commit kvm for openSUSE:11.4

Hello community, here is the log from the commit of package kvm for openSUSE:11.4 checked in at Tue Jan 24 10:29:00 CET 2012. -------- --- old-versions/11.4/UPDATES/all/kvm/kvm.changes 2012-01-11 18:51:19.000000000 +0100 +++ 11.4/kvm/kvm.changes 2012-01-23 20:34:04.000000000 +0100 @@ -1,0 +2,5 @@ +Mon Jan 23 19:15:54 UTC 2012 - brogers@suse.com + +- avoid buffer overflow in e1000 device emulation (bnc#740165) + +------------------------------------------------------------------- calling whatdependson for 11.4-i586 New: ---- kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kvm.spec ++++++ --- /var/tmp/diff_new_pack.UYMeoV/_old 2012-01-24 10:28:41.000000000 +0100 +++ /var/tmp/diff_new_pack.UYMeoV/_new 2012-01-24 10:28:41.000000000 +0100 @@ -89,7 +89,7 @@ Group: System/Kernel Url: http://kvm.qumranet.com/ Version: %{package_base_version}%{package_extra_version} -Release: 1.<RELEASE12> +Release: 1.<RELEASE14> Source0: qemu-%{name}-%{package_base_version}.tar.bz2 Source1: 60-kvm.rules Source2: qemu-ifup @@ -166,6 +166,7 @@ Patch144: kvm-qemu-preXX-validate-virtqueue.patch Patch145: kvm-qemu-preXX-dictzip3.patch Patch146: kvm-qemu-preXX-os-posix-set-groups-properly-for-runas.patch +Patch147: kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch Patch200: qemu-img-vmdk-scsi.patch Patch201: kvm-studio-slirp-nooutgoing.patch @@ -305,6 +306,7 @@ %patch144 -p1 %patch145 -p1 %patch146 -p1 +%patch147 -p1 # Studio addons %patch200 -p1 ++++++ kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++

From 7fff7710abc9893d8dce5dbad1e7093caf521132 Mon Sep 17 00:00:00 2001 From: Anthony Liguori Date: Wed, 4 Jan 2012 14:50:45 -0600 Subject: e1000: check for overflow whenever issuing PCI dma reads

Reported-by: Nicolae Mogoreanu Signed-off-by: Anthony Liguori --- hw/e1000.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) Index: qemu-kvm-0.12.5/hw/e1000.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/e1000.c +++ qemu-kvm-0.12.5/hw/e1000.c @@ -456,6 +456,7 @@ process_tx_desc(E1000State *s, struct e1 bytes = split_size; if (tp->size + bytes > msh) bytes = msh - tp->size; + bytes = MIN(sizeof(tp->data) - tp->size, bytes); cpu_physical_memory_read(addr, tp->data + tp->size, bytes); if ((sz = tp->size + bytes) >= hdr && tp->size < hdr) memmove(tp->header, tp->data, hdr); @@ -471,6 +472,7 @@ process_tx_desc(E1000State *s, struct e1 // context descriptor TSE is not set, while data descriptor TSE is set DBGOUT(TXERR, "TCP segmentaion Error\n"); } else { + split_size = MIN(sizeof(tp->data) - tp->size, split_size); cpu_physical_memory_read(addr, tp->data + tp->size, split_size); tp->size += split_size; } continue with "q"... Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org