Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP5:GA
xen.10696
CVE-2018-18438-qemuu-006-integer-overflow-in-cc...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2018-18438-qemuu-006-integer-overflow-in-ccid_card_vscard_read-allows-memory-corruption.patch of Package xen.10696
References: bsc#1112188 CVE-2018-18438 Suggested-by: Paolo Bonzini <address@hidden> Signed-off-by: Philippe Mathieu-Daudé <address@hidden> --- chardev/baum.c | 2 +- chardev/char-fd.c | 2 +- chardev/char-mux.c | 2 +- chardev/char-pty.c | 2 +- chardev/char-ringbuf.c | 4 ++-- chardev/char-socket.c | 2 +- chardev/char-udp.c | 2 +- chardev/char.c | 2 +- chardev/msmouse.c | 2 +- chardev/spice.c | 2 +- chardev/testdev.c | 2 +- chardev/wctablet.c | 4 ++-- gdbstub.c | 2 +- hw/bt/hci-csr.c | 4 ++-- include/chardev/char.h | 2 +- ui/console.c | 2 +- ui/gtk.c | 2 +- 17 files changed, 20 insertions(+), 20 deletions(-) Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/backends/baum.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/backends/baum.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/backends/baum.c @@ -429,7 +429,7 @@ static int baum_eat_packet(BaumDriverSta } /* The other end is writing some data. Store it and try to interpret */ -static int baum_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t baum_write(CharDriverState *chr, const uint8_t *buf, size_t len) { BaumDriverState *baum = chr->opaque; int tocopy, cur, eaten, orig_len = len; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/qemu-char.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/qemu-char.c @@ -230,7 +230,7 @@ void qemu_chr_add_handlers(CharDriverSta } } -static int null_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t null_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { return len; } @@ -271,7 +271,7 @@ typedef struct { } MuxDriver; -static int mux_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t mux_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { MuxDriver *d = chr->opaque; int ret; @@ -816,7 +816,7 @@ typedef struct FDCharDriver { QTAILQ_ENTRY(FDCharDriver) node; } FDCharDriver; -static int fd_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t fd_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { FDCharDriver *s = chr->opaque; @@ -1052,7 +1052,7 @@ static void pty_chr_rearm_timer(CharDriv } } -static int pty_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t pty_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { PtyCharDriver *s = chr->opaque; @@ -2164,7 +2164,7 @@ typedef struct { int max_size; } NetCharDriver; -static int udp_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t udp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { NetCharDriver *s = chr->opaque; gsize bytes_written; @@ -2304,7 +2304,7 @@ typedef struct { static gboolean tcp_chr_accept(GIOChannel *chan, GIOCondition cond, void *opaque); -static int tcp_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t tcp_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { TCPCharDriver *s = chr->opaque; if (s->connected) { @@ -2779,7 +2779,7 @@ static size_t ringbuf_count(const CharDr return d->prod - d->cons; } -static int ringbuf_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t ringbuf_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { RingBufCharDriver *d = chr->opaque; int i; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/backends/msmouse.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/backends/msmouse.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/backends/msmouse.c @@ -52,7 +52,7 @@ static void msmouse_event(void *opaque, qemu_chr_be_write(chr, bytes, 4); } -static int msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, int len) +static size_t msmouse_chr_write (struct CharDriverState *s, const uint8_t *buf, size_t len) { /* Ignore writes to mouse port */ return len; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/spice-qemu-char.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/spice-qemu-char.c @@ -179,7 +179,7 @@ static GSource *spice_chr_add_watch(Char return (GSource *)src; } -static int spice_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t spice_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { SpiceCharDriver *s = chr->opaque; int read_bytes; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/gdbstub.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/gdbstub.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/gdbstub.c @@ -1638,7 +1638,7 @@ static void gdb_monitor_output(GDBState put_packet(s, buf); } -static int gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t gdb_monitor_write(CharDriverState *chr, const uint8_t *buf, size_t len) { const char *p = (const char *)buf; int max_sz; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/bt/hci-csr.c @@ -294,8 +294,8 @@ static int csrhci_data_len(const uint8_t exit(-1); } -static int csrhci_write(struct CharDriverState *chr, - const uint8_t *buf, int len) +static size_t csrhci_write(struct CharDriverState *chr, + const uint8_t *buf, size_t len) { struct csrhci_s *s = (struct csrhci_s *) chr->opaque; int plen = s->in_len; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/include/sysemu/char.h =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/include/sysemu/char.h +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/include/sysemu/char.h @@ -55,7 +55,7 @@ typedef void IOEventHandler(void *opaque struct CharDriverState { void (*init)(struct CharDriverState *s); - int (*chr_write)(struct CharDriverState *s, const uint8_t *buf, int len); + size_t (*chr_write)(struct CharDriverState *s, const uint8_t *buf, size_t len); GSource *(*chr_add_watch)(struct CharDriverState *s, GIOCondition cond); void (*chr_update_read_handler)(struct CharDriverState *s); int (*chr_ioctl)(struct CharDriverState *s, int cmd, void *arg); Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/ui/gtk.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/ui/gtk.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/ui/gtk.c @@ -1159,7 +1159,7 @@ static gboolean gd_focus_out_event(GtkWi /** Virtual Console Callbacks **/ -static int gd_vc_chr_write(CharDriverState *chr, const uint8_t *buf, int len) +static size_t gd_vc_chr_write(CharDriverState *chr, const uint8_t *buf, size_t len) { VirtualConsole *vc = chr->opaque;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor