diff options
| author | Juergen Lock <nox@FreeBSD.org> | 2015-05-17 10:09:36 +0000 |
|---|---|---|
| committer | Juergen Lock <nox@FreeBSD.org> | 2015-05-17 10:09:36 +0000 |
| commit | a5d6daade5f9d70b65365296353cbbe8ece8a8b6 (patch) | |
| tree | bd581c5d54d5dc952ad2e19ed8c8926a92c739d1 /emulators/qemu/files | |
| parent | - Add CPE info (diff) | |
- Apply fixes for "BENOM" vulnerability - CVE-2015-3456 .
- Bump PORTREVISIONs.
PR: 200255
PR: 200256
PR: 200257
Submitted by: venture37@geeklan.co.uk
Obtained from: http://git.qemu.org/?p=qemu.git;a=commitdiff;h=e907746266721f305d67bc0718795fedee2e824c
Security: http://vuxml.FreeBSD.org/freebsd/2780e442-fc59-11e4-b18b-6805ca1d3bb1.html
Notes
Notes:
svn path=/head/; revision=386593
Diffstat (limited to 'emulators/qemu/files')
| -rw-r--r-- | emulators/qemu/files/patch-CVE-2015-3456 | 44 |
1 files changed, 44 insertions, 0 deletions
diff --git a/emulators/qemu/files/patch-CVE-2015-3456 b/emulators/qemu/files/patch-CVE-2015-3456 new file mode 100644 index 000000000000..3ea061ea2056 --- /dev/null +++ b/emulators/qemu/files/patch-CVE-2015-3456 @@ -0,0 +1,44 @@ +--- a/hw/fdc.c ++++ b/hw/fdc.c +@@ -1324,7 +1324,7 @@ static uint32_t fdctrl_read_data (fdctrl + { + fdrive_t *cur_drv; + uint32_t retval = 0; +- int pos; ++ uint32_t pos; + + cur_drv = get_cur_drv(fdctrl); + fdctrl->dsr &= ~FD_DSR_PWRDOWN; +@@ -1333,8 +1333,8 @@ static uint32_t fdctrl_read_data (fdctrl + return 0; + } + pos = fdctrl->data_pos; ++ pos %= FD_SECTOR_LEN; + if (fdctrl->msr & FD_MSR_NONDMA) { +- pos %= FD_SECTOR_LEN; + if (pos == 0) { + if (fdctrl->data_pos != 0) + if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) { +@@ -1680,8 +1680,11 @@ static void fdctrl_handle_option (fdctrl + static void fdctrl_handle_drive_specification_command (fdctrl_t *fdctrl, int direction) + { + fdrive_t *cur_drv = get_cur_drv(fdctrl); ++ uint32_t pos; ++ ++ pos = fdctrl->data_pos - 1; ++ pos %= FD_SECTOR_LEN; +- +- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) { ++ if (fdctrl->fifo[pos] & 0x80) { + /* Command parameters done */ + if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) { + fdctrl->fifo[0] = fdctrl->fifo[1]; +@@ -1778,7 +1782,7 @@ static uint8_t command_to_handler[256]; + static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value) + { + fdrive_t *cur_drv; +- int pos; ++ uint32_t pos; + + /* Reset mode */ + if (!(fdctrl->dor & FD_DOR_nRESET)) { |