File: virtio-serial-fix-ANY_LAYOUT-CVE-2015-5745.patch

package info (click to toggle)
qemu-kvm 1.1.2%2Bdfsg-6%2Bdeb7u12
  • links: PTS, VCS
  • area: main
  • in suites: wheezy
  • size: 43,848 kB
  • sloc: ansic: 606,321; asm: 10,684; sh: 6,663; perl: 4,223; python: 3,802; makefile: 1,076; objc: 843; xml: 409
file content (29 lines) | stat: -rw-r--r-- 1,003 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
From 7882080388be5088e72c425b02223c02e6cb4295 Mon Sep 17 00:00:00 2001
From: "Michael S. Tsirkin" <mst@redhat.com>
Date: Thu, 23 Jul 2015 17:52:02 +0300
Subject: virtio-serial: fix ANY_LAYOUT
Bug-Debian: http://bugs.debian.org/795087

Don't assume a specific layout for control messages.
Required by virtio 1.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
---
 hw/char/virtio-serial-bus.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -222,7 +222,9 @@ static size_t send_control_msg(VirtIOSer
 
     cpkt = (struct virtio_console_control *)buf;
     stl_p(&cpkt->id, port->id);
-    memcpy(elem.in_sg[0].iov_base, buf, len);
+
+    /* TODO: detect a buffer that's too short, set NEEDS_RESET */
+    iov_from_buf(elem.in_sg, elem.in_num, buf, 0, len);
 
     virtqueue_push(vq, &elem, len);
     virtio_notify(&port->vser->vdev, vq);