1 From 8cb8ea32396f52e01cdb38c00b5b7f5a0141f97f Mon Sep 17 00:00:00 2001
2 From: Petr Matousek <pmatouse@redhat.com>
3 Date: Wed, 6 May 2015 09:48:59 +0200
4 Subject: [PATCH] fdc: force the fifo access to be in bounds of the allocated
7 During processing of certain commands such as FD_CMD_READ_ID and
8 FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
9 get out of bounds leading to memory corruption with values coming
12 Fix this by making sure that the index is always bounded by the
15 This is CVE-2015-3456.
17 Signed-off-by: Petr Matousek <pmatouse@redhat.com>
18 Reviewed-by: John Snow <jsnow@redhat.com>
19 Signed-off-by: John Snow <jsnow@redhat.com>
20 (cherry picked from commit e907746266721f305d67bc0718795fedee2e824c)
21 Signed-off-by: Stefan Priebe <s.priebe@profihost.ag>
23 hw/block/fdc.c | 17 +++++++++++------
24 1 file changed, 11 insertions(+), 6 deletions(-)
26 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
27 index 739a03e..1168e8c 100644
30 @@ -1512,7 +1512,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
37 cur_drv = get_cur_drv(fdctrl);
38 fdctrl->dsr &= ~FD_DSR_PWRDOWN;
39 @@ -1521,8 +1521,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
42 pos = fdctrl->data_pos;
43 + pos %= FD_SECTOR_LEN;
44 if (fdctrl->msr & FD_MSR_NONDMA) {
45 - pos %= FD_SECTOR_LEN;
47 if (fdctrl->data_pos != 0)
48 if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
49 @@ -1867,10 +1867,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int direction)
50 static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
52 FDrive *cur_drv = get_cur_drv(fdctrl);
55 - if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
56 + pos = fdctrl->data_pos - 1;
57 + pos %= FD_SECTOR_LEN;
58 + if (fdctrl->fifo[pos] & 0x80) {
59 /* Command parameters done */
60 - if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
61 + if (fdctrl->fifo[pos] & 0x40) {
62 fdctrl->fifo[0] = fdctrl->fifo[1];
65 @@ -1970,7 +1973,7 @@ static uint8_t command_to_handler[256];
66 static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
73 if (!(fdctrl->dor & FD_DOR_nRESET)) {
74 @@ -2019,7 +2022,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
77 FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
78 - fdctrl->fifo[fdctrl->data_pos++] = value;
79 + pos = fdctrl->data_pos++;
80 + pos %= FD_SECTOR_LEN;
81 + fdctrl->fifo[pos] = value;
82 if (fdctrl->data_pos == fdctrl->data_len) {
83 /* We now have all parameters
84 * and will be able to treat the command