mirror of
https://git.FreeBSD.org/ports.git
synced 2025-01-29 10:18:30 +00:00
Catch up with github tree - changelog:
https://github.com/seanbruno/qemu-bsd-user/commits/bsd-user
This commit is contained in:
Juergen Lock
parent
ffeb0aa74b
commit
3afca2cc7e
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=386632
@ -2,8 +2,7 @@
|
||||
# $FreeBSD$
|
||||
|
||||
PORTNAME= qemu
|
||||
PORTVERSION= 2.3.50.g20150501
|
||||
PORTREVISION= 1
|
||||
PORTVERSION= 2.3.50.g20150517
|
||||
CATEGORIES= emulators
|
||||
MASTER_SITES= GH \
|
||||
LOCAL/nox \
|
||||
@ -21,7 +20,7 @@ COMMENT?= QEMU CPU Emulator - github bsd-user branch
|
||||
USE_GITHUB= yes
|
||||
GH_ACCOUNT= seanbruno
|
||||
GH_PROJECT= ${PORTNAME}-bsd-user
|
||||
GH_TAGNAME= 38afafe
|
||||
GH_TAGNAME= c65473e
|
||||
HAS_CONFIGURE= yes
|
||||
USES= gmake pkgconfig bison perl5 python:2,build
|
||||
USE_PERL5= build
|
||||
@ -133,7 +132,7 @@ CONFIGURE_ARGS+= --prefix=${PREFIX} --cc=${CC} --enable-docs \
|
||||
--smbd=${LOCALBASE}/sbin/smbd \
|
||||
--enable-debug \
|
||||
--enable-debug-info \
|
||||
--extra-cflags=-I${WRKSRC}\ -I${LOCALBASE}/include\ -DPREFIX=\\\"${PREFIX}\\\"
|
||||
--extra-cflags=-I${WRKSRC}\ -I${LOCALBASE}/include\ -DPREFIX=\\\"\"${PREFIX}\\\"\"
|
||||
|
||||
.if empty(PORT_OPTIONS:MX11)
|
||||
CONFIGURE_ARGS+= --disable-sdl
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
SHA256 (qemu/2.3.50.g20150501/seanbruno-qemu-bsd-user-2.3.50.g20150501-38afafe_GH0.tar.gz) = 85cb6a43861711202c432d876d6c6efbbe75616f1ad4a0a116868ccfdbbef369
|
||||
SIZE (qemu/2.3.50.g20150501/seanbruno-qemu-bsd-user-2.3.50.g20150501-38afafe_GH0.tar.gz) = 10906252
|
||||
SHA256 (qemu/2.3.50.g20150501/dtc-v1.4.0.tar.gz) = 39d0713efd82a27adc065ecb9ef36401c53d5ee87ae1764e2bb243fcd97488e3
|
||||
SIZE (qemu/2.3.50.g20150501/dtc-v1.4.0.tar.gz) = 131893
|
||||
SHA256 (qemu/2.3.50.g20150517/seanbruno-qemu-bsd-user-2.3.50.g20150517-c65473e_GH0.tar.gz) = eff1dc0aaae0a2400f4d9ab42ea7d6b723eb6d5a96cc72a8b310ebe2e82d77e1
|
||||
SIZE (qemu/2.3.50.g20150517/seanbruno-qemu-bsd-user-2.3.50.g20150517-c65473e_GH0.tar.gz) = 10985886
|
||||
SHA256 (qemu/2.3.50.g20150517/dtc-v1.4.0.tar.gz) = 39d0713efd82a27adc065ecb9ef36401c53d5ee87ae1764e2bb243fcd97488e3
|
||||
SIZE (qemu/2.3.50.g20150517/dtc-v1.4.0.tar.gz) = 131893
|
||||
|
||||
@ -1,84 +0,0 @@
|
||||
From e907746266721f305d67bc0718795fedee2e824c Mon Sep 17 00:00:00 2001
|
||||
From: Petr Matousek <pmatouse@redhat.com>
|
||||
Date: Wed, 6 May 2015 09:48:59 +0200
|
||||
Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated buffer
|
||||
|
||||
During processing of certain commands such as FD_CMD_READ_ID and
|
||||
FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
|
||||
get out of bounds leading to memory corruption with values coming
|
||||
from the guest.
|
||||
|
||||
Fix this by making sure that the index is always bounded by the
|
||||
allocated memory.
|
||||
|
||||
This is CVE-2015-3456.
|
||||
|
||||
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
|
||||
Reviewed-by: John Snow <jsnow@redhat.com>
|
||||
Signed-off-by: John Snow <jsnow@redhat.com>
|
||||
---
|
||||
hw/block/fdc.c | 17 +++++++++++------
|
||||
1 files changed, 11 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/hw/block/fdc.c b/hw/block/fdc.c
|
||||
index f72a392..d8a8edd 100644
|
||||
--- a/hw/block/fdc.c
|
||||
+++ b/hw/block/fdc.c
|
||||
@@ -1497,7 +1497,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
|
||||
{
|
||||
FDrive *cur_drv;
|
||||
uint32_t retval = 0;
|
||||
- int pos;
|
||||
+ uint32_t pos;
|
||||
|
||||
cur_drv = get_cur_drv(fdctrl);
|
||||
fdctrl->dsr &= ~FD_DSR_PWRDOWN;
|
||||
@@ -1506,8 +1506,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
|
||||
return 0;
|
||||
}
|
||||
pos = fdctrl->data_pos;
|
||||
+ pos %= FD_SECTOR_LEN;
|
||||
if (fdctrl->msr & FD_MSR_NONDMA) {
|
||||
- pos %= FD_SECTOR_LEN;
|
||||
if (pos == 0) {
|
||||
if (fdctrl->data_pos != 0)
|
||||
if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
|
||||
@@ -1852,10 +1852,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int direction)
|
||||
static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
|
||||
{
|
||||
FDrive *cur_drv = get_cur_drv(fdctrl);
|
||||
+ uint32_t pos;
|
||||
|
||||
- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
|
||||
+ pos = fdctrl->data_pos - 1;
|
||||
+ pos %= FD_SECTOR_LEN;
|
||||
+ if (fdctrl->fifo[pos] & 0x80) {
|
||||
/* Command parameters done */
|
||||
- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
|
||||
+ if (fdctrl->fifo[pos] & 0x40) {
|
||||
fdctrl->fifo[0] = fdctrl->fifo[1];
|
||||
fdctrl->fifo[2] = 0;
|
||||
fdctrl->fifo[3] = 0;
|
||||
@@ -1955,7 +1958,7 @@ static uint8_t command_to_handler[256];
|
||||
static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
|
||||
{
|
||||
FDrive *cur_drv;
|
||||
- int pos;
|
||||
+ uint32_t pos;
|
||||
|
||||
/* Reset mode */
|
||||
if (!(fdctrl->dor & FD_DOR_nRESET)) {
|
||||
@@ -2004,7 +2007,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
|
||||
}
|
||||
|
||||
FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
|
||||
- fdctrl->fifo[fdctrl->data_pos++] = value;
|
||||
+ pos = fdctrl->data_pos++;
|
||||
+ pos %= FD_SECTOR_LEN;
|
||||
+ fdctrl->fifo[pos] = value;
|
||||
if (fdctrl->data_pos == fdctrl->data_len) {
|
||||
/* We now have all parameters
|
||||
* and will be able to treat the command
|
||||
--
|
||||
1.7.0.4
|
||||
|
||||
Loading…
Reference in New Issue
Block a user