Fix an infinite loop in the emulated SB16 device
PATCH 1/1 Fix an infinite loop in the emulated SB16 device
This patch from Tavis Ormandy <[email protected]> fixes an infinite loop in the emulated SB16 device.
See http://taviso.decsystem.org/virtsec.pdf for more details.
--- hw/sb16.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)
hw/sb16.c +4 -2
@@ -1246,8 +1246,10 @@ static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len) s->block_size);#endif -while (s->left_till_irq <=0 ) { - s->left_till_irq = s->block_size + s->left_till_irq; +if (s->block_size) { +while (s->left_till_irq <=0 ) { + s->left_till_irq = s->block_size + s->left_till_irq; + } }return dma_pos;
Signature · 4 lines
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73 : :' : Debian developer | Electrical Engineer `. `' [email protected] | [email protected] `- people.debian.org/~aurel32 | www.aurel32.net
Quoted 15 lines · Aurelien Jarno
This patch from Tavis Ormandy <[email protected]> fixes an infinite loop in the emulated SB16 device.
See http://taviso.decsystem.org/virtsec.pdf for more details.
---hw/sb16.c| 6 ++++--1 files changed, 4 insertions(+), 2 deletions(-)hw/sb16.c +0
-0@@ -1246,8 +1246,10 @@ static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len) s->block_size);#endif
hw/sb16.c static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len) · line 1255
Quoted 10 lines
hw/sb16.c +4
-2-while (s->left_till_irq <=0 ) { - s->left_till_irq = s->block_size + s->left_till_irq; +if (s->block_size) { +while (s->left_till_irq <=0 ) { + s->left_till_irq = s->block_size + s->left_till_irq; + } }return dma_pos;
This was fixed by commit 'Mon Jan 14 04:24:29 2008 UTC (2 weeks, 1 day ago) by balrog', and the fix is elaborated on in:
http://lists.gnu.org/archive/html/qemu-devel/2007-05/msg00038.html
http://lists.gnu.org/archive/html/qemu-devel/2007-05/msg00019.html
Signature · 1 line
mailto:[email protected]