 		       s->cirrus_blt_width, s->cirrus_blt_height);
     } else {
-	(*s->cirrus_rop) (s, s->vram_ptr + s->cirrus_blt_dstaddr,
-			  s->vram_ptr + s->cirrus_blt_srcaddr,
+
+    if (BLTUNSAFE(s))
+        return 0;
+
+	(*s->cirrus_rop) (s, s->vram_ptr +
+                (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
+			  s->vram_ptr +
+                (s->cirrus_blt_srcaddr & s->cirrus_addr_mask),
 			  s->cirrus_blt_dstpitch, s->cirrus_blt_srcpitch,
 			  s->cirrus_blt_width, s->cirrus_blt_height);
 
@@ -762,8 +791,9 @@ static void cirrus_bitblt_cputovideo_nex
         } else {
             /* at least one scan line */
             do {
-                (*s->cirrus_rop)(s, s->vram_ptr + s->cirrus_blt_dstaddr,
-                                 s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
+                (*s->cirrus_rop)(s, s->vram_ptr +
+                    (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
+                        s->cirrus_bltbuf, 0, 0, s->cirrus_blt_width, 1);
                 cirrus_invalidate_region(s, s->cirrus_blt_dstaddr, 0,
                                          s->cirrus_blt_width, 1);
                 s->cirrus_blt_dstaddr += s->cirrus_blt_dstpitch;
@@ -1879,7 +1909,7 @@ static void cirrus_mem_writeb_mode4and5_
     unsigned val = mem_value;
     uint8_t *dst;
 
-    dst = s->vram_ptr + offset;
+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
     for (x = 0; x < 8; x++) {
 	if (val & 0x80) {
 	    *dst = s->cirrus_shadow_gr1;
@@ -1902,7 +1932,7 @@ static void cirrus_mem_writeb_mode4and5_
     unsigned val = mem_value;
     uint8_t *dst;
 
-    dst = s->vram_ptr + offset;
+    dst = s->vram_ptr + (offset &= s->cirrus_addr_mask);
     for (x = 0; x < 8; x++) {
 	if (val & 0x80) {
 	    *dst = s->cirrus_shadow_gr1;
Index: xen-3.2.1-testing/tools/ioemu/hw/cirrus_vga_rop.h
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/hw/cirrus_vga_rop.h
+++ xen-3.2.1-testing/tools/ioemu/hw/cirrus_vga_rop.h
@@ -49,6 +49,12 @@ glue(cirrus_bitblt_rop_fwd_, ROP_NAME)(C
     src = src_ - src_base;
     dstpitch -= bltwidth;
     srcpitch -= bltwidth;
+
+    if (dstpitch < 0 || srcpitch < 0) {
+        /* is 0 valid? srcpitch == 0 could be useful */
+        return;
+    }
+
     for (y = 0; y < bltheight; y++) {
         for (x = 0; x < bltwidth; x++) {
             ROP_OP(*(dst_base + m(dst)), *(src_base + m(src)));
Index: xen-3.2.1-testing/tools/ioemu/hw/i8259.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/hw/i8259.c
+++ xen-3.2.1-testing/tools/ioemu/hw/i8259.c
@@ -299,9 +299,11 @@ static void pic_ioport_write(void *opaqu
             s->init_state = 1;
             s->init4 = val & 1;
             if (val & 0x02)
-                hw_error("single mode not supported");
+                /* hw_error("single mode not supported"); */
+                return;
             if (val & 0x08)
-                hw_error("level sensitive irq not supported");
+                /* hw_error("level sensitive irq not supported"); */
+                return;
         } else if (val & 0x08) {
             if (val & 0x04)
                 s->poll = 1;
Index: xen-3.2.1-testing/tools/ioemu/hw/ne2000.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/hw/ne2000.c
+++ xen-3.2.1-testing/tools/ioemu/hw/ne2000.c
@@ -221,7 +221,7 @@ static int ne2000_can_receive(void *opaq
     NE2000State *s = opaque;
     
     if (s->cmd & E8390_STOP)
-        return 1;
+        return 0;
     return !ne2000_buffer_full(s);
 }
 
Index: xen-3.2.1-testing/tools/ioemu/hw/pc.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/hw/pc.c
+++ xen-3.2.1-testing/tools/ioemu/hw/pc.c
@@ -315,7 +315,8 @@ void bochs_bios_write(void *opaque, uint
     case 0x400:
     case 0x401:
         fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
-        exit(1);
+        /* according to documentation, these can be safely ignored */
+        break;
     case 0x402:
     case 0x403:
 #ifdef DEBUG_BIOS
@@ -338,8 +339,9 @@ void bochs_bios_write(void *opaque, uint
         /* LGPL'ed VGA BIOS messages */
     case 0x501:
     case 0x502:
+        /* according to documentation, these can be safely ignored */
         fprintf(stderr, "VGA BIOS panic, line %d\n", val);
-        exit(1);
+        break;
     case 0x500:
     case 0x503:
 #ifdef DEBUG_BIOS
Index: xen-3.2.1-testing/tools/ioemu/target-i386/translate.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/target-i386/translate.c
+++ xen-3.2.1-testing/tools/ioemu/target-i386/translate.c
@@ -5326,7 +5326,12 @@ static target_ulong disas_insn(DisasCont
         if (CODE64(s))
             goto illegal_op;
         val = ldub_code(s->pc++);
-        gen_op_aam(val);
+        /* taviso: operand can be zero */
+        if (val) {
+            gen_op_aam(val);
+        } else {
+            gen_exception(s, EXCP00_DIVZ, s->pc - s->cs_base);
+        }
         s->cc_op = CC_OP_LOGICB;
         break;
     case 0xd5: /* aad */
@@ -5374,6 +5379,7 @@ static target_ulong disas_insn(DisasCont
         gen_jmp_im(pc_start - s->cs_base);
         gen_op_into(s->pc - pc_start);
         break;
+#ifdef WANT_ICEBP
     case 0xf1: /* icebp (undocumented, exits to external debugger) */
 #if 1
         gen_debug(s, pc_start - s->cs_base);
@@ -5383,6 +5389,7 @@ static target_ulong disas_insn(DisasCont
         cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
 #endif
         break;
+#endif /* icebp */
     case 0xfa: /* cli */
         if (!s->vm86) {
             if (s->cpl <= s->iopl) {
Index: xen-3.2.1-testing/tools/ioemu/vl.c
===================================================================
--- xen-3.2.1-testing.orig/tools/ioemu/vl.c
+++ xen-3.2.1-testing/tools/ioemu/vl.c
@@ -3602,8 +3602,8 @@ typedef struct NetSocketState {
     VLANClientState *vc;
     int fd;
     int state; /* 0 = getting length, 1 = getting data */
-    int index;
-    int packet_len;
+    unsigned int index;
+    unsigned int packet_len;
     uint8_t buf[4096];
     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
 } NetSocketState;
@@ -3634,7 +3634,8 @@ static void net_socket_receive_dgram(voi
 static void net_socket_send(void *opaque)
 {
     NetSocketState *s = opaque;
-    int l, size, err;
+    int size, err;
+    unsigned l;
     uint8_t buf1[4096];
     const uint8_t *buf;
 
@@ -3673,7 +3674,15 @@ static void net_socket_send(void *opaque
             l = s->packet_len - s->index;
             if (l > size)
                 l = size;
-            memcpy(s->buf + s->index, buf, l);
+            if (s->index + l <= sizeof(s->buf)) {
+                memcpy(s->buf + s->index, buf, l);
+            } else {
+                fprintf(stderr, "serious error: oversized packet received,"
+                    "connection terminated.\n");
+                s->state = 0;
+                goto eoc;
+            }
+
             s->index += l;
             buf += l;
             size -= l;