Changeset 12550 from xen-unstable. [QEMU] fdc: Limit sector size to 16K In fdctrl_start_transfer the sector size field (fifo[5]) is not checked for overflows. This allows an arbitrarily large sector size to be used, which can in turn result in a negative data_len field that is then used for DMA transfers. This can lead to the corrpuption of qemu state because some subsequent checks on the transfer length is conducted using signed integers. This patch limits the value fifo[5] to 7 which is the standard limit on floppy sector size. Signed-off-by: Herbert Xu <herbert.org.au>
QE ack for RHEL5.
A package has been built which should help the problem described in this bug report. This report is therefore being closed with a resolution of CURRENTRELEASE. You may reopen this bug report if the solution does not work for you.