Hello community, here is the log from the commit of package qemu for openSUSE:12.1:Update:Test checked in at 2012-02-08 14:50:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.1:Update:Test/qemu (Old) and /work/SRC/openSUSE:12.1:Update:Test/.qemu.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qemu", Maintainer is "[email protected]" Changes: -------- --- /work/SRC/openSUSE:12.1:Update:Test/qemu/qemu.changes 2012-02-08 14:50:52.000000000 +0100 +++ /work/SRC/openSUSE:12.1:Update:Test/.qemu.new/qemu.changes 2012-02-08 14:50:52.000000000 +0100 @@ -1,0 +2,5 @@ +Mon Feb 6 20:11:59 UTC 2012 - [email protected] + +- avoid buffer overflow in e1000 device emulation (bnc#740165) + +------------------------------------------------------------------- New: ---- 0026-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qemu.spec ++++++ --- /var/tmp/diff_new_pack.t9vu8Q/_old 2012-02-08 14:50:52.000000000 +0100 +++ /var/tmp/diff_new_pack.t9vu8Q/_new 2012-02-08 14:50:52.000000000 +0100 @@ -1,7 +1,7 @@ # # spec file for package qemu # -# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -15,16 +15,13 @@ # Please submit bugfixes or comments via http://bugs.opensuse.org/ # -# norootforbuild - - Name: qemu Url: http://fabrice.bellard.free.fr/qemu/ -License: BSD3c(or similar) ; GPLv2+ ; LGPLv2.1+ ; MIT License (or similar) -Group: System/Emulators/PC Summary: Universal CPU emulator +License: BSD-3-Clause ; GPL-2.0+ ; LGPL-2.1+ ; MIT +Group: System/Emulators/PC Version: 0.14.1 -Release: 1 +Release: 0 Source: %name-%version.tar.bz2 Patch1: 0001-qemu-0.7.0-amd64.patch Patch2: 0002-qemu-0.9.0.cvs-binfmt.patch @@ -50,6 +47,7 @@ Patch23: 0023-linux-user-add-binfmt-wrapper-for-argv-0-handling.patch Patch24: 0024-fix-glibc-install-locales.patch Patch25: 0025-add-syscall-numbers-from-2.6.39.2.patch +Patch26: 0026-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch # this is to make lint happy Source300: rpmlintrc BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -122,6 +120,7 @@ %patch15 -p1 %patch17 -p1 %endif +%patch26 -p1 %build # build QEMU ++++++ 0026-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++ >From 7fff7710abc9893d8dce5dbad1e7093caf521132 Mon Sep 17 00:00:00 2001 From: Anthony Liguori <[email protected]> Date: Wed, 4 Jan 2012 14:50:45 -0600 Subject: e1000: check for overflow whenever issuing PCI dma reads Reported-by: Nicolae Mogoreanu <[email protected]> Signed-off-by: Anthony Liguori <[email protected]> --- hw/e1000.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) Index: qemu-kvm-0.12.5/hw/e1000.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/e1000.c +++ qemu-kvm-0.12.5/hw/e1000.c @@ -456,6 +456,7 @@ process_tx_desc(E1000State *s, struct e1 bytes = split_size; if (tp->size + bytes > msh) bytes = msh - tp->size; + bytes = MIN(sizeof(tp->data) - tp->size, bytes); cpu_physical_memory_read(addr, tp->data + tp->size, bytes); if ((sz = tp->size + bytes) >= hdr && tp->size < hdr) memmove(tp->header, tp->data, hdr); @@ -471,6 +472,7 @@ process_tx_desc(E1000State *s, struct e1 // context descriptor TSE is not set, while data descriptor TSE is set DBGOUT(TXERR, "TCP segmentaion Error\n"); } else { + split_size = MIN(sizeof(tp->data) - tp->size, split_size); cpu_physical_memory_read(addr, tp->data + tp->size, split_size); tp->size += split_size; } -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
