From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50085) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bx7xx-00044X-8j for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bx7xu-0007B9-2C for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:41 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41024) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1bx7xt-0007Ar-Ms for qemu-devel@nongnu.org; Thu, 20 Oct 2016 03:40:37 -0400 From: P J P Date: Thu, 20 Oct 2016 13:10:24 +0530 Message-Id: <1476949224-6865-1-git-send-email-ppandit@redhat.com> Subject: [Qemu-devel] [PATCH] audio: intel-hda: check stream entry count during transfer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Qemu Developers Cc: Gerd Hoffmann , Huawei PSIRT , Prasad J Pandit From: Prasad J Pandit Intel HDA emulator uses stream of buffers during DMA data transfers. Each entry has buffer length and buffer pointer position, which are used to derive bytes to 'copy'. If this length and buffer pointer were to be same, 'copy' could be set to zero(0), leading to an infinite loop. Add check to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit --- hw/audio/intel-hda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340..537face 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib; -- 2.7.4