OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

FDC: Fix buffer overflow (Hervé Poussineau)

Browse Source 
In floppy controller, programming PIO writes which are more than one sector
long leads to a buffer overflow of the fdtrl->fifo[] array.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4293 c046a42c-6fe2-441c-8c8c-71466251a162
This commit is contained in:
blueswir1 2008-05-01 19:03:31 +00:00
parent 6ef05b9546
commit b3bc154098
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/fdc.c
View File

@ -1770,8 +1770,10 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
/* Is it write command time ? */ /* Is it write command time ? */
if (fdctrl->msr & FD_MSR_NONDMA) { if (fdctrl->msr & FD_MSR_NONDMA) {
/* FIFO data write */ /* FIFO data write */
fdctrl->fifo[fdctrl->data_pos++] = value; pos = fdctrl->data_pos++;
if (fdctrl->data_pos % FD_SECTOR_LEN == (FD_SECTOR_LEN - 1) || pos %= FD_SECTOR_LEN;
fdctrl->fifo[pos] = value;
if (pos == FD_SECTOR_LEN - 1 ||
fdctrl->data_pos == fdctrl->data_len) { fdctrl->data_pos == fdctrl->data_len) {
cur_drv = get_cur_drv(fdctrl); cur_drv = get_cur_drv(fdctrl);
if (bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) { if (bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {