[Xen-changelog] [xen-3.1-testing] ioemu: security fixes for not-built or not-default-configured

["Xen patchbot-3.1-testing" <patchbot-3.1-testing@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir@xxxxxxxxxxxxx>
# Date 1191314661 -3600
# Node ID 4b22d472bda62b9ec43fca3ff7362b7284031a8d
# Parent  3ef467ebd2f89ea38d6c83598fd674818bf62e31
ioemu: security fixes for not-built or not-default-configured
subsystems.

Patches originally proposed by S. Caglar Onur and cleaned up for
xen-unstable by Robert Buchholz <rbu@xxxxxxxxxx>.

Signed-off-by: Keir Fraser <keir@xxxxxxxxxxxxx>
xen-unstable changeset:   15963:0b873d909ad30e554a3ffebf14176e7257a3e023
xen-unstable date:        Wed Sep 26 09:19:12 2007 +0100
---
 tools/ioemu/hw/fdc.c    |    9 +++++++--
 tools/ioemu/hw/ne2000.c |    8 ++++++--
 tools/ioemu/hw/sb16.c   |    6 ++++--
 3 files changed, 17 insertions(+), 6 deletions(-)

diff -r 3ef467ebd2f8 -r 4b22d472bda6 tools/ioemu/hw/fdc.c
--- a/tools/ioemu/hw/fdc.c      Fri Sep 28 16:05:02 2007 +0100
+++ b/tools/ioemu/hw/fdc.c      Tue Oct 02 09:44:21 2007 +0100
@@ -1110,8 +1110,13 @@ static uint32_t fdctrl_read_data (fdctrl
             len = fdctrl->data_len - fdctrl->data_pos;
             if (len > FD_SECTOR_LEN)
                 len = FD_SECTOR_LEN;
-            bdrv_read(cur_drv->bs, fd_sector(cur_drv),
-                      fdctrl->fifo, len);
+            if (cur_drv->bs) {
+                bdrv_read(cur_drv->bs, fd_sector(cur_drv),
+                          fdctrl->fifo, len);
+            } else {
+                FLOPPY_ERROR("can't read data from drive\n");
+                return 0;
+            }
         }
     }
     retval = fdctrl->fifo[pos];
diff -r 3ef467ebd2f8 -r 4b22d472bda6 tools/ioemu/hw/ne2000.c
--- a/tools/ioemu/hw/ne2000.c   Fri Sep 28 16:05:02 2007 +0100
+++ b/tools/ioemu/hw/ne2000.c   Tue Oct 02 09:44:21 2007 +0100
@@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
 {
     NE2000State *s = opaque;
     uint8_t *p;
-    int total_len, next, avail, len, index, mcast_idx;
+    unsigned int total_len, next, avail, len, index, mcast_idx;
     uint8_t buf1[60];
     static const uint8_t broadcast_macaddr[6] = 
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
@@ -327,7 +327,11 @@ static void ne2000_receive(void *opaque,
 
     /* write packet data */
     while (size > 0) {
-        avail = s->stop - index;
+        /* taviso: this can wrap, so check its okay. */
+        if (index <= s->stop)
+            avail = s->stop - index;
+        else
+            avail = 0;
         len = size;
         if (len > avail)
             len = avail;
diff -r 3ef467ebd2f8 -r 4b22d472bda6 tools/ioemu/hw/sb16.c
--- a/tools/ioemu/hw/sb16.c     Fri Sep 28 16:05:02 2007 +0100
+++ b/tools/ioemu/hw/sb16.c     Tue Oct 02 09:44:21 2007 +0100
@@ -1235,8 +1235,10 @@ static int SB_read_DMA (void *opaque, in
             s->block_size);
 #endif
 
-    while (s->left_till_irq <= 0) {
-        s->left_till_irq = s->block_size + s->left_till_irq;
+    if (s->block_size) {
+        while (s->left_till_irq <= 0) {
+            s->left_till_irq = s->block_size + s->left_till_irq;
+        }
     }
 
     return dma_pos;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog