Hi: [QEMU] fdc: Limit sector size to 16K
In fdctrl_start_transfer the sector size field (fifo[5]) is not checked for overflows. This allows an arbitrarily large sector size to be used, which can in turn result in a negative data_len field that is then used for DMA transfers. This can lead to the corrpuption of qemu state because some subsequent checks on the transfer length is conducted using signed integers. This patch limits the value fifo[5] to 7 which is the standard limit on floppy sector size. Signed-off-by: Herbert Xu <[EMAIL PROTECTED]> Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} <[EMAIL PROTECTED]> Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt -- diff -r 91951de7592c tools/ioemu/hw/fdc.c --- a/tools/ioemu/hw/fdc.c Sun Nov 26 17:35:00 2006 +0000 +++ b/tools/ioemu/hw/fdc.c Mon Nov 27 14:47:31 2006 +1100 @@ -898,7 +898,7 @@ static void fdctrl_start_transfer (fdctr fdctrl->data_len = fdctrl->fifo[8]; } else { int tmp; - fdctrl->data_len = 128 << fdctrl->fifo[5]; + fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]); tmp = (cur_drv->last_sect - ks + 1); if (fdctrl->fifo[0] & 0x80) tmp += cur_drv->last_sect; _______________________________________________ Qemu-devel mailing list Qemu-devel@nongnu.org http://lists.nongnu.org/mailman/listinfo/qemu-devel
