Merge branch 'origin'

Conflicts:
	hw/ide.c
	hw/pc.c
	loader.c
	osdep.c
	osdep.h
	qemu-common.h
(All easily resolved.)

diff --cc Makefile
Simple merge

diff --cc audio/audio.c
Simple merge

diff --cc audio/audio.h
Simple merge

diff --cc block.c
Simple merge

diff --cc cutils.c
Simple merge

diff --cc dyngen.c
Simple merge

diff --cc hw/ide.c
Simple merge

diff --cc linux-user/elfload.c
Simple merge

diff --cc loader.c
index 813756e9cf541434f7652119856d06a207e7e3f5,289ba0f0284ca5ce4bc2951c8b6f5776cb325121..dcb5a6bfa8acc4a0724d815f4ac1b625d39cd033
--- 1/loader.c
--- 2/loader.c
+++ b/loader.c
@@@ -125,18 -205,22 +204,22 @@@ int load_aout(const char *filename, tar
      case ZMAGIC:
      case QMAGIC:
      case OMAGIC:
+         if (e.a_text + e.a_data > max_sz)
+             goto fail;
        lseek(fd, N_TXTOFF(e), SEEK_SET);
-       size = qemu_read(fd, addr, e.a_text + e.a_data);
+       size = read_targphys(fd, addr, e.a_text + e.a_data);
 -      if (size < 0)
 +      if (size != e.a_text + e.a_data)
            goto fail;
        break;
      case NMAGIC:
+         if (N_DATADDR(e) + e.a_data > max_sz)
+             goto fail;
        lseek(fd, N_TXTOFF(e), SEEK_SET);
-       size = qemu_read(fd, addr, e.a_text);
+       size = read_targphys(fd, addr, e.a_text);
 -      if (size < 0)
 +      if (size != e.a_text)
            goto fail;
-       ret = qemu_read(fd, addr + N_DATADDR(e), e.a_data);
+       ret = read_targphys(fd, addr + N_DATADDR(e), e.a_data);
 -      if (ret < 0)
 +      if (ret != e.a_data)
            goto fail;
        size += ret;
        break;

diff --cc monitor.c
Simple merge

diff --cc osdep.c
Simple merge

diff --cc osdep.h
Simple merge

diff --cc qemu-common.h
index 66756bf7d8a294986337c1cb7369ec9bbb7bfa1a,a246144672054e7662116a2de421a90806389ea1..964e203ac9756e186ecc6a6b3cd2100c99c5bd17
--- 1/qemu-common.h
--- 2/qemu-common.h
+++ b/qemu-common.h
@@@ -86,17 -86,14 +86,25 @@@ int strstart(const char *str, const cha
  int stristart(const char *str, const char *val, const char **ptr);
  time_t mktimegm(struct tm *tm);
  
 +#define CTYPE(isfoobar,argumentchar) (isfoobar((unsigned char)(argumentchar)))
 +  /* One must not pass a plain `char' to isupper, toupper, et al.  If
 +   * it has the top bit set (ie, is negative if your chars are
 +   * signed), undefined behaviour results.  The <ctype.h> functions
 +   * are defined to take the value of an unsigned char, as an int.
 +   * So use this macro.  You may pass toupper et al for isfoobar.
 +   * Do not pass EOF as a character to this macro.  If you might have
 +   * EOF then you ought to have it in an int representing an unsigned
 +   * char, which is safe for the ctype macros directly.  Or test separately.
 +   * Obviously don't use this for floating point things like isnan! */
 +
+ void *qemu_malloc(size_t size);
+ void *qemu_mallocz(size_t size);
+ void qemu_free(void *ptr);
+ char *qemu_strdup(const char *str);
+ 
+ void *get_mmap_addr(unsigned long size);
+ 
+ 
  /* Error handling.  */
  
  void hw_error(const char *fmt, ...)

diff --cc tests/qruncom.c
Simple merge

diff --cc vl.c
Simple merge

diff --cc vnc.c
Simple merge