diff options
author | takeshi_hoshina <takeshi_hoshina@mail.toyota.co.jp> | 2020-11-02 11:07:33 +0900 |
---|---|---|
committer | takeshi_hoshina <takeshi_hoshina@mail.toyota.co.jp> | 2020-11-02 11:07:33 +0900 |
commit | 1c7d6584a7811b7785ae5c1e378f14b5ba0971cf (patch) | |
tree | cd70a267a5ef105ba32f200aa088e281fbd85747 /external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch | |
parent | 4204309872da5cb401cbb2729d9e2d4869a87f42 (diff) |
basesystem-jjsandbox/ToshikazuOhiwa/master-jj
recipes
Diffstat (limited to 'external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch')
-rw-r--r-- | external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch | 50 |
1 files changed, 0 insertions, 50 deletions
diff --git a/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch b/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch deleted file mode 100644 index 9fe13645..00000000 --- a/external/poky/meta/recipes-devtools/qemu/qemu/CVE-2018-18954.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 3c9fd43da473a324f6cc7a0d3db58f651a2d262c Mon Sep 17 00:00:00 2001 -From: Prasad J Pandit <pjp@fedoraproject.org> -Date: Fri, 26 Oct 2018 18:03:58 +0530 -Subject: [PATCH] ppc/pnv: check size before data buffer access -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -While performing PowerNV memory r/w operations, the access length -'sz' could exceed the data[4] buffer size. Add check to avoid OOB -access. - -Reported-by: Moguofang <moguofang@huawei.com> -Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> -Reviewed-by: Cédric Le Goater <clg@kaod.org> -Signed-off-by: David Gibson <david@gibson.dropbear.id.au> - -CVE: CVE-2018-18954 -Upstream-Status: Backport -[https://git.qemu.org/?p=qemu.git;a=commit;h=d07945e78eb6b593cd17a4640c1fc9eb35e3245d] - -Signed-off-by: Dan Tran <dantran@microsoft.com> ---- - hw/ppc/pnv_lpc.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/hw/ppc/pnv_lpc.c b/hw/ppc/pnv_lpc.c -index d7721320a2..172a915cfc 100644 ---- a/hw/ppc/pnv_lpc.c -+++ b/hw/ppc/pnv_lpc.c -@@ -155,9 +155,15 @@ static void pnv_lpc_do_eccb(PnvLpcController *lpc, uint64_t cmd) - /* XXX Check for magic bits at the top, addr size etc... */ - unsigned int sz = (cmd & ECCB_CTL_SZ_MASK) >> ECCB_CTL_SZ_LSH; - uint32_t opb_addr = cmd & ECCB_CTL_ADDR_MASK; -- uint8_t data[4]; -+ uint8_t data[8]; - bool success; - -+ if (sz > sizeof(data)) { -+ qemu_log_mask(LOG_GUEST_ERROR, -+ "ECCB: invalid operation at @0x%08x size %d\n", opb_addr, sz); -+ return; -+ } -+ - if (cmd & ECCB_CTL_READ) { - success = opb_read(lpc, opb_addr, data, sz); - if (success) { --- -2.22.0.vfs.1.1.57.gbaf16c8 - |