fix CVE-2008-0928, see bug #212351

Package-Manager: portage-2.1.4.4

4 files changed, 333 insertions, 12 deletions

diff --git a/app-emulation/qemu-softmmu/ChangeLog b/app-emulation/qemu-softmmu/ChangeLog
index 500bd41df284..be1872a83a8d 100644
--- a/app-emulation/qemu-softmmu/ChangeLog
+++ b/app-emulation/qemu-softmmu/ChangeLog
@@ -1,6 +1,13 @@
 # ChangeLog for app-emulation/qemu-softmmu
 # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.46 2008/02/01 19:37:00 lu_zero Exp $
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/ChangeLog,v 1.47 2008/03/05 17:58:52 lu_zero Exp $
+
+*qemu-softmmu-0.9.1-r1 (05 Mar 2008)
+
+  05 Mar 2008; Luca Barbato <lu_zero@gentoo.org>
+  +files/qemu-softmmu-0.9.1-block-device-address-range.patch,
+  +qemu-softmmu-0.9.1-r1.ebuild:
+  Fix CVE-2008-0928, patch from the red hat bugzilla
 
   01 Feb 2008; Luca Barbato <lu_zero@gentoo.org>
   -files/qemu-0.8.0-gcc4-hacks.patch, -files/qemu-0.8.0-gcc4-opts.patch,
diff --git a/app-emulation/qemu-softmmu/Manifest b/app-emulation/qemu-softmmu/Manifest
index 5c4f94d796a0..3f95bd5f2b37 100644
--- a/app-emulation/qemu-softmmu/Manifest
+++ b/app-emulation/qemu-softmmu/Manifest
@@ -1,19 +1,11 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
 AUX qemu-softmmu-0.9.0-block-qcow2.patch 346 RMD160 d9c11c082fce158e5fbdaceb5e87a327877de58c SHA1 976bd2727f8bdbad999ea2c23112dcbe550bbf4c SHA256 bfea37a8fc718bcee6f31df02c3095094c58d3ace952a7e7789784d6b3471c5a
 AUX qemu-softmmu-0.9.0-ide-cd.patch 1764 RMD160 5d19bd67c74734c4e66f67dc136adb6f08fa418f SHA1 152fd0403c0644c275ac4aee539139ee5bffd262 SHA256 1f0d9d52e3ead71f0f250902993d1a7d3fb9c88be23870f5559a1596c42bdaf5
+AUX qemu-softmmu-0.9.1-block-device-address-range.patch 7904 RMD160 5653db42b048a0f1748b5394b7382fa3f2edc2a8 SHA1 258a10d73348683fbc7659110b0da57e0003cc46 SHA256 39268b7caebe64d11cd538974def842bedccca0894423f1d003574b8f39e9ecf
 DIST qemu-0.9.0.tar.gz 1901741 RMD160 4296542b6da18a6ac93d20787330d3c1c2ac0a19 SHA1 1e57e48a06eb8729913d92601000466eecef06cb SHA256 491facf9335654967ee53d8fb3540a274bfcbdcc225506bd38c4ee8e9ab405c1
 DIST qemu-0.9.1.tar.gz 2804104 RMD160 ee7bdb55a4540df2082d4bde9ebfd2f4e6f201a5 SHA1 630ea20b5989f0df00128de7f7be661c573ed041 SHA256 4756d0b4a4dc7dd88354bc6b37d381e4462dd328d0feef94803e90c0455835a5
 EBUILD qemu-softmmu-0.9.0-r1.ebuild 3175 RMD160 8a7d2bc7dd359671e5350537da075fc169168b60 SHA1 681d7c1f8ff28c30a4e9135e1e54d4075cd8fe7b SHA256 a381f8a2e983e6e6266657adab2cc59605bb3efc416dec4b7f901a51e0666412
 EBUILD qemu-softmmu-0.9.0.ebuild 3129 RMD160 dc0666aa7499db65af3f78d0d94a4253750927d5 SHA1 7493550b324f11ee72aa5ca994cdd207eb383c6f SHA256 ddd4eb920698c27d70a27d20eb1877b37a7824689340821f8cfe16698100942c
+EBUILD qemu-softmmu-0.9.1-r1.ebuild 2916 RMD160 f5c10c15b1ff736cf30a14df7b91bbd9d8940801 SHA1 b74eab5645f1d3f570cda585a50e675889de6c81 SHA256 fe53f7b2ca44627c603b68efd7110608a969f577835736c8ea71610f6b111de8
 EBUILD qemu-softmmu-0.9.1.ebuild 2832 RMD160 150a50f0010d93200e611af2181cc5df76a91781 SHA1 213f88845793c90dd59e6eff978d839e9d0da3fe SHA256 2c11e38b4b501ef9300e35eeec00236feedad5bcc69decfb839ad52260609f13
-MISC ChangeLog 8098 RMD160 9a7f88671309f8f9a27aabcb35a1c68a0541354b SHA1 f904e6f7192c31f173233714ff7b94c7304d35de SHA256 f61074f5b820b740929df04a8fb8bd9f93f68eab5d4088dfe9b101f55e8f6cd3
+MISC ChangeLog 8334 RMD160 ae268c1eedf13e5c8ebb2f96a025db7d5c4ee881 SHA1 ba9e6c46bf9955e2ecc7205e9f78eeeb56b1a44b SHA256 15031eaf44f985847639ebc563a08e7dcdefbc3b091ed2c920764efe5d7bdcf4
 MISC metadata.xml 223 RMD160 f054e67dff10c87ea1d0b5753124445be6bd4610 SHA1 fcf66d2b271369d296150dde06603d850623ed27 SHA256 64a96c3c9929aec46b50a63ae1fd8c46cef4a8423f448d6f6fff09e20510c98b
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v2.0.7 (GNU/Linux)
-
-iD8DBQFHpJ2tNQqtfCuFneMRAk3NAJ9m4P0O+rJQk5niMKZnBANwzLl75gCfQqZn
-fVsiiGwkjmGG0652LM8YOrA=
-=4i/p
------END PGP SIGNATURE-----
diff --git a/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-block-device-address-range.patch b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-block-device-address-range.patch
new file mode 100644
index 000000000000..d9bb1f646883
--- /dev/null
+++ b/app-emulation/qemu-softmmu/files/qemu-softmmu-0.9.1-block-device-address-range.patch
@@ -0,0 +1,212 @@
+diff -rup kvm-60.orig/qemu/block.c kvm-60.new/qemu/block.c
+--- kvm-60.orig/qemu/block.c	2008-02-26 18:44:28.000000000 -0500
++++ kvm-60.new/qemu/block.c	2008-02-26 18:44:52.000000000 -0500
+@@ -124,6 +124,60 @@ void path_combine(char *dest, int dest_s
+     }
+ }
+ 
++static int bdrv_rd_badreq_sectors(BlockDriverState *bs,
++                                  int64_t sector_num, int nb_sectors)
++{
++    return
++        nb_sectors < 0 ||
++        sector_num < 0 ||
++        nb_sectors > bs->total_sectors ||
++        sector_num > bs->total_sectors - nb_sectors;
++}
++
++static int bdrv_rd_badreq_bytes(BlockDriverState *bs,
++                                int64_t offset, int count)
++{
++    int64_t size = bs->total_sectors << SECTOR_BITS;
++    return
++        count < 0 ||
++        size < 0 ||
++        count > size ||
++        offset > size - count;
++}
++
++static int bdrv_wr_badreq_sectors(BlockDriverState *bs,
++                                  int64_t sector_num, int nb_sectors)
++{
++    if (sector_num < 0 ||
++        nb_sectors < 0)
++        return 1;
++
++    if (sector_num > bs->total_sectors - nb_sectors) {
++        if (bs->autogrow)
++            bs->total_sectors = sector_num + nb_sectors;
++        else
++            return 1;
++    }
++    return 0;
++}
++
++static int bdrv_wr_badreq_bytes(BlockDriverState *bs,
++                                int64_t offset, int count)
++{
++    int64_t size = bs->total_sectors << SECTOR_BITS;
++    if (count < 0 ||
++        offset < 0)
++        return 1;
++
++    if (offset > size - count) {
++        if (bs->autogrow)
++            bs->total_sectors = (offset + count + SECTOR_SIZE - 1) >> SECTOR_BITS;
++        else
++            return 1;
++    }
++    return 0;
++}
++
+ 
+ static void bdrv_register(BlockDriver *bdrv)
+ {
+@@ -332,6 +386,10 @@ int bdrv_open2(BlockDriverState *bs, con
+     bs->read_only = 0;
+     bs->is_temporary = 0;
+     bs->encrypted = 0;
++    bs->autogrow = 0;
++
++    if (flags & BDRV_O_AUTOGROW)
++        bs->autogrow = 1;
+ 
+     if (flags & BDRV_O_SNAPSHOT) {
+         BlockDriverState *bs1;
+@@ -376,6 +434,7 @@ int bdrv_open2(BlockDriverState *bs, con
+     }
+     bs->drv = drv;
+     bs->opaque = qemu_mallocz(drv->instance_size);
++    bs->total_sectors = 0; /* driver will set if it does not do getlength */
+     if (bs->opaque == NULL && drv->instance_size > 0)
+         return -1;
+     /* Note: for compatibility, we open disk image files as RDWR, and
+@@ -441,6 +500,7 @@ void bdrv_close(BlockDriverState *bs)
+         bs->drv = NULL;
+ 
+         /* call the change callback */
++        bs->total_sectors = 0;
+         bs->media_changed = 1;
+         if (bs->change_cb)
+             bs->change_cb(bs->change_opaque);
+@@ -506,6 +566,8 @@ int bdrv_read(BlockDriverState *bs, int6
+     if (!drv)
+         return -ENOMEDIUM;
+ 
++    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+             memcpy(buf, bs->boot_sector_data, 512);
+         sector_num++;
+@@ -546,6 +608,8 @@ int bdrv_write(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (bs->read_only)
+         return -EACCES;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);
+     }
+@@ -671,6 +735,8 @@ int bdrv_pread(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pread)
+         return bdrv_pread_em(bs, offset, buf1, count1);
++    if (bdrv_rd_badreq_bytes(bs, offset, count1))
++        return -EDOM;
+     return drv->bdrv_pread(bs, offset, buf1, count1);
+ }
+ 
+@@ -686,6 +752,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pwrite)
+         return bdrv_pwrite_em(bs, offset, buf1, count1);
++    if (bdrv_wr_badreq_bytes(bs, offset, count1))
++        return -EDOM;
+     return drv->bdrv_pwrite(bs, offset, buf1, count1);
+ }
+ 
+@@ -1091,6 +1159,8 @@ int bdrv_write_compressed(BlockDriverSta
+         return -ENOMEDIUM;
+     if (!drv->bdrv_write_compressed)
+         return -ENOTSUP;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return -EDOM;
+     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+ }
+ 
+@@ -1237,6 +1307,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
+ 
+     if (!drv)
+         return NULL;
++    if (bdrv_rd_badreq_sectors(bs, sector_num, nb_sectors))
++        return NULL;
+ 
+     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+@@ -1268,6 +1340,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
+         return NULL;
+     if (bs->read_only)
+         return NULL;
++    if (bdrv_wr_badreq_sectors(bs, sector_num, nb_sectors))
++        return NULL;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);
+     }
+diff -rup kvm-60.orig/qemu/block.h kvm-60.new/qemu/block.h
+--- kvm-60.orig/qemu/block.h	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block.h	2008-02-26 18:44:52.000000000 -0500
+@@ -45,6 +45,7 @@ typedef struct QEMUSnapshotInfo {
+                                      it (default for
+                                      bdrv_file_open()) */
+ #define BDRV_O_DIRECT      0x0020
++#define BDRV_O_AUTOGROW    0x0040 /* Allow backing file to extend when writing past end of file */
+ 
+ #ifndef QEMU_IMG
+ void bdrv_info(void);
+diff -rup kvm-60.orig/qemu/block_int.h kvm-60.new/qemu/block_int.h
+--- kvm-60.orig/qemu/block_int.h	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block_int.h	2008-02-26 18:44:52.000000000 -0500
+@@ -97,6 +97,7 @@ struct BlockDriverState {
+     int locked;    /* if true, the media cannot temporarily be ejected */
+     int encrypted; /* if true, the media is encrypted */
+     int sg;        /* if true, the device is a /dev/sg* */
++    int autogrow;  /* if true, the backing store can auto-extend to allocate new extents */
+     /* event callback when inserting/removing */
+     void (*change_cb)(void *opaque);
+     void *change_opaque;
+diff -rup kvm-60.orig/qemu/block-qcow2.c kvm-60.new/qemu/block-qcow2.c
+--- kvm-60.orig/qemu/block-qcow2.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow2.c	2008-02-26 18:44:52.000000000 -0500
+@@ -191,7 +191,7 @@ static int qcow_open(BlockDriverState *b
+     int len, i, shift, ret;
+     QCowHeader header;
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-qcow.c kvm-60.new/qemu/block-qcow.c
+--- kvm-60.orig/qemu/block-qcow.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-qcow.c	2008-02-26 18:44:52.000000000 -0500
+@@ -95,7 +95,7 @@ static int qcow_open(BlockDriverState *b
+     int len, i, shift, ret;
+     QCowHeader header;
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &header, sizeof(header)) != sizeof(header))
+diff -rup kvm-60.orig/qemu/block-vmdk.c kvm-60.new/qemu/block-vmdk.c
+--- kvm-60.orig/qemu/block-vmdk.c	2008-01-20 07:35:04.000000000 -0500
++++ kvm-60.new/qemu/block-vmdk.c	2008-02-26 18:44:52.000000000 -0500
+@@ -375,7 +375,7 @@ static int vmdk_open(BlockDriverState *b
+         flags = BDRV_O_RDONLY;
+     fprintf(stderr, "(VMDK) image open: flags=0x%x filename=%s\n", flags, bs->filename);
+ 
+-    ret = bdrv_file_open(&s->hd, filename, flags);
++    ret = bdrv_file_open(&s->hd, filename, flags | BDRV_O_AUTOGROW);
+     if (ret < 0)
+         return ret;
+     if (bdrv_pread(s->hd, 0, &magic, sizeof(magic)) != sizeof(magic))
diff --git a/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r1.ebuild b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r1.ebuild
new file mode 100644
index 000000000000..9fad6e267739
--- /dev/null
+++ b/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r1.ebuild
@@ -0,0 +1,110 @@
+# Copyright 1999-2008 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-emulation/qemu-softmmu/qemu-softmmu-0.9.1-r1.ebuild,v 1.1 2008/03/05 17:58:52 lu_zero Exp $
+
+inherit eutils flag-o-matic toolchain-funcs
+
+DESCRIPTION="Multi-platform & multi-targets cpu emulator and dynamic translator"
+HOMEPAGE="http://fabrice.bellard.free.fr/qemu/"
+SRC_URI="${HOMEPAGE}${P/-softmmu/}.tar.gz"
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+KEYWORDS="-alpha ~amd64 ~ppc -sparc ~x86"
+IUSE="sdl kqemu gnutls alsa"
+RESTRICT="binchecks test"
+
+DEPEND="virtual/libc
+	sys-libs/zlib
+	sdl? ( media-libs/libsdl )
+	!<=app-emulation/qemu-0.7.0
+	kqemu? ( >=app-emulation/kqemu-1.3.0_pre10 )
+	gnutls? (
+		dev-util/pkgconfig
+		net-libs/gnutls
+	)
+	app-text/texi2html"
+RDEPEND="sys-libs/zlib
+	sdl? ( media-libs/libsdl )
+	gnutls? ( net-libs/gnutls )
+	alsa? ( media-libs/alsa-lib )"
+
+S="${WORKDIR}/${P/-softmmu/}"
+
+pkg_setup() {
+	if [ "$(gcc-major-version)" == "4" ]; then
+	eerror "qemu requires gcc-3 in order to build and work correctly"
+	eerror "please compile it switching to gcc-3."
+	eerror "We are aware that qemu can guess a gcc-3 but this feature"
+	eerror "could be harmful."
+	die "gcc 4 cannot build qemu"
+	fi
+}
+
+src_unpack() {
+	unpack ${A}
+
+	cd "${S}"
+	# Fix CVE-2008-0928
+	epatch "${FILESDIR}/${P}-block-device-address-range.patch"
+	# Alter target makefiles to accept CFLAGS set via flag-o.
+	sed -i 's/^\(C\|OP_C\|HELPER_C\)FLAGS=/\1FLAGS+=/' \
+		Makefile Makefile.target tests/Makefile
+	# Ensure mprotect restrictions are relaxed for emulator binaries
+	[[ -x /sbin/paxctl ]] && \
+		sed -i 's/^VL_LDFLAGS=$/VL_LDFLAGS=-Wl,-z,execheap/' \
+			Makefile.target
+	# Prevent install of kernel module by qemu's makefile
+	sed -i 's/\(.\/install.sh\)/#\1/' Makefile
+	# avoid strip
+	sed -i 's:$(INSTALL) -m 755 -s:$(INSTALL) -m 755:' Makefile Makefile.target
+}
+
+src_compile() {
+	#Let the application set its cflags
+	unset CFLAGS
+
+	# Switch off hardened tech
+	filter-flags -fpie -fstack-protector
+
+	myconf="--disable-gcc-check"
+	if use alsa; then
+		myconf="$myconf --enable-alsa"
+	fi
+	if ! use gnutls; then
+		myconf="$myconf --disable-vnc-tls"
+	fi
+	if ! use kqemu; then
+		myconf="$myconf --disable-kqemu"
+	fi
+	if ! use sdl ; then
+		myconf="$myconf --disable-sdl --disable-gfx-check"
+	fi
+	./configure \
+		--prefix=/usr \
+		--enable-adlib \
+		--cc=$(tc-getCC) \
+		--host-cc=$(tc-getCC) \
+		--disable-linux-user \
+		--enable-system \
+		${myconf} \
+		|| die "could not configure"
+
+	emake || die "make failed"
+}
+
+src_install() {
+	make install \
+		prefix="${D}/usr" \
+		bindir="${D}/usr/bin" \
+		datadir="${D}/usr/share/qemu" \
+		docdir="${D}/usr/share/doc/${P}" \
+		mandir="${D}/usr/share/man" || die
+
+	chmod -x "${D}/usr/share/man/*/*"
+}
+
+pkg_postinst() {
+	einfo "You will need the Universal TUN/TAP driver compiled into"
+	einfo "kernel or as a module to use the virtual network device."
+}