[Qemu-devel] [PATCH] FDC: Fix buffer overflow

[Qemu-devel] [PATCH] FDC: Fix buffer overflow

[Hervé Poussineau]

[-- Attachment #1: Type: text/plain, Size: 181 bytes --]

Hi,

In floppy controller, programming PIO writes which are more than one 
sector long leads to a buffer overflow of the fdtrl->fifo[] array.
Attached patch fixes it.

Hervé

[-- Attachment #2: fdc_pio_write.diff --]
[-- Type: text/plain, Size: 730 bytes --]

Index: hw/fdc.c
===================================================================
--- hw/fdc.c	(revision 4290)
+++ hw/fdc.c	(working copy)
@@ -1770,8 +1770,10 @@
     /* Is it write command time ? */
     if (fdctrl->msr & FD_MSR_NONDMA) {
         /* FIFO data write */
-        fdctrl->fifo[fdctrl->data_pos++] = value;
-        if (fdctrl->data_pos % FD_SECTOR_LEN == (FD_SECTOR_LEN - 1) ||
+        pos = fdctrl->data_pos++;
+        pos %= FD_SECTOR_LEN;
+        fdctrl->fifo[pos] = value;
+        if (pos == FD_SECTOR_LEN - 1 ||
             fdctrl->data_pos == fdctrl->data_len) {
             cur_drv = get_cur_drv(fdctrl);
             if (bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {