From 018bb538f4dd1dd45d5ccd574b6aefdfe11d6b56 Mon Sep 17 00:00:00 2001 From: Mark McLoughlin Date: Nov 20 2009 18:28:20 +0000 Subject: - Fix a use-after-free crasher in the slirp code (#539583) - Fix overflow in the parallels image format support (#533573) --- diff --git a/qemu-parallels-image-format-overflow.patch b/qemu-parallels-image-format-overflow.patch new file mode 100644 index 0000000..dc3283a --- /dev/null +++ b/qemu-parallels-image-format-overflow.patch @@ -0,0 +1,41 @@ +From ff1a1e986f2e167c2538160d0476ac61cda31f77 Mon Sep 17 00:00:00 2001 +From: David Woodhouse +Date: Sat, 7 Nov 2009 14:10:01 +0000 +Subject: [PATCH] Fix 32-bit overflow in parallels image support + +(cherry picked from commit c34d2451ed32651e14e309f94009be07d231ee96) + +Signed-off-by: David Woodhouse +Signed-off-by: Anthony Liguori +Signed-off-by: Mark McLoughlin +Fedora-patch: qemu-parallels-image-format-overflow.patch +--- + block/parallels.c | 5 +++-- + 1 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/block/parallels.c b/block/parallels.c +index 0b64a5c..63b6738 100644 +--- a/block/parallels.c ++++ b/block/parallels.c +@@ -119,7 +119,8 @@ fail: + static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num) + { + BDRVParallelsState *s = bs->opaque; +- uint32_t index, offset, position; ++ uint32_t index, offset; ++ uint64_t position; + + index = sector_num / s->tracks; + offset = sector_num % s->tracks; +@@ -128,7 +129,7 @@ static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num) + if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0)) + return -1; + +- position = (s->catalog_bitmap[index] + offset) * 512; ++ position = (uint64_t)(s->catalog_bitmap[index] + offset) * 512; + + // fprintf(stderr, "sector: %llx index=%x offset=%x pointer=%x position=%x\n", + // sector_num, index, offset, s->catalog_bitmap[index], position); +-- +1.6.2.5 + diff --git a/qemu-slirp-use-after-free.patch b/qemu-slirp-use-after-free.patch new file mode 100644 index 0000000..4e1d527 --- /dev/null +++ b/qemu-slirp-use-after-free.patch @@ -0,0 +1,31 @@ +From 56d370091cb01878c580f528011cd1717f8077fa Mon Sep 17 00:00:00 2001 +From: Mark McLoughlin +Date: Fri, 20 Nov 2009 18:07:15 +0000 +Subject: [PATCH] slirp: fix use-after-free + +460fec67ee introduced a use-after free in slirp. + +Cc: Jan Kiszka +Signed-off-by: Mark McLoughlin +Fedora-patch: qemu-slirp-use-after-free.patch +--- + slirp/mbuf.c | 2 +- + 1 files changed, 1 insertions(+), 1 deletions(-) + +diff --git a/slirp/mbuf.c b/slirp/mbuf.c +index 7652fea..87508ba 100644 +--- a/slirp/mbuf.c ++++ b/slirp/mbuf.c +@@ -95,8 +95,8 @@ m_free(struct mbuf *m) + * Either free() it or put it on the free list + */ + if (m->m_flags & M_DOFREE) { +- free(m); + m->slirp->mbuf_alloced--; ++ free(m); + } else if ((m->m_flags & M_FREELIST) == 0) { + insque(m,&m->slirp->m_freelist); + m->m_flags = M_FREELIST; /* Clobber other flags */ +-- +1.6.2.5 + diff --git a/qemu.spec b/qemu.spec index 6878fc5..c9cd57f 100644 --- a/qemu.spec +++ b/qemu.spec @@ -1,7 +1,7 @@ Summary: QEMU is a FAST! processor emulator Name: qemu Version: 0.11.0 -Release: 11%{?dist} +Release: 12%{?dist} # Epoch because we pushed a qemu-1.0 package Epoch: 2 License: GPLv2+ and LGPLv2+ and BSD @@ -61,6 +61,12 @@ Patch12: qemu-fix-dropped-packets-with-non-virtio-nics.patch # Temporarily disable preadv/pwritev support (#526549) Patch13: qemu-disable-preadv-support.patch +# Fix a use-after-free crasher in the slirp code (#539583) +Patch14: qemu-slirp-use-after-free.patch + +# Fix overflow in the parallels image format support (#533573) +Patch15: qemu-parallels-image-format-overflow.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel BuildRequires: rsync dev86 iasl @@ -261,6 +267,8 @@ such as kvmtrace and kvm_stat. %patch11 -p1 %patch12 -p1 %patch13 -p1 +%patch14 -p1 +%patch15 -p1 %build # --build-id option is used fedora 8 onwards for giving info to the debug packages. @@ -542,6 +550,10 @@ fi %{_mandir}/man1/qemu-img.1* %changelog +* Fri Nov 20 2009 Mark McLoughlin - 2:0.11.0-12 +- Fix a use-after-free crasher in the slirp code (#539583) +- Fix overflow in the parallels image format support (#533573) + * Wed Nov 4 2009 Mark McLoughlin - 2:0.11.0-11 - Temporarily disable preadv/pwritev support to fix data corruption (#526549)