debuggers.hg

view tools/ioemu/patches/limit-fdc-sector-size-to-16K @ 0:7d21f7218375

Exact replica of unstable on 051908 + README-this
author Mukesh Rathor
date Mon May 19 15:34:57 2008 -0700 (2008-05-19)
parents
children
line source
1 # HG changeset patch
2 # User kfraser@localhost.localdomain
3 # Node ID f711b87ba951e608287abd0de028c6f0d83400a9
4 # Parent f3ee62b7fb5299c89d442845e0883bcfab78c067
5 [QEMU] fdc: Limit sector size to 16K
7 In fdctrl_start_transfer the sector size field (fifo[5]) is not
8 checked for overflows. This allows an arbitrarily large sector size
9 to be used, which can in turn result in a negative data_len field that
10 is then used for DMA transfers.
12 This can lead to the corrpuption of qemu state because some subsequent
13 checks on the transfer length is conducted using signed integers.
15 This patch limits the value fifo[5] to 7 which is the standard limit
16 on floppy sector size.
18 Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
20 Index: ioemu/hw/fdc.c
21 ===================================================================
22 --- ioemu.orig/hw/fdc.c 2006-12-08 18:21:36.000000000 +0000
23 +++ ioemu/hw/fdc.c 2006-12-08 18:22:57.000000000 +0000
24 @@ -898,7 +898,7 @@
25 fdctrl->data_len = fdctrl->fifo[8];
26 } else {
27 int tmp;
28 - fdctrl->data_len = 128 << fdctrl->fifo[5];
29 + fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]);
30 tmp = (cur_drv->last_sect - ks + 1);
31 if (fdctrl->fifo[0] & 0x80)
32 tmp += cur_drv->last_sect;