3430f55120
Refine the reproducible build changes to no longer override linux commands, but rather fix via patches only. Also fix all the recent security issues reported. OBS-URL: https://build.opensuse.org/request/show/441247 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=320
39 lines
1.4 KiB
Diff
39 lines
1.4 KiB
Diff
From 1f01b4d6f3d3acc6d0fd5e809b0de4547f4815cc Mon Sep 17 00:00:00 2001
|
|
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Thu, 20 Oct 2016 13:10:24 +0530
|
|
Subject: [PATCH] audio: intel-hda: check stream entry count during transfer
|
|
|
|
Intel HDA emulator uses stream of buffers during DMA data
|
|
transfers. Each entry has buffer length and buffer pointer
|
|
position, which are used to derive bytes to 'copy'. If this
|
|
length and buffer pointer were to be same, 'copy' could be
|
|
set to zero(0), leading to an infinite loop. Add check to
|
|
avoid it.
|
|
|
|
Reported-by: Huawei PSIRT <psirt@huawei.com>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
(cherry picked from commit 0c0fc2b5fd534786051889459848764edd798050)
|
|
[BR: CVE-2016-8909 BSC#1006536]
|
|
Signed-off-by: Bruce Rogers <brogers@suse.com>
|
|
---
|
|
hw/audio/intel-hda.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
|
|
index cd95340..537face 100644
|
|
--- a/hw/audio/intel-hda.c
|
|
+++ b/hw/audio/intel-hda.c
|
|
@@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output,
|
|
}
|
|
|
|
left = len;
|
|
- while (left > 0) {
|
|
+ s = st->bentries;
|
|
+ while (left > 0 && s-- > 0) {
|
|
copy = left;
|
|
if (copy > st->bsize - st->lpib)
|
|
copy = st->bsize - st->lpib;
|