Hello community, here is the log from the commit of package qemu checked in at Tue Mar 11 17:56:37 CET 2008. -------- --- qemu/qemu.changes 2008-01-17 16:32:55.000000000 +0100 +++ /mounts/work_src_done/STABLE/qemu/qemu.changes 2008-03-11 14:03:25.000000000 +0100 @@ -1,0 +2,5 @@ +Tue Mar 11 14:02:54 CET 2008 - uli@suse.de + +- secfix (unchecked block read/write vulnerability, bug #362956) + +------------------------------------------------------------------- New: ---- bug-362956_qemu-block-rw-rangecheck.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ qemu.spec ++++++ --- /var/tmp/diff_new_pack.Su6471/_old 2008-03-11 17:55:04.000000000 +0100 +++ /var/tmp/diff_new_pack.Su6471/_new 2008-03-11 17:55:04.000000000 +0100 @@ -10,6 +10,7 @@ # norootforbuild + Name: qemu BuildRequires: SDL-devel bison e2fsprogs-devel Url: http://fabrice.bellard.free.fr/qemu/ @@ -17,7 +18,7 @@ Group: System/Emulators/PC Summary: Universal CPU emulator Version: 0.9.1 -Release: 1 +Release: 22 Source: %name-%version.tar.bz2 #Patch400: qemu-0.7.0-gcc4-dot-syms.patch #Patch401: qemu-0.8.0-gcc4-hacks.patch @@ -58,6 +59,7 @@ Patch82: qemu-cvs-svm2.patch Patch83: qemu-cvs-ppcspe.patch Patch84: qemu-s390dis-license.patch +Patch85: bug-362956_qemu-block-rw-rangecheck.patch Source200: kvm_bios.bin Source201: zx-rom.bin Source202: COPYING.zx-rom @@ -161,6 +163,7 @@ %endif %patch83 %patch84 +%patch85 -p1 %if 1 cd gcc-3.3.5 %patch600 @@ -313,6 +316,8 @@ %endif %changelog +* Tue Mar 11 2008 uli@suse.de +- secfix (unchecked block read/write vulnerability, bug #362956) * Thu Jan 17 2008 uli@suse.de - update -> 0.9.1 - TFTP booting from host directory (Anthony Liguori, Erwan Velu) @@ -472,7 +477,7 @@ - added NWFPE glue code fix * Tue Mar 07 2006 schwab@suse.de - More fixes for ia64 port. -* Mon Mar 06 2006 schwab@suse.de +* Tue Mar 07 2006 schwab@suse.de - Remove obsolete hunk from ia64 patch. * Wed Jan 25 2006 mls@suse.de - converted neededforbuild to BuildRequires @@ -488,7 +493,7 @@ - updated linker scripts for new binutils release * Sat Sep 17 2005 dmueller@suse.de - update to 0.7.2 -* Mon Aug 15 2005 schwab@suse.de +* Tue Aug 16 2005 schwab@suse.de - Don't package /emul/ia32-linux on ia64. * Mon Aug 15 2005 schwab@suse.de - Fix compilation on ia64. ++++++ bug-362956_qemu-block-rw-rangecheck.patch ++++++ diff --git a/block.c b/block.c index 0f8ad7b..d7f1114 100644 --- a/block.c +++ b/block.c @@ -123,6 +123,24 @@ void path_combine(char *dest, int dest_size, } } +static int bdrv_rw_badreq_sectors(BlockDriverState *bs, + int64_t sector_num, int nb_sectors) +{ + return + nb_sectors < 0 || + nb_sectors > bs->total_sectors || + sector_num > bs->total_sectors - nb_sectors; +} + +static int bdrv_rw_badreq_bytes(BlockDriverState *bs, + int64_t offset, int count) +{ + int64_t size = bs->total_sectors << SECTOR_BITS; + return + count < 0 || + count > size || + offset > size - count; +} static void bdrv_register(BlockDriver *bdrv) { @@ -375,6 +393,7 @@ int bdrv_open2(BlockDriverState *bs, const char *filename, int flags, } bs->drv = drv; bs->opaque = qemu_mallocz(drv->instance_size); + bs->total_sectors = 0; /* driver will set if it does not do getlength */ if (bs->opaque == NULL && drv->instance_size > 0) return -1; /* Note: for compatibility, we open disk image files as RDWR, and @@ -440,6 +459,7 @@ void bdrv_close(BlockDriverState *bs) bs->drv = NULL; /* call the change callback */ + bs->total_sectors = 0; bs->media_changed = 1; if (bs->change_cb) bs->change_cb(bs->change_opaque); @@ -505,6 +525,8 @@ int bdrv_read(BlockDriverState *bs, int64_t sector_num, if (!drv) return -ENOMEDIUM; + if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) + return -EDOM; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(buf, bs->boot_sector_data, 512); sector_num++; @@ -545,6 +567,8 @@ int bdrv_write(BlockDriverState *bs, int64_t sector_num, return -ENOMEDIUM; if (bs->read_only) return -EACCES; + if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) + return -EDOM; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(bs->boot_sector_data, buf, 512); } @@ -670,6 +694,8 @@ int bdrv_pread(BlockDriverState *bs, int64_t offset, return -ENOMEDIUM; if (!drv->bdrv_pread) return bdrv_pread_em(bs, offset, buf1, count1); + if (bdrv_rw_badreq_bytes(bs, offset, count1)) + return -EDOM; return drv->bdrv_pread(bs, offset, buf1, count1); } @@ -685,6 +711,8 @@ int bdrv_pwrite(BlockDriverState *bs, int64_t offset, return -ENOMEDIUM; if (!drv->bdrv_pwrite) return bdrv_pwrite_em(bs, offset, buf1, count1); + if (bdrv_rw_badreq_bytes(bs, offset, count1)) + return -EDOM; return drv->bdrv_pwrite(bs, offset, buf1, count1); } @@ -951,6 +979,8 @@ int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num, return -ENOMEDIUM; if (!drv->bdrv_write_compressed) return -ENOTSUP; + if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) + return -EDOM; return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors); } @@ -1097,6 +1127,8 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDriverState *bs, int64_t sector_num, if (!drv) return NULL; + if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) + return NULL; /* XXX: we assume that nb_sectors == 0 is suppored by the async read */ if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { @@ -1128,6 +1160,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num, return NULL; if (bs->read_only) return NULL; + if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors)) + return NULL; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(bs->boot_sector_data, buf, 512); } ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... --------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org