OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
QEMU With E2K User Support
40,257 Commits 9 Branches 0 Tags 459 MiB
C 83.1%
C++ 6.3%
Python 3.2%
Dylan 2.8%
Shell 1.6%
Other 2.8%
c170aad8b0
Go to file
Paolo Bonzini c170aad8b0 scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158) 
This is a guest-triggerable buffer overflow present in QEMU 2.2.0
and newer.  scsi_cdb_length returns -1 as an error value, but the
caller does not check it.

Luckily, the massive overflow means that QEMU will just SIGSEGV,
making the impact much smaller.

Reported-by: Zhu Donghai (朱东海) <donghai.zdh@alibaba-inc.com>
Fixes: 1894df0281
Reviewed-by: Fam Zheng <famz@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2015-07-24 13:57:44 +02:00
audio ossaudio: fix memory leak 2015-07-08 13:11:01 +02:00
backends Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
block mirror: Speed up bitmap initial scanning 2015-07-22 11:14:21 +01:00
bsd-user cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
crypto crypto: Fix aes_decrypt_wrapper() 2015-07-20 13:35:45 +02:00
default-configs acpi: split out ICH ACPI support 2015-07-07 13:11:57 +03:00
disas disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR 2015-07-21 11:18:45 +01:00
docs AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
dtc@65cc4d2748 dtc: Update dtc / libfdt submodule to version 1.4.0 2015-06-03 23:56:49 +02:00
fpu target-s390x: define default NaN values 2015-06-05 01:37:58 +02:00
fsdev virtfs-proxy-helper: fail gracefully if socket path is too long 2015-06-16 20:32:29 +05:30
gdb-xml gdb-xml: Include XML for s390 vector registers 2015-05-27 17:52:03 +02:00
hw scsi: fix buffer overflow in scsi_req_parse_cdb (CVE-2015-5158) 2015-07-24 13:57:44 +02:00
include AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
libcacard libcacard: pkgconfig: tidy dependent libs 2015-06-23 19:57:28 +03:00
libdecnumber remove libdecnumber/dpd/decimal128Local.h 2015-06-23 19:57:27 +03:00
linux-headers linux-headers: Update to 4.2-rc1 2015-07-06 17:59:01 +02:00
linux-user linux-user: Fix MIPS N64 trap and break instruction bug 2015-07-15 14:07:25 +01:00
migration RDMA: Fix error exits 2015-07-16 20:00:20 +02:00
net net: Flush queued packets when guest resumes 2015-07-20 18:11:24 +01:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
pixman@87eea99e44
po
qapi migration: create migration event 2015-07-07 14:54:55 +02:00
qga qga: fixed versions for guest bus types in qapi-schema 2015-07-21 14:36:06 -05:00
qobject Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qom cpu: Convert cpu_index into a bitmap 2015-07-09 15:20:40 +02:00
roms pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
scripts virtio-input: move sys/ioctl.h include 2015-07-16 17:34:41 +02:00
slirp qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
stubs main-loop: introduce qemu_mutex_iothread_locked 2015-07-01 15:45:50 +02:00
target-alpha cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-arm target-arm: kvm: Differentiate registers based on write-back levels 2015-07-21 11:18:45 +01:00
target-cris disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-i386 target-i386: emulate CPUID level of real hardware 2015-07-15 17:05:59 -03:00
target-lm32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-m68k cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-microblaze disas: microblaze: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-mips mips/kvm: Sign extend registers written to KVM 2015-07-16 20:00:20 +02:00
target-moxie cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-openrisc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-ppc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-s390x cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sh4 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sparc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-tricore cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-unicore32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-xtensa cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
tcg tci: Fix regression with INDEX_op_qemu_st_i32, INDEX_op_qemu_st_i64 2015-07-13 10:07:38 +01:00
tests AioContext: fix broken ctx->dispatching optimization 2015-07-22 12:41:40 +01:00
trace Remove superfluous '\n' around error_report() 2015-03-10 08:15:33 +03:00
ui vnc: fix memory leak 2015-07-24 13:57:44 +02:00
util timer: rename NSEC_PER_SEC due to Mac OS X header clash 2015-07-20 17:01:00 +01:00
.exrc
.gitignore gitignore: Ignore more .pod files. 2015-04-04 09:45:59 +03:00
.gitmodules
.mailmap
.travis.yml
accel.c
aio-posix.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
aio-win32.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
arch_init.c migration: reduce include files 2015-06-12 06:42:34 +02:00
async.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
balloon.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
block.c block: Fix backing file child when modifying graph 2015-07-14 17:15:23 +02:00
blockdev-nbd.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
blockdev.c mirror: correct buf_size 2015-07-14 21:50:13 -04:00
blockjob.c blockjob: add block_job_release function 2015-07-07 14:27:14 +01:00
bootdevice.c misc: fix typos in copyright declaration 2015-03-26 14:21:43 +01:00
bt-host.c
bt-vhci.c
Changelog
CODING_STYLE
configure crypto: fix build with nettle >= 3.0.0 2015-07-16 20:00:20 +02:00
COPYING
COPYING.LIB
coroutine-gthread.c
coroutine-sigaltstack.c
coroutine-ucontext.c
coroutine-win32.c
cpu-exec.c cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
cpus.c cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
cputlb.c memory: replace cpu_physical_memory_reset_dirty() with test-and-clear 2015-06-05 17:10:00 +02:00
device_tree.c device-tree: Make a common-obj 2015-06-03 14:21:24 +03:00
device-hotplug.c
disas.c disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
dma-helpers.c range: remove useless inclusions 2015-04-30 16:05:48 +03:00
dump.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
exec.c exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb() 2015-07-23 07:37:38 +02:00
gdbstub.c gdbstub: Use cpu_set_pc() helper 2015-07-09 15:20:40 +02:00
HACKING
hmp-commands.hx qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
hmp.c qmp: Add optional bool "unmap" to drive-mirror 2015-07-02 10:06:23 +01:00
hmp.h qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
iohandler.c iohandler: Change return type of qemu_set_fd_handler to "void" 2015-06-12 13:26:21 +01:00
ioport.c - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan) 2015-04-30 12:04:11 +01:00
iothread.c qom: Add helper function for getting user objects root 2015-06-19 18:40:00 +02:00
kvm-all.c VFIO updates for 2.4-rc0 2015-07-07 09:22:40 +01:00
kvm-stub.c kvm: some fixes to kvm_resamplefds_allowed 2015-07-06 12:15:14 -06:00
LICENSE
main-loop.c Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler 2015-06-12 13:26:21 +01:00
MAINTAINERS MAINTAINERS: update email address 2015-07-14 17:15:23 +02:00
Makefile Makefile: Add "make ctags" 2015-06-23 20:23:39 +03:00
Makefile.objs crypto: introduce new module for computing hash digests 2015-07-07 12:04:07 +02:00
Makefile.target migration: move savevm.c inside migration/ 2015-06-12 06:42:30 +02:00
memory_mapping.c memory_mapping: Rework cpu related includes 2015-06-26 16:00:50 +02:00
memory.c memory: fix refcount leak in memory_region_present 2015-07-16 20:00:20 +02:00
module-common.c
monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
nbd.c qemu-nbd: only send a limited number of errno codes on the wire 2015-05-08 14:45:11 +02:00
numa.c numa: Fix memory leak in numa_set_mem_node_id() 2015-07-15 16:57:50 -03:00
os-posix.c rcu: do not create thread in pthread_atfork callback 2015-04-01 10:06:38 +02:00
os-win32.c
page_cache.c
qapi-schema.json Revert "vhost-user: add multi queue support" 2015-07-20 14:19:40 +03:00
qdev-monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qdict-test-data.txt
qemu-bridge-helper.c
qemu-char.c qemu-char: Fix missed data on unix socket 2015-07-23 07:37:38 +02:00
qemu-coroutine-io.c coroutine-io: Return -errno in case of error 2015-03-18 12:07:21 +01:00
qemu-coroutine-lock.c coroutine: remove unnecessary parentheses in qemu_co_queue_empty 2015-04-30 16:05:49 +03:00
qemu-coroutine-sleep.c
qemu-coroutine.c coroutine: Clean up qemu_coroutine_enter() 2015-03-09 11:11:59 +01:00
qemu-doc.texi raw-posix: Deprecate host floppy passthrough 2015-03-19 11:43:02 +01:00
qemu-img-cmds.hx
qemu-img.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qemu-img.texi
qemu-io-cmds.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-io.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-log.c
qemu-nbd.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-nbd.texi
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx Revert "vhost-user: add multi queue support" 2015-07-20 14:19:40 +03:00
qemu-seccomp.c
qemu-tech.texi
qemu-timer.c qemu-timer: initialize "timers_done_ev" to set 2015-07-22 12:41:32 +01:00
qemu.nsi
qemu.sasl
qjson.c QJSON: Use OBJECT_CHECK 2015-05-11 08:59:07 -04:00
qmp-commands.hx migration: Write documetation for events capabilites 2015-07-15 09:07:54 +02:00
qmp.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
qtest.c qtest: pre-buffer hex nibs 2015-05-22 15:58:22 -04:00
README
rules.mak rules.mak: Force CFLAGS for all objects in DSO 2015-05-08 14:45:11 +02:00
softmmu_template.h softmmu: Add probe_write() 2015-06-11 10:13:28 +01:00
spice-qemu-char.c spice: fix spice_chr_add_watch() pre-condition 2015-05-29 09:56:01 +02:00
tcg-runtime.c
tci.c tcg: Mask TCGMemOp appropriately for indexing 2015-06-09 06:35:29 -07:00
thread-pool.c thread-pool: clean up thread_pool_completion_bh() 2015-04-28 15:36:09 +02:00
thunk.c linux-user: Allocate thunk size dynamically 2015-06-15 11:36:58 +03:00
tpm.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
trace-events vmstate: Create optional sections 2015-07-07 14:54:52 +02:00
translate-all.c translate-all: Change tb_flush() env argument to cpu 2015-07-09 15:20:40 +02:00
translate-all.h translate-all: remove unnecessary argument to tb_invalidate_phys_range 2015-06-05 17:09:59 +02:00
user-exec.c exec: move functions to translate-all.h 2015-06-05 17:09:59 +02:00
VERSION Update version for v2.4.0-rc1 release 2015-07-16 20:32:20 +01:00
version.rc
vl.c migration: Register global state section before loadvm 2015-07-15 09:07:54 +02:00
xen-common-stub.c
xen-common.c
xen-hvm-stub.c xen: Remove xen_cmos_set_s3_resume() 2015-03-10 08:15:33 +03:00
xen-hvm.c xen-220615, more SOB lines 2015-06-23 17:46:20 +01:00
xen-mapcache.c

README 

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team