Red Hat Bugzilla – Bug 218002
fdc: Limit sector size to 16K
Last modified: 2007-11-30 17:07:38 EST
Changeset 12550 from xen-unstable.
[QEMU] fdc: Limit sector size to 16K
In fdctrl_start_transfer the sector size field (fifo) is not checked
for overflows. This allows an arbitrarily large sector size to be used,
which can in turn result in a negative data_len field that is then used
for DMA transfers.
This can lead to the corrpuption of qemu state because some subsequent
checks on the transfer length is conducted using signed integers.
This patch limits the value fifo to 7 which is the standard limit
on floppy sector size.
Signed-off-by: Herbert Xu <email@example.com>
QE ack for RHEL5.
A package has been built which should help the problem described in
this bug report. This report is therefore being closed with a resolution
of CURRENTRELEASE. You may reopen this bug report if the solution does
not work for you.