diff options
Diffstat (limited to 'app-emulation/qemu/files/qemu-2.7.0-CVE-2016-8909.patch')
-rw-r--r-- | app-emulation/qemu/files/qemu-2.7.0-CVE-2016-8909.patch | 31 |
1 files changed, 0 insertions, 31 deletions
diff --git a/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-8909.patch b/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-8909.patch deleted file mode 100644 index ed6613f8966..00000000000 --- a/app-emulation/qemu/files/qemu-2.7.0-CVE-2016-8909.patch +++ /dev/null @@ -1,31 +0,0 @@ -From: Prasad J Pandit <address@hidden> - -Intel HDA emulator uses stream of buffers during DMA data -transfers. Each entry has buffer length and buffer pointer -position, which are used to derive bytes to 'copy'. If this -length and buffer pointer were to be same, 'copy' could be -set to zero(0), leading to an infinite loop. Add check to -avoid it. - -Reported-by: Huawei PSIRT <address@hidden> -Signed-off-by: Prasad J Pandit <address@hidden> ---- - hw/audio/intel-hda.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c -index cd95340..537face 100644 ---- a/hw/audio/intel-hda.c -+++ b/hw/audio/intel-hda.c -@@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, - } - - left = len; -- while (left > 0) { -+ s = st->bentries; -+ while (left > 0 && s-- > 0) { - copy = left; - if (copy > st->bsize - st->lpib) - copy = st->bsize - st->lpib; --- -2.7.4 |