From mboxrd@z Thu Jan 1 00:00:00 1970 From: "=?utf-8?q?S=2E=C3=87a=C4=9Flar?= Onur" Subject: [PATCH] CVE-2007-1320 Date: Tue, 29 Jan 2008 02:06:07 +0200 Message-ID: <200801290206.08534.caglar@pardus.org.tr> Reply-To: caglar-caicS1wCkhO6A22drWdTBw@public.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Cc: security-caicS1wCkhO6A22drWdTBw@public.gmane.org To: kvm-devel Return-path: Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org SGk7CgpUaGlzIHBhdGNoIChyZWRpZmZlZCBhZ2Fpbmcga3ZtLTYwKSBmcm9tIFRhdmlzIE9ybWFu ZHkgPHRhdmlzb0Bnb29nbGUuY29tPiBmaXhlcyBDVkUtMjAwNy0xMzIwIFsxXQoKQWdhaW4sIEkn bSBub3Qgc3VyZSB3aHkgcWVtdSB1cHN0cmVhbSBub3QgbWVyZ2VkIHRoZXNlIGJ1dCBYZW4gYWxy ZWFkeSBkaWQgWzJdLgoKWzFdIGh0dHA6Ly9jdmUubWl0cmUub3JnL2NnaS1iaW4vY3ZlbmFtZS5j Z2k/bmFtZT1DVkUtMjAwNy0xMzIwClsyXSBodHRwOi8veGVuYml0cy54ZW5zb3VyY2UuY29tL3hl bi0zLjEtdGVzdGluZy5oZz9yZXYvOWU4NjI2MGI5NWE0CgpkaWZmIC11ciBrdm0tNjAub3JpZy9x ZW11L2h3L2NpcnJ1c192Z2EuYyBrdm0tNjAvcWVtdS9ody9jaXJydXNfdmdhLmMKLS0tIGt2bS02 MC5vcmlnL3FlbXUvaHcvY2lycnVzX3ZnYS5jCTIwMDgtMDEtMjAgMTQ6MzU6MDQuMDAwMDAwMDAw ICswMjAwCisrKyBrdm0tNjAvcWVtdS9ody9jaXJydXNfdmdhLmMJMjAwOC0wMS0yOSAwMTo0NTo0 OC4wMDAwMDAwMDAgKzAyMDAKQEAgLTIyMyw2ICsyMjMsMjAgQEAKICNkZWZpbmUgQ0lSUlVTX0hP T0tfTk9UX0hBTkRMRUQgMAogI2RlZmluZSBDSVJSVVNfSE9PS19IQU5ETEVEIDEKIAorI2RlZmlu ZSBCTFRVTlNBRkUocykgXAorICAgICggXAorICAgICAgICAoIC8qIGNoZWNrIGRzdCBpcyB3aXRo aW4gYm91bmRzICovIFwKKyAgICAgICAgICAgIChzKS0+Y2lycnVzX2JsdF9oZWlnaHQgKiAocykt PmNpcnJ1c19ibHRfZHN0cGl0Y2ggXAorICAgICAgICAgICAgICAgICsgKChzKS0+Y2lycnVzX2Js dF9kc3RhZGRyICYgKHMpLT5jaXJydXNfYWRkcl9tYXNrKSA+IFwKKyAgICAgICAgICAgICAgICAg ICAgKHMpLT52cmFtX3NpemUgXAorICAgICAgICApIHx8IFwKKyAgICAgICAgKCAvKiBjaGVjayBz cmMgaXMgd2l0aGluIGJvdW5kcyAqLyBcCisgICAgICAgICAgICAocyktPmNpcnJ1c19ibHRfaGVp Z2h0ICogKHMpLT5jaXJydXNfYmx0X3NyY3BpdGNoIFwKKyAgICAgICAgICAgICAgICArICgocykt PmNpcnJ1c19ibHRfc3JjYWRkciAmIChzKS0+Y2lycnVzX2FkZHJfbWFzaykgPiBcCisgICAgICAg ICAgICAgICAgICAgIChzKS0+dnJhbV9zaXplIFwKKyAgICAgICAgKSBcCisgICAgKQorCiBzdHJ1 Y3QgQ2lycnVzVkdBU3RhdGU7CiB0eXBlZGVmIHZvaWQgKCpjaXJydXNfYml0Ymx0X3JvcF90KSAo c3RydWN0IENpcnJ1c1ZHQVN0YXRlICpzLAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHVpbnQ4X3QgKiBkc3QsIGNvbnN0IHVpbnQ4X3QgKiBzcmMsCkBAIC02NDksNyArNjYz LDcgQEAKIAogICAgIGZvciAoeSA9IDA7IHkgPCBsaW5lczsgeSsrKSB7CiAJb2ZmX2N1ciA9IG9m Zl9iZWdpbjsKLQlvZmZfY3VyX2VuZCA9IG9mZl9jdXIgKyBieXRlc3BlcmxpbmU7CisJb2ZmX2N1 cl9lbmQgPSAob2ZmX2N1ciArIGJ5dGVzcGVybGluZSkgJiBzLT5jaXJydXNfYWRkcl9tYXNrOwog CW9mZl9jdXIgJj0gVEFSR0VUX1BBR0VfTUFTSzsKIAl3aGlsZSAob2ZmX2N1ciA8IG9mZl9jdXJf ZW5kKSB7CiAJICAgIGNwdV9waHlzaWNhbF9tZW1vcnlfc2V0X2RpcnR5KHMtPnZyYW1fb2Zmc2V0 ICsgb2ZmX2N1cik7CkBAIC02NjQsNyArNjc4LDExIEBACiB7CiAgICAgdWludDhfdCAqZHN0Owog Ci0gICAgZHN0ID0gcy0+dnJhbV9wdHIgKyBzLT5jaXJydXNfYmx0X2RzdGFkZHI7CisgICAgZHN0 ID0gcy0+dnJhbV9wdHIgKyAocy0+Y2lycnVzX2JsdF9kc3RhZGRyICYgcy0+Y2lycnVzX2FkZHJf bWFzayk7CisKKyAgICBpZiAoQkxUVU5TQUZFKHMpKQorICAgICAgICByZXR1cm4gMDsKKwogICAg ICgqcy0+Y2lycnVzX3JvcCkgKHMsIGRzdCwgc3JjLAogICAgICAgICAgICAgICAgICAgICAgIHMt PmNpcnJ1c19ibHRfZHN0cGl0Y2gsIDAsCiAgICAgICAgICAgICAgICAgICAgICAgcy0+Y2lycnVz X2JsdF93aWR0aCwgcy0+Y2lycnVzX2JsdF9oZWlnaHQpOwpAQCAtNjgwLDggKzY5OCwxMCBAQAog ewogICAgIGNpcnJ1c19maWxsX3Qgcm9wX2Z1bmM7CiAKKyAgICBpZiAoQkxUVU5TQUZFKHMpKQor ICAgICAgICByZXR1cm4gMDsKICAgICByb3BfZnVuYyA9IGNpcnJ1c19maWxsW3JvcF90b19pbmRl eFtibHRfcm9wXV1bcy0+Y2lycnVzX2JsdF9waXhlbHdpZHRoIC0gMV07Ci0gICAgcm9wX2Z1bmMo cywgcy0+dnJhbV9wdHIgKyBzLT5jaXJydXNfYmx0X2RzdGFkZHIsCisgICAgcm9wX2Z1bmMocywg cy0+dnJhbV9wdHIgKyAocy0+Y2lycnVzX2JsdF9kc3RhZGRyICYgcy0+Y2lycnVzX2FkZHJfbWFz ayksIAogICAgICAgICAgICAgIHMtPmNpcnJ1c19ibHRfZHN0cGl0Y2gsCiAgICAgICAgICAgICAg cy0+Y2lycnVzX2JsdF93aWR0aCwgcy0+Y2lycnVzX2JsdF9oZWlnaHQpOwogICAgIGNpcnJ1c19p bnZhbGlkYXRlX3JlZ2lvbihzLCBzLT5jaXJydXNfYmx0X2RzdGFkZHIsCkBAIC03MDAsOCArNzIw LDggQEAKIHN0YXRpYyBpbnQgY2lycnVzX2JpdGJsdF92aWRlb3RvdmlkZW9fcGF0dGVybmNvcHko Q2lycnVzVkdBU3RhdGUgKiBzKQogewogICAgIHJldHVybiBjaXJydXNfYml0Ymx0X2NvbW1vbl9w YXR0ZXJuY29weShzLAotCQkJCQkgICAgcy0+dnJhbV9wdHIgKwotICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAocy0+Y2lycnVzX2JsdF9zcmNhZGRyICYgfjcpKTsK KwkJCQkJICAgIHMtPnZyYW1fcHRyICsgKChzLT5jaXJydXNfYmx0X3NyY2FkZHIgJiB+NykgJgor ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBzLT5jaXJydXNfYWRk cl9tYXNrKSk7CiB9CiAKIHN0YXRpYyB2b2lkIGNpcnJ1c19kb19jb3B5KENpcnJ1c1ZHQVN0YXRl ICpzLCBpbnQgZHN0LCBpbnQgc3JjLCBpbnQgdywgaW50IGgpCkBAIC03NTEsOCArNzcxLDEwIEBA CiAgICAgaWYgKG5vdGlmeSkKIAl2Z2FfaHdfdXBkYXRlKCk7CiAKLSAgICAoKnMtPmNpcnJ1c19y b3ApIChzLCBzLT52cmFtX3B0ciArIHMtPmNpcnJ1c19ibHRfZHN0YWRkciwKLQkJICAgICAgcy0+ dnJhbV9wdHIgKyBzLT5jaXJydXNfYmx0X3NyY2FkZHIsCisgICAgKCpzLT5jaXJydXNfcm9wKSAo cywgcy0+dnJhbV9wdHIgKworCQkgICAgICAocy0+Y2lycnVzX2JsdF9kc3RhZGRyICYgcy0+Y2ly cnVzX2FkZHJfbWFzayksCisJCSAgICAgIHMtPnZyYW1fcHRyICsKKwkJICAgICAgKHMtPmNpcnJ1 c19ibHRfc3JjYWRkciAmIHMtPmNpcnJ1c19hZGRyX21hc2spLAogCQkgICAgICBzLT5jaXJydXNf Ymx0X2RzdHBpdGNoLCBzLT5jaXJydXNfYmx0X3NyY3BpdGNoLAogCQkgICAgICBzLT5jaXJydXNf Ymx0X3dpZHRoLCBzLT5jaXJydXNfYmx0X2hlaWdodCk7CiAKQEAgLTc3OCw4ICs4MDAsMTQgQEAK IAkJICAgICAgIHMtPmNpcnJ1c19ibHRfc3JjYWRkciAtIHMtPnN0YXJ0X2FkZHIsCiAJCSAgICAg ICBzLT5jaXJydXNfYmx0X3dpZHRoLCBzLT5jaXJydXNfYmx0X2hlaWdodCk7CiAgICAgfSBlbHNl IHsKLQkoKnMtPmNpcnJ1c19yb3ApIChzLCBzLT52cmFtX3B0ciArIHMtPmNpcnJ1c19ibHRfZHN0 YWRkciwKLQkJCSAgcy0+dnJhbV9wdHIgKyBzLT5jaXJydXNfYmx0X3NyY2FkZHIsCisKKyAgICBp ZiAoQkxUVU5TQUZFKHMpKQorICAgICAgICByZXR1cm4gMDsKKworCSgqcy0+Y2lycnVzX3JvcCkg KHMsIHMtPnZyYW1fcHRyICsKKyAgICAgICAgICAgICAgICAocy0+Y2lycnVzX2JsdF9kc3RhZGRy ICYgcy0+Y2lycnVzX2FkZHJfbWFzayksCisJCQkgIHMtPnZyYW1fcHRyICsKKyAgICAgICAgICAg ICAgICAocy0+Y2lycnVzX2JsdF9zcmNhZGRyICYgcy0+Y2lycnVzX2FkZHJfbWFzayksCiAJCQkg IHMtPmNpcnJ1c19ibHRfZHN0cGl0Y2gsIHMtPmNpcnJ1c19ibHRfc3JjcGl0Y2gsCiAJCQkgIHMt PmNpcnJ1c19ibHRfd2lkdGgsIHMtPmNpcnJ1c19ibHRfaGVpZ2h0KTsKIApAQCAtODExLDggKzgz OSw5IEBACiAgICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICAvKiBhdCBsZWFzdCBvbmUgc2Nh biBsaW5lICovCiAgICAgICAgICAgICBkbyB7Ci0gICAgICAgICAgICAgICAgKCpzLT5jaXJydXNf cm9wKShzLCBzLT52cmFtX3B0ciArIHMtPmNpcnJ1c19ibHRfZHN0YWRkciwKLSAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHMtPmNpcnJ1c19ibHRidWYsIDAsIDAsIHMtPmNpcnJ1c19i bHRfd2lkdGgsIDEpOworICAgICAgICAgICAgICAgICgqcy0+Y2lycnVzX3JvcCkocywgcy0+dnJh bV9wdHIgKworICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKHMtPmNpcnJ1c19ibHRf ZHN0YWRkciAmIHMtPmNpcnJ1c19hZGRyX21hc2spLAorICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHMtPmNpcnJ1c19ibHRidWYsIDAsIDAsIHMtPmNpcnJ1c19ibHRfd2lkdGgsIDEp OwogICAgICAgICAgICAgICAgIGNpcnJ1c19pbnZhbGlkYXRlX3JlZ2lvbihzLCBzLT5jaXJydXNf Ymx0X2RzdGFkZHIsIDAsCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHMtPmNpcnJ1c19ibHRfd2lkdGgsIDEpOwogICAgICAgICAgICAgICAgIHMtPmNpcnJ1c19ibHRf ZHN0YWRkciArPSBzLT5jaXJydXNfYmx0X2RzdHBpdGNoOwpAQCAtMTkzMyw3ICsxOTYyLDcgQEAK ICAgICB1bnNpZ25lZCB2YWwgPSBtZW1fdmFsdWU7CiAgICAgdWludDhfdCAqZHN0OwogCi0gICAg ZHN0ID0gcy0+dnJhbV9wdHIgKyBvZmZzZXQ7CisgICAgZHN0ID0gcy0+dnJhbV9wdHIgKyAob2Zm c2V0ICY9IHMtPmNpcnJ1c19hZGRyX21hc2spOwogICAgIGZvciAoeCA9IDA7IHggPCA4OyB4Kysp IHsKIAlpZiAodmFsICYgMHg4MCkgewogCSAgICAqZHN0ID0gcy0+Y2lycnVzX3NoYWRvd19ncjE7 CkBAIC0xOTU2LDcgKzE5ODUsNyBAQAogICAgIHVuc2lnbmVkIHZhbCA9IG1lbV92YWx1ZTsKICAg ICB1aW50OF90ICpkc3Q7CiAKLSAgICBkc3QgPSBzLT52cmFtX3B0ciArIG9mZnNldDsKKyAgICBk c3QgPSBzLT52cmFtX3B0ciArIChvZmZzZXQgJj0gcy0+Y2lycnVzX2FkZHJfbWFzayk7CiAgICAg Zm9yICh4ID0gMDsgeCA8IDg7IHgrKykgewogCWlmICh2YWwgJiAweDgwKSB7CiAJICAgICpkc3Qg PSBzLT5jaXJydXNfc2hhZG93X2dyMTsKWWFsbsSxemNhIGt2bS02MC9xZW11L2h3J2RhOiBjaXJy dXNfdmdhLmMub3JpZwpkaWZmIC11ciBrdm0tNjAub3JpZy9xZW11L2h3L2NpcnJ1c192Z2Ffcm9w Lmgga3ZtLTYwL3FlbXUvaHcvY2lycnVzX3ZnYV9yb3AuaAotLS0ga3ZtLTYwLm9yaWcvcWVtdS9o dy9jaXJydXNfdmdhX3JvcC5oCTIwMDgtMDEtMjAgMTQ6MzU6MDQuMDAwMDAwMDAwICswMjAwCisr KyBrdm0tNjAvcWVtdS9ody9jaXJydXNfdmdhX3JvcC5oCTIwMDgtMDEtMjkgMDE6NDU6NDguMDAw MDAwMDAwICswMjAwCkBAIC0zMSw2ICszMSwxMiBAQAogICAgIGludCB4LHk7CiAgICAgZHN0cGl0 Y2ggLT0gYmx0d2lkdGg7CiAgICAgc3JjcGl0Y2ggLT0gYmx0d2lkdGg7CisKKyAgICBpZiAoZHN0 cGl0Y2ggPCAwIHx8IHNyY3BpdGNoIDwgMCkgeworICAgICAgICAvKiBpcyAwIHZhbGlkPyBzcmNw aXRjaCA9PSAwIGNvdWxkIGJlIHVzZWZ1bCAqLworICAgICAgICByZXR1cm47CisgICAgfQorCiAg ICAgZm9yICh5ID0gMDsgeSA8IGJsdGhlaWdodDsgeSsrKSB7CiAgICAgICAgIGZvciAoeCA9IDA7 IHggPCBibHR3aWR0aDsgeCsrKSB7CiAgICAgICAgICAgICBST1BfT1AoKmRzdCwgKnNyYyk7CgoK Q2hlZXJzCi0tIApTLsOHYcSfbGFyIE9udXIgPGNhZ2xhckBwYXJkdXMub3JnLnRyPgpodHRwOi8v Y2VraXJkZWsucGFyZHVzLm9yZy50ci9+Y2FnbGFyLwoKTGludXggaXMgbGlrZSBsaXZpbmcgaW4g YSB0ZWVwZWUuIE5vIFdpbmRvd3MsIG5vIEdhdGVzIGFuZCBhbiBBcGFjaGUgaW4gaG91c2UhCgot LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tClRoaXMgU0YubmV0IGVtYWlsIGlzIHNwb25zb3JlZCBieTogTWljcm9z b2Z0CkRlZnkgYWxsIGNoYWxsZW5nZXMuIE1pY3Jvc29mdChSKSBWaXN1YWwgU3R1ZGlvIDIwMDgu Cmh0dHA6Ly9jbGsuYXRkbXQuY29tL01SVC9nby92c2UwMTIwMDAwMDcwbXJ0L2RpcmVjdC8wMS8K X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Ka3ZtLWRldmVs IG1haWxpbmcgbGlzdAprdm0tZGV2ZWxAbGlzdHMuc291cmNlZm9yZ2UubmV0Cmh0dHBzOi8vbGlz dHMuc291cmNlZm9yZ2UubmV0L2xpc3RzL2xpc3RpbmZvL2t2bS1kZXZlbAo=