[Xen-changelog] [xen stable-4.1] x86: properly set up fbld emulation operand address

[patchbot@xxxxxxx]

commit ca0fe6dc4ff9fd12bca751d73b20b309f0444ae2
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Sep 30 14:32:39 2013 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Sep 30 14:32:39 2013 +0200

    x86: properly set up fbld emulation operand address
    
    This is CVE-2013-4361 / XSA-66.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    master commit: 28b706efb6abb637fabfd74cde70a50935a5640b
    master date: 2013-09-30 14:18:58 +0200
---
 xen/arch/x86/x86_emulate/x86_emulate.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index f4686c4..d1c2c23 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2975,11 +2975,11 @@ x86_emulate(
                 break;
             case 4: /* fbld m80dec */
                 ea.bytes = 10;
-                dst = ea;
+                src = ea;
                 if ( (rc = ops->read(src.mem.seg, src.mem.off,
                                      &src.val, src.bytes, ctxt)) != 0 )
                     goto done;
-                emulate_fpu_insn_memdst("fbld", src.val);
+                emulate_fpu_insn_memsrc("fbld", src.val);
                 break;
             case 5: /* fild m64i */
                 ea.bytes = 8;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.1

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog