From f6676f8a7021a4bb20d69d36539b54030880cd91 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Beno=C3=AEt=20Canet?= Date: Sat, 12 Apr 2014 22:59:50 +0200 Subject: [PATCH] ide: Correct improper smart self test counter reset in ide core (CVE-2014-2894) The SMART self test counter was incorrectly being reset to zero, not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE: * We would write off the beginning of a dynamically allocated buffer * We forgot the SMART history Fix this. Signed-off-by: Benoit Canet Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net Reviewed-by: Markus Armbruster Cc: qemu-stable@nongnu.org Acked-by: Kevin Wolf [PMM: tweaked commit message as per suggestions from Markus] Signed-off-by: Peter Maydell (cherry picked from commit 940973ae0b45c9b6817bab8e4cf4df99a9ef83d7) --- hw/ide/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/ide/core.c b/hw/ide/core.c index 9785d5f..c13e54d 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -1548,7 +1548,7 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val) case 2: /* extended self test */ s->smart_selftest_count++; if(s->smart_selftest_count > 21) - s->smart_selftest_count = 0; + s->smart_selftest_count = 1; n = 2 + (s->smart_selftest_count - 1) * 24; s->smart_selftest_data[n] = s->sector; s->smart_selftest_data[n+1] = 0x00; /* OK and finished */ -- 1.7.10.4