Fix CVE-2007-1320, CVE-2007-1321 , CVE-2007-1322, CVE-2007-1323 and CVE-2007-1366

diff -r 3341afbb1953 tools/ioemu/block.c
@@ -458,8 +458,15 @@ int bdrv_write(BlockDriverState *bs, int
         return -1;
     if (bs->read_only)
         return -1;
+    if (sector_num < 0)
+        return -1;
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);   
+    }
+    {
+        unsigned int ns = sector_num * 512;
+        if (ns < 0)
+            return -1;
     }
     return bs->drv->bdrv_write(bs, sector_num, buf, nb_sectors);
 }

117 lines not on this page · raw message

diff -r 3341afbb1953 tools/ioemu/hw/cirrus_vga_rop.h
@@ -31,6 +31,12 @@ glue(cirrus_bitblt_rop_fwd_, ROP_NAME)(C
     int x,y;
     dstpitch -= bltwidth;
     srcpitch -= bltwidth;
+
+    if (dstpitch < 0 || srcpitch < 0) {
+        /* is 0 valid? srcpitch == 0 could be useful */
+        return;
+    }
+
     for (y = 0; y < bltheight; y++) {
         for (x = 0; x < bltwidth; x++) {
             ROP_OP(*dst, *src);

diff -r 3341afbb1953 tools/ioemu/hw/dma.c
@@ -340,9 +340,11 @@ static void channel_run (int ncont, int 
 #endif
 
     r = dma_controllers[ncont].regs + ichan;
-    n = r->transfer_handler (r->opaque, ichan + (ncont << 2),
-                             r->now[COUNT], (r->base[COUNT] + 1) << ncont);
-    r->now[COUNT] = n;
+    if (r->transfer_handler) {
+        n = r->transfer_handler (r->opaque, ichan + (ncont << 2),
+                                 r->now[COUNT], (r->base[COUNT] + 1) << ncont);
+        r->now[COUNT] = n;
+    }
     ldebug ("dma_pos %d size %d\n", n, (r->base[COUNT] + 1) << ncont);
 }
 

diff -r 3341afbb1953 tools/ioemu/hw/fdc.c
@@ -1110,8 +1110,13 @@ static uint32_t fdctrl_read_data (fdctrl
             len = fdctrl->data_len - fdctrl->data_pos;
             if (len > FD_SECTOR_LEN)
                 len = FD_SECTOR_LEN;
-            bdrv_read(cur_drv->bs, fd_sector(cur_drv),
-                      fdctrl->fifo, len);
+            if (cur_drv->bs) {
+                bdrv_read(cur_drv->bs, fd_sector(cur_drv),
+                          fdctrl->fifo, len);
+            } else {
+                FLOPPY_ERROR("can't read data from drive\n");
+                return 0;
+            }
         }
     }
     retval = fdctrl->fifo[pos];

diff -r 3341afbb1953 tools/ioemu/hw/i8259.c
@@ -292,9 +292,11 @@ static void pic_ioport_write(void *opaqu
             s->init_state = 1;
             s->init4 = val & 1;
             if (val & 0x02)
-                hw_error("single mode not supported");
+                /* hw_error("single mode not supported"); */
+                return;
             if (val & 0x08)
-                hw_error("level sensitive irq not supported");
+                /* hw_error("level sensitive irq not supported"); */
+                return;
         } else if (val & 0x08) {
             if (val & 0x04)
                 s->poll = 1;

diff -r 3341afbb1953 tools/ioemu/hw/ne2000.c
@@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
 {
     NE2000State *s = opaque;
     uint8_t *p;
-    int total_len, next, avail, len, index, mcast_idx;
+    unsigned int total_len, next, avail, len, index, mcast_idx;
     uint8_t buf1[60];
     static const uint8_t broadcast_macaddr[6] = 
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };

@@ -327,7 +327,11 @@ static void ne2000_receive(void *opaque,
 
     /* write packet data */
     while (size > 0) {
-        avail = s->stop - index;
+        /* taviso: this can wrap, so check its okay. */
+        if (index <= s->stop)
+            avail = s->stop - index;
+        else
+            avail = 0;
         len = size;
         if (len > avail)
             len = avail;

diff -r 3341afbb1953 tools/ioemu/hw/pc.c
@@ -327,7 +327,8 @@ void bochs_bios_write(void *opaque, uint
     case 0x400:
     case 0x401:
         fprintf(stderr, "BIOS panic at rombios.c, line %d\n", val);
-        exit(1);
+        /* according to documentation, these can be safely ignored */
+        break;
     case 0x402:
     case 0x403:
 #ifdef DEBUG_BIOS

@@ -350,8 +351,9 @@ void bochs_bios_write(void *opaque, uint
         /* LGPL'ed VGA BIOS messages */
     case 0x501:
     case 0x502:
+        /* according to documentation, these can be safely ignored */
         fprintf(stderr, "VGA BIOS panic, line %d\n", val);
-        exit(1);
+        break;
     case 0x500:
     case 0x503:
 #ifdef DEBUG_BIOS

diff -r 3341afbb1953 tools/ioemu/hw/sb16.c
@@ -1235,8 +1235,10 @@ static int SB_read_DMA (void *opaque, in
             s->block_size);
 #endif
 
-    while (s->left_till_irq <= 0) {
-        s->left_till_irq = s->block_size + s->left_till_irq;
+    if (s->block_size) {
+        while (s->left_till_irq <= 0) {
+            s->left_till_irq = s->block_size + s->left_till_irq;
+        }
     }
 
     return dma_pos;

diff -r 3341afbb1953 tools/ioemu/target-i386/translate.c
@@ -5244,7 +5244,12 @@ static target_ulong disas_insn(DisasCont
         if (CODE64(s))
             goto illegal_op;
         val = ldub_code(s->pc++);
-        gen_op_aam(val);
+        /* taviso: operand can be zero */
+        if (val) {
+            gen_op_aam(val);
+        } else {
+            gen_exception(s, EXCP00_DIVZ, s->pc - s->cs_base);
+        }
         s->cc_op = CC_OP_LOGICB;
         break;
     case 0xd5: /* aad */

@@ -5292,6 +5297,7 @@ static target_ulong disas_insn(DisasCont
         gen_jmp_im(pc_start - s->cs_base);
         gen_op_into(s->pc - pc_start);
         break;
+#ifdef WANT_ICEBP
     case 0xf1: /* icebp (undocumented, exits to external debugger) */
 #if 1
         gen_debug(s, pc_start - s->cs_base);

@@ -5301,6 +5307,7 @@ static target_ulong disas_insn(DisasCont
         cpu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM);
 #endif
         break;
+#endif /* icebp */
     case 0xfa: /* cli */
         if (!s->vm86) {
             if (s->cpl <= s->iopl) {

diff -r 3341afbb1953 tools/ioemu/vl.c
@@ -3239,8 +3239,8 @@ typedef struct NetSocketState {
     VLANClientState *vc;
     int fd;
     int state; /* 0 = getting length, 1 = getting data */
-    int index;
-    int packet_len;
+    unsigned int index;
+    unsigned int packet_len;
     uint8_t buf[4096];
     struct sockaddr_in dgram_dst; /* contains inet host and port destination iff connectionless (SOCK_DGRAM) */
 } NetSocketState;

@@ -3271,7 +3271,8 @@ static void net_socket_send(void *opaque
 static void net_socket_send(void *opaque)
 {
     NetSocketState *s = opaque;
-    int l, size, err;
+    int size, err;
+    unsigned l;
     uint8_t buf1[4096];
     const uint8_t *buf;
 

@@ -3310,7 +3311,15 @@ static void net_socket_send(void *opaque
             l = s->packet_len - s->index;
             if (l > size)
                 l = size;
-            memcpy(s->buf + s->index, buf, l);
+            if (s->index + l <= sizeof(s->buf)) {
+                memcpy(s->buf + s->index, buf, l);
+            } else {
+                fprintf(stderr, "serious error: oversized packet received,"
+                    "connection terminated.\n");
+                s->state = 0;
+                goto eoc;
+            }
+
             s->index += l;
             buf += l;
             size -= l;

Index: xen-3.1.0-src/tools/ioemu/block.c
===================================================================
@@ -465,6 +465,11 @@ int bdrv_write(BlockDriverState *bs, int
     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
         memcpy(bs->boot_sector_data, buf, 512);   
     }
+    {
+        unsigned int ns = sector_num * 512;
+        if (ns < 0)
+            return -1;
+    }
     return bs->drv->bdrv_write(bs, sector_num, buf, nb_sectors);
 }
 

Index: xen-3.1.0-src/tools/ioemu/hw/fdc.c
===================================================================
@@ -1110,8 +1110,13 @@ static uint32_t fdctrl_read_data (fdctrl
             len = fdctrl->data_len - fdctrl->data_pos;
             if (len > FD_SECTOR_LEN)
                 len = FD_SECTOR_LEN;
-            bdrv_read(cur_drv->bs, fd_sector(cur_drv),
-                      fdctrl->fifo, len);
+            if (cur_drv->bs) {
+                bdrv_read(cur_drv->bs, fd_sector(cur_drv),
+                          fdctrl->fifo, len);
+            } else {
+                FLOPPY_ERROR("can't read data from drive\n");
+                return 0;
+            }
         }
     }
     retval = fdctrl->fifo[pos];

Index: xen-3.1.0-src/tools/ioemu/hw/ne2000.c
===================================================================
@@ -252,7 +252,7 @@ static void ne2000_receive(void *opaque,
 {
     NE2000State *s = opaque;
     uint8_t *p;
-    int total_len, next, avail, len, index, mcast_idx;
+    unsigned int total_len, next, avail, len, index, mcast_idx;
     uint8_t buf1[60];
     static const uint8_t broadcast_macaddr[6] = 
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };

@@ -327,7 +327,11 @@ static void ne2000_receive(void *opaque,
 
     /* write packet data */
     while (size > 0) {
-        avail = s->stop - index;
+        /* taviso: this can wrap, so check its okay. */
+        if (index <= s->stop)
+            avail = s->stop - index;
+        else
+            avail = 0;
         len = size;
         if (len > avail)
             len = avail;

Index: xen-3.1.0-src/tools/ioemu/hw/sb16.c
===================================================================
@@ -1235,8 +1235,10 @@ static int SB_read_DMA (void *opaque, in
             s->block_size);
 #endif
 
-    while (s->left_till_irq <= 0) {
-        s->left_till_irq = s->block_size + s->left_till_irq;
+    if (s->block_size) {
+        while (s->left_till_irq <= 0) {
+            s->left_till_irq = s->block_size + s->left_till_irq;
+        }
     }
 
     return dma_pos;