From d81e62bebd4b283460026f4ef69110bac32b2eac Mon Sep 17 00:00:00 2001 From: "kfraser@localhost.localdomain" Date: Mon, 27 Nov 2006 10:09:19 +0000 Subject: [PATCH] [QEMU] fdc: Limit sector size to 16K In fdctrl_start_transfer the sector size field (fifo[5]) is not checked for overflows. This allows an arbitrarily large sector size to be used, which can in turn result in a negative data_len field that is then used for DMA transfers. This can lead to the corrpuption of qemu state because some subsequent checks on the transfer length is conducted using signed integers. This patch limits the value fifo[5] to 7 which is the standard limit on floppy sector size. Signed-off-by: Herbert Xu --- tools/ioemu/hw/fdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/ioemu/hw/fdc.c b/tools/ioemu/hw/fdc.c index 3890ace120..1d16cd6518 100644 --- a/tools/ioemu/hw/fdc.c +++ b/tools/ioemu/hw/fdc.c @@ -898,7 +898,7 @@ static void fdctrl_start_transfer (fdctrl_t *fdctrl, int direction) fdctrl->data_len = fdctrl->fifo[8]; } else { int tmp; - fdctrl->data_len = 128 << fdctrl->fifo[5]; + fdctrl->data_len = 128 << (fdctrl->fifo[5] > 7 ? 7 : fdctrl->fifo[5]); tmp = (cur_drv->last_sect - ks + 1); if (fdctrl->fifo[0] & 0x80) tmp += cur_drv->last_sect; -- 2.30.2