File 0234-i8254-fix-out-of-bounds-memory-acce.patch of Package qemu.4227

Overview Repositories Revisions Requests Users Attributes Meta

File 0234-i8254-fix-out-of-bounds-memory-acce.patch of Package qemu.4227

From 03fd4d2f9d61b02f98553e6deaf294c0d16a7446 Mon Sep 17 00:00:00 2001
From: Petr Matousek <pmatouse@redhat.com>
Date: Wed, 17 Jun 2015 12:46:11 +0200
Subject: [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
Cc: qemu-stable@nongnu.org
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit d4862a87e31a51de9eb260f25c9e99a75efe3235)
[AF: bsc#934069]
Signed-off-by: Andreas Färber <afaerber@suse.de>
---
 hw/timer/i8254.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 3450c98637..9b65a33692 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
     PITChannelState *s;
 
     addr &= 3;
+
+    if (addr == 3) {
+        /* Mode/Command register is write only, read is ignored */
+        return 0;
+    }
+
     s = &pit->channels[addr];
     if (s->status_latched) {
         s->status_latched = 0;

Places

File 0234-i8254-fix-out-of-bounds-memory-acce.patch of Package qemu.4227

Places