OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity
QEMU With E2K User Support
40,280 Commits 9 Branches 0 Tags 459 MiB
C 83.1%
C++ 6.3%
Python 3.2%
Dylan 2.8%
Shell 1.6%
Other 2.8%
d2ff858545
Go to file
Kevin Wolf d2ff858545 ide: Check array bounds before writing to io_buffer (CVE-2015-5154) 
If the end_transfer_func of a command is called because enough data has
been read or written for the current PIO transfer, and it fails to
correctly call the command completion functions, the DRQ bit in the
status register and s->end_transfer_func may remain set. This allows the
guest to access further bytes in s->io_buffer beyond s->data_end, and
eventually overflowing the io_buffer.

One case where this currently happens is emulation of the ATAPI command
START STOP UNIT.

This patch fixes the problem by adding explicit array bounds checks
before accessing the buffer instead of relying on end_transfer_func to
function correctly.

Cc: qemu-stable@nongnu.org
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
2015-07-26 23:42:53 -04:00
audio ossaudio: fix memory leak 2015-07-08 13:11:01 +02:00
backends hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init() 2015-07-22 15:09:25 -03:00
block mirror: Speed up bitmap initial scanning 2015-07-22 11:14:21 +01:00
bsd-user cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
crypto crypto: Fix aes_decrypt_wrapper() 2015-07-20 13:35:45 +02:00
default-configs acpi: split out ICH ACPI support 2015-07-07 13:11:57 +03:00
disas disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR 2015-07-21 11:18:45 +01:00
docs AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
dtc@65cc4d2748 dtc: Update dtc / libfdt submodule to version 1.4.0 2015-06-03 23:56:49 +02:00
fpu target-s390x: define default NaN values 2015-06-05 01:37:58 +02:00
fsdev virtfs-proxy-helper: fail gracefully if socket path is too long 2015-06-16 20:32:29 +05:30
gdb-xml gdb-xml: Include XML for s390 vector registers 2015-05-27 17:52:03 +02:00
hw ide: Check array bounds before writing to io_buffer (CVE-2015-5154) 2015-07-26 23:42:53 -04:00
include memory: count number of active VGA logging clients 2015-07-24 13:57:45 +02:00
libcacard libcacard: pkgconfig: tidy dependent libs 2015-06-23 19:57:28 +03:00
libdecnumber remove libdecnumber/dpd/decimal128Local.h 2015-06-23 19:57:27 +03:00
linux-headers linux-headers: Update to 4.2-rc1 2015-07-06 17:59:01 +02:00
linux-user linux-user: Fix MIPS N64 trap and break instruction bug 2015-07-15 14:07:25 +01:00
migration rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
net net: Flush queued packets when guest resumes 2015-07-20 18:11:24 +01:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
pixman@87eea99e44 pixman: update internal copy to pixman-0.32.6 2014-09-15 08:14:19 +02:00
po po: fix conflict with %.mo rule in rules.mak 2014-09-26 13:35:08 +02:00
qapi migration: create migration event 2015-07-07 14:54:55 +02:00
qga qga: fixed versions for guest bus types in qapi-schema 2015-07-21 14:36:06 -05:00
qobject Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qom cpu: Convert cpu_index into a bitmap 2015-07-09 15:20:40 +02:00
roms pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
scripts virtio-input: move sys/ioctl.h include 2015-07-16 17:34:41 +02:00
slirp qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
stubs main-loop: introduce qemu_mutex_iothread_locked 2015-07-01 15:45:50 +02:00
target-alpha cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-arm target-arm: kvm: Differentiate registers based on write-back levels 2015-07-21 11:18:45 +01:00
target-cris disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-i386 target-i386/FPU: a misprint in helper_fistll_ST0 2015-07-24 13:57:45 +02:00
target-lm32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-m68k cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-microblaze disas: microblaze: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-mips mips/kvm: Sign extend registers written to KVM 2015-07-16 20:00:20 +02:00
target-moxie cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-openrisc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-ppc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-s390x cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sh4 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sparc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-tricore cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-unicore32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-xtensa cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
tcg tcg/optimize: fix tcg_opt_gen_movi 2015-07-23 20:37:12 -07:00
tests rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
trace Remove superfluous '\n' around error_report() 2015-03-10 08:15:33 +03:00
ui vnc: fix memory leak 2015-07-24 13:57:44 +02:00
util rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
.exrc
.gitignore gitignore: Ignore more .pod files. 2015-04-04 09:45:59 +03:00
.gitmodules
.mailmap
.travis.yml .travis.yml: Add "--enable-modules" 2015-01-26 12:27:05 +01:00
accel.c accel: Create accel object when initializing machine 2014-10-09 15:36:14 +02:00
aio-posix.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
aio-win32.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
arch_init.c migration: reduce include files 2015-06-12 06:42:34 +02:00
async.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
balloon.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
block.c block: Fix backing file child when modifying graph 2015-07-14 17:15:23 +02:00
blockdev-nbd.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
blockdev.c mirror: correct buf_size 2015-07-14 21:50:13 -04:00
blockjob.c blockjob: add block_job_release function 2015-07-07 14:27:14 +01:00
bootdevice.c misc: fix typos in copyright declaration 2015-03-26 14:21:43 +01:00
bt-host.c
bt-vhci.c
Changelog
CODING_STYLE CODING_STYLE: Section about conditional statement 2014-08-15 18:54:06 +04:00
configure crypto: fix build with nettle >= 3.0.0 2015-07-16 20:00:20 +02:00
COPYING
COPYING.LIB
coroutine-gthread.c
coroutine-sigaltstack.c coroutine-sigaltstack: Change jmp_buf to sigjmp_buf 2014-11-11 11:07:55 +03:00
coroutine-ucontext.c coroutine-ucontext: use __thread 2015-01-13 13:43:28 +00:00
coroutine-win32.c coroutine-win32.c: Add noinline attribute to work around gcc bug 2014-06-26 14:08:14 +01:00
cpu-exec.c cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
cpus.c rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
cputlb.c memory: replace cpu_physical_memory_reset_dirty() with test-and-clear 2015-06-05 17:10:00 +02:00
device_tree.c device-tree: Make a common-obj 2015-06-03 14:21:24 +03:00
device-hotplug.c pci-hotplug-old: Has been dead for five major releases, bury 2015-03-01 12:37:54 +01:00
disas.c disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
dma-helpers.c range: remove useless inclusions 2015-04-30 16:05:48 +03:00
dump.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
exec.c exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb() 2015-07-23 07:37:38 +02:00
gdbstub.c gdbstub: Use cpu_set_pc() helper 2015-07-09 15:20:40 +02:00
HACKING
hmp-commands.hx qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
hmp.c qmp: Add optional bool "unmap" to drive-mirror 2015-07-02 10:06:23 +01:00
hmp.h qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
iohandler.c iohandler: Change return type of qemu_set_fd_handler to "void" 2015-06-12 13:26:21 +01:00
ioport.c - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan) 2015-04-30 12:04:11 +01:00
iothread.c rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
kvm-all.c VFIO updates for 2.4-rc0 2015-07-07 09:22:40 +01:00
kvm-stub.c kvm: some fixes to kvm_resamplefds_allowed 2015-07-06 12:15:14 -06:00
LICENSE vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio 2014-12-19 15:24:06 -07:00
main-loop.c Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler 2015-06-12 13:26:21 +01:00
MAINTAINERS MAINTAINERS: update email address 2015-07-14 17:15:23 +02:00
Makefile Makefile: Add "make ctags" 2015-06-23 20:23:39 +03:00
Makefile.objs crypto: introduce new module for computing hash digests 2015-07-07 12:04:07 +02:00
Makefile.target migration: move savevm.c inside migration/ 2015-06-12 06:42:30 +02:00
memory_mapping.c memory_mapping: Rework cpu related includes 2015-06-26 16:00:50 +02:00
memory.c memory: count number of active VGA logging clients 2015-07-24 13:57:45 +02:00
module-common.c
monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
nbd.c qemu-nbd: only send a limited number of errno codes on the wire 2015-05-08 14:45:11 +02:00
numa.c numa: Fix memory leak in numa_set_mem_node_id() 2015-07-15 16:57:50 -03:00
os-posix.c rcu: do not create thread in pthread_atfork callback 2015-04-01 10:06:38 +02:00
os-win32.c pidfile: stop making pidfile error a special case 2014-11-02 10:04:34 +03:00
page_cache.c xbzrle: rebuild the cache_is_cached function 2015-01-15 17:49:43 +05:30
qapi-schema.json Revert "vhost-user: add multi queue support" 2015-07-20 14:19:40 +03:00
qdev-monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qdict-test-data.txt
qemu-bridge-helper.c qemu-bridge-helper: Fix fd leak in main() 2014-06-27 10:39:10 +02:00
qemu-char.c qemu-char: Fix missed data on unix socket 2015-07-23 07:37:38 +02:00
qemu-coroutine-io.c coroutine-io: Return -errno in case of error 2015-03-18 12:07:21 +01:00
qemu-coroutine-lock.c coroutine: remove unnecessary parentheses in qemu_co_queue_empty 2015-04-30 16:05:49 +03:00
qemu-coroutine-sleep.c coroutine: Drop co_sleep_ns 2014-08-29 10:46:58 +01:00
qemu-coroutine.c coroutine: Clean up qemu_coroutine_enter() 2015-03-09 11:11:59 +01:00
qemu-doc.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-img-cmds.hx qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-img.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qemu-img.texi qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-io-cmds.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-io.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-log.c qemu-log: Correct help text of 'log cpu_reset' 2015-02-10 09:27:20 +03:00
qemu-nbd.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-nbd.texi
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-seccomp.c seccomp: add mlockall to whitelist 2015-01-23 14:07:08 +01:00
qemu-tech.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-timer.c qemu-timer: initialize "timers_done_ev" to set 2015-07-22 12:41:32 +01:00
qemu.nsi
qemu.sasl
qjson.c QJSON: Use OBJECT_CHECK 2015-05-11 08:59:07 -04:00
qmp-commands.hx migration: Write documetation for events capabilites 2015-07-15 09:07:54 +02:00
qmp.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
qtest.c qtest: pre-buffer hex nibs 2015-05-22 15:58:22 -04:00
README
rules.mak rules.mak: Force CFLAGS for all objects in DSO 2015-05-08 14:45:11 +02:00
softmmu_template.h softmmu: Add probe_write() 2015-06-11 10:13:28 +01:00
spice-qemu-char.c spice: fix spice_chr_add_watch() pre-condition 2015-05-29 09:56:01 +02:00
tcg-runtime.c
tci.c tcg: Mask TCGMemOp appropriately for indexing 2015-06-09 06:35:29 -07:00
thread-pool.c thread-pool: clean up thread_pool_completion_bh() 2015-04-28 15:36:09 +02:00
thunk.c linux-user: Allocate thunk size dynamically 2015-06-15 11:36:58 +03:00
tpm.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
trace-events vmstate: Create optional sections 2015-07-07 14:54:52 +02:00
translate-all.c translate-all: Change tb_flush() env argument to cpu 2015-07-09 15:20:40 +02:00
translate-all.h translate-all: remove unnecessary argument to tb_invalidate_phys_range 2015-06-05 17:09:59 +02:00
user-exec.c exec: move functions to translate-all.h 2015-06-05 17:09:59 +02:00
VERSION Update version for v2.4.0-rc2 release 2015-07-22 18:17:19 +01:00
version.rc
vl.c vl: Fix compiler warning for builds without VNC 2015-07-24 13:57:45 +02:00
xen-common-stub.c accel: Move Xen registration code to xen-common.c 2014-10-04 08:59:15 +02:00
xen-common.c accel: Pass MachineState object to accel init functions 2014-10-09 12:57:10 +02:00
xen-hvm-stub.c xen: Remove xen_cmos_set_s3_resume() 2015-03-10 08:15:33 +03:00
xen-hvm.c xen-220615, more SOB lines 2015-06-23 17:46:20 +01:00
xen-mapcache.c xen: add a lock for the mapcache 2015-01-20 14:24:17 +00:00

README 

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team