diff options
Diffstat (limited to 'meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch')
| -rw-r--r-- | meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch b/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch new file mode 100644 index 0000000000..bd3566e282 --- /dev/null +++ b/meta/recipes-devtools/qemu/files/ide-CVE-2014-2894.patch @@ -0,0 +1,46 @@ +From c5dae2f4c50ef848f224da718154af4438862cdb Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Beno=C3=AEt=20Canet?= <benoit.canet@irqsave.net> +Date: Sat, 12 Apr 2014 22:59:50 +0200 +Subject: [PATCH] ide: Correct improper smart self test counter reset in ide + core. + +The SMART self test counter was incorrectly being reset to zero, +not 1. This had the effect that on every 21st SMART EXECUTE OFFLINE: + * We would write off the beginning of a dynamically allocated buffer + * We forgot the SMART history +Fix this. + +Signed-off-by: Benoit Canet <benoit@irqsave.net> +Message-id: 1397336390-24664-1-git-send-email-benoit.canet@irqsave.net +Reviewed-by: Markus Armbruster <armbru@redhat.com> +Cc: qemu-stable@nongnu.org +Acked-by: Kevin Wolf <kwolf@redhat.com> +[PMM: tweaked commit message as per suggestions from Markus] +Signed-off-by: Peter Maydell <peter.maydell@linaro.org> + +Fixes CVE-2014-2894 +Upstream-Status: Backport + +(cherry picked from commit 940973ae0b45c9b6817bab8e4cf4df99a9ef83d7) +Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> +Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> +--- + hw/ide/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/ide/core.c b/hw/ide/core.c +index e1f4c33..6007f6f 100644 +--- a/hw/ide/core.c ++++ b/hw/ide/core.c +@@ -1601,7 +1601,7 @@ static bool cmd_smart(IDEState *s, uint8_t cmd) + case 2: /* extended self test */ + s->smart_selftest_count++; + if (s->smart_selftest_count > 21) { +- s->smart_selftest_count = 0; ++ s->smart_selftest_count = 1; + } + n = 2 + (s->smart_selftest_count - 1) * 24; + s->smart_selftest_data[n] = s->sector; +-- +1.9.1 + |