ia64/xen-unstable

changeset 15987:0b873d909ad3

ioemu: security fixes for not-built or not-default-configured subsystems.

Patches originally proposed by S. Caglar Onur and cleaned up for
xen-unstable by Robert Buchholz <rbu@gentoo.org>.

Signed-off-by: Keir Fraser <keir@xensource.com>
author Keir Fraser <keir@xensource.com>
date Wed Sep 26 09:19:12 2007 +0100 (2007-09-26)
parents 3c1e76dda38b
children 80277ff19c9c
files tools/ioemu/hw/fdc.c tools/ioemu/hw/ne2000.c tools/ioemu/hw/sb16.c
line diff
     1.1 --- a/tools/ioemu/hw/fdc.c	Wed Sep 26 09:15:34 2007 +0100
     1.2 +++ b/tools/ioemu/hw/fdc.c	Wed Sep 26 09:19:12 2007 +0100
     1.3 @@ -1100,8 +1100,13 @@ static uint32_t fdctrl_read_data (fdctrl
     1.4              len = fdctrl->data_len - fdctrl->data_pos;
     1.5              if (len > FD_SECTOR_LEN)
     1.6                  len = FD_SECTOR_LEN;
     1.7 -            bdrv_read(cur_drv->bs, fd_sector(cur_drv),
     1.8 -                      fdctrl->fifo, len);
     1.9 +            if (cur_drv->bs) {
    1.10 +                bdrv_read(cur_drv->bs, fd_sector(cur_drv),
    1.11 +                          fdctrl->fifo, len);
    1.12 +            } else {
    1.13 +                FLOPPY_ERROR("can't read data from drive\n");
    1.14 +                return 0;
    1.15 +            }
    1.16          }
    1.17      }
    1.18      retval = fdctrl->fifo[pos];
     2.1 --- a/tools/ioemu/hw/ne2000.c	Wed Sep 26 09:15:34 2007 +0100
     2.2 +++ b/tools/ioemu/hw/ne2000.c	Wed Sep 26 09:19:12 2007 +0100
     2.3 @@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
     2.4  {
     2.5      NE2000State *s = opaque;
     2.6      uint8_t *p;
     2.7 -    int total_len, next, avail, len, index, mcast_idx;
     2.8 +    unsigned int total_len, next, avail, len, index, mcast_idx;
     2.9      uint8_t buf1[60];
    2.10      static const uint8_t broadcast_macaddr[6] = 
    2.11          { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
    2.12 @@ -327,7 +327,11 @@ static void ne2000_receive(void *opaque,
    2.13  
    2.14      /* write packet data */
    2.15      while (size > 0) {
    2.16 -        avail = s->stop - index;
    2.17 +        /* taviso: this can wrap, so check its okay. */
    2.18 +        if (index <= s->stop)
    2.19 +            avail = s->stop - index;
    2.20 +        else
    2.21 +            avail = 0;
    2.22          len = size;
    2.23          if (len > avail)
    2.24              len = avail;
     3.1 --- a/tools/ioemu/hw/sb16.c	Wed Sep 26 09:15:34 2007 +0100
     3.2 +++ b/tools/ioemu/hw/sb16.c	Wed Sep 26 09:19:12 2007 +0100
     3.3 @@ -1235,8 +1235,10 @@ static int SB_read_DMA (void *opaque, in
     3.4              s->block_size);
     3.5  #endif
     3.6  
     3.7 -    while (s->left_till_irq <= 0) {
     3.8 -        s->left_till_irq = s->block_size + s->left_till_irq;
     3.9 +    if (s->block_size) {
    3.10 +        while (s->left_till_irq <= 0) {
    3.11 +            s->left_till_irq = s->block_size + s->left_till_irq;
    3.12 +        }
    3.13      }
    3.14  
    3.15      return dma_pos;