diff options
Diffstat (limited to 'app-emulation/qemu/files/qemu-2.5.0-usb-ehci-oob.patch')
| -rw-r--r-- | app-emulation/qemu/files/qemu-2.5.0-usb-ehci-oob.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/app-emulation/qemu/files/qemu-2.5.0-usb-ehci-oob.patch b/app-emulation/qemu/files/qemu-2.5.0-usb-ehci-oob.patch new file mode 100644 index 000000000000..2ddca3e99b49 --- /dev/null +++ b/app-emulation/qemu/files/qemu-2.5.0-usb-ehci-oob.patch @@ -0,0 +1,52 @@ +From 49d925ce50383a286278143c05511d30ec41a36e Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit <pjp@fedoraproject.org> +Date: Wed, 20 Jan 2016 01:26:46 +0530 +Subject: [PATCH] usb: check page select value while processing iTD + +While processing isochronous transfer descriptors(iTD), the page +select(PG) field value could lead to an OOB read access. Add +check to avoid it. + +Reported-by: Qinghao Tang <luodalongde@gmail.com> +Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> +Message-id: 1453233406-12165-1-git-send-email-ppandit@redhat.com +Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> +--- + hw/usb/hcd-ehci.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/hw/usb/hcd-ehci.c b/hw/usb/hcd-ehci.c +index ab00268..93601d9 100644 +--- a/hw/usb/hcd-ehci.c ++++ b/hw/usb/hcd-ehci.c +@@ -1405,21 +1405,23 @@ static int ehci_process_itd(EHCIState *ehci, + if (itd->transact[i] & ITD_XACT_ACTIVE) { + pg = get_field(itd->transact[i], ITD_XACT_PGSEL); + off = itd->transact[i] & ITD_XACT_OFFSET_MASK; +- ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); +- ptr2 = (itd->bufptr[pg+1] & ITD_BUFPTR_MASK); + len = get_field(itd->transact[i], ITD_XACT_LENGTH); + + if (len > max * mult) { + len = max * mult; + } +- +- if (len > BUFF_SIZE) { ++ if (len > BUFF_SIZE || pg > 6) { + return -1; + } + ++ ptr1 = (itd->bufptr[pg] & ITD_BUFPTR_MASK); + qemu_sglist_init(&ehci->isgl, ehci->device, 2, ehci->as); + if (off + len > 4096) { + /* transfer crosses page border */ ++ if (pg == 6) { ++ return -1; /* avoid page pg + 1 */ ++ } ++ ptr2 = (itd->bufptr[pg + 1] & ITD_BUFPTR_MASK); + uint32_t len2 = off + len - 4096; + uint32_t len1 = len - len2; + qemu_sglist_add(&ehci->isgl, ptr1 + off, len1); +-- +2.7.4 + |