commit kvm for openSUSE:12.1:Update:Test

Hello community, here is the log from the commit of package kvm for openSUSE:12.1:Update:Test checked in at 2012-01-25 15:06:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.1:Update:Test/kvm (Old) and /work/SRC/openSUSE:12.1:Update:Test/.kvm.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Package is "kvm", Maintainer is "BROGERS@suse.com" Changes: -------- --- /work/SRC/openSUSE:12.1:Update:Test/kvm/kvm.changes 2011-12-19 18:18:23.000000000 +0100 +++ /work/SRC/openSUSE:12.1:Update:Test/.kvm.new/kvm.changes 2012-01-25 15:06:23.000000000 +0100 @@ -1,0 +2,10 @@ +Mon Jan 23 19:15:54 UTC 2012 - brogers@suse.com + +- avoid buffer overflow in e1000 device emulation (bnc#740165) + +------------------------------------------------------------------- +Thu Dec 15 15:46:53 UTC 2011 - bkutil@suse.com + +- Fix dictzip with long file names. + +------------------------------------------------------------------- New: ---- kvm-qemu-preXX-dictzip3.patch kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kvm.spec ++++++ --- /var/tmp/diff_new_pack.YNc4jj/_old 2012-01-25 15:06:24.000000000 +0100 +++ /var/tmp/diff_new_pack.YNc4jj/_new 2012-01-25 15:06:24.000000000 +0100 @@ -1,7 +1,7 @@ # # spec file for package kvm # -# Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -144,6 +144,8 @@ Patch110: kvm-qemu-preXX-ccid-Fix-buffer-overrun-in-handling-of-VSC_ATR-message.patch Patch111: kvm-qemu-preXX-scsi-disk-commonize-iovec-creation-between-reads-and.patch Patch112: kvm-qemu-preXX-scsi-disk-lazily-allocate-bounce-buffer.patch +Patch113: kvm-qemu-preXX-dictzip3.patch +Patch114: kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch Patch150: qemu-kvm-common-code-fixes-for-s390-build.patch @@ -246,6 +248,8 @@ %patch110 -p1 %patch111 -p1 %patch112 -p1 +%patch113 -p1 +%patch114 -p1 %patch150 -p1 ++++++ kvm-qemu-preXX-dictzip3.patch ++++++ Index: qemu-kvm-0.12.5/block/tar.c =================================================================== --- qemu-kvm-0.12.5.orig/block/tar.c +++ qemu-kvm-0.12.5/block/tar.c @@ -83,7 +83,8 @@ static int str_ends(char *str, const cha return !strncmp(str + str_len - end_len, end, end_len); } -static int is_target_file(BlockDriverState *bs, char *filename) +static int is_target_file(BlockDriverState *bs, char *filename, + char *header) { int retval = 0; @@ -99,10 +100,17 @@ static int is_target_file(BlockDriverSta if (str_ends(filename, ".vmdk")) retval = 1; + if (retval && + (header[OFFS_TYPE] != '0') && + (header[OFFS_TYPE] != 'S')) { + retval = 0; + } + dprintf("does filename %s match? %s\n", filename, retval ? "yes" : "no"); /* make sure we're not using this name again */ filename[0] = '\0'; + return retval; } @@ -201,12 +209,13 @@ static int tar_open(BlockDriverState *bs bdrv_pread(s->hd, header_offs - s->file_len, s->longfile, sizeof(s->longfile)); s->longfile[sizeof(s->longfile)-1] = '\0'; + real_file = header; } else if (s->longfile[0]) { real_file = s->longfile; } else { real_file = header; } - } while(!is_target_file(bs, real_file)); + } while(!is_target_file(bs, real_file, header)); /* We found an image! */ ++++++ kvm-qemu-preXX-e1000-check-for-overflow-whenever-issuing-PCI-dma-reads.patch ++++++

From 7fff7710abc9893d8dce5dbad1e7093caf521132 Mon Sep 17 00:00:00 2001 From: Anthony Liguori Date: Wed, 4 Jan 2012 14:50:45 -0600 Subject: e1000: check for overflow whenever issuing PCI dma reads

Reported-by: Nicolae Mogoreanu Signed-off-by: Anthony Liguori --- hw/e1000.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) Index: qemu-kvm-0.12.5/hw/e1000.c =================================================================== --- qemu-kvm-0.12.5.orig/hw/e1000.c +++ qemu-kvm-0.12.5/hw/e1000.c @@ -456,6 +456,7 @@ process_tx_desc(E1000State *s, struct e1 bytes = split_size; if (tp->size + bytes > msh) bytes = msh - tp->size; + bytes = MIN(sizeof(tp->data) - tp->size, bytes); cpu_physical_memory_read(addr, tp->data + tp->size, bytes); if ((sz = tp->size + bytes) >= hdr && tp->size < hdr) memmove(tp->header, tp->data, hdr); @@ -471,6 +472,7 @@ process_tx_desc(E1000State *s, struct e1 // context descriptor TSE is not set, while data descriptor TSE is set DBGOUT(TXERR, "TCP segmentaion Error\n"); } else { + split_size = MIN(sizeof(tp->data) - tp->size, split_size); cpu_physical_memory_read(addr, tp->data + tp->size, split_size); tp->size += split_size; } -- To unsubscribe, e-mail: opensuse-commit+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-commit+help@opensuse.org