From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1JJZgC-0002tZ-07 for qemu-devel@nongnu.org; Mon, 28 Jan 2008 14:30:04 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1JJZgB-0002tF-H5 for qemu-devel@nongnu.org; Mon, 28 Jan 2008 14:30:03 -0500 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1JJZgB-0002tA-7z for qemu-devel@nongnu.org; Mon, 28 Jan 2008 14:30:03 -0500 Received: from hall.aurel32.net ([88.191.38.19]) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1JJZgA-00058M-U5 for qemu-devel@nongnu.org; Mon, 28 Jan 2008 14:30:03 -0500 Received: from volta.aurel32.net ([2002:52e8:2fb:1:216:d3ff:fe17:fd00]) by hall.aurel32.net with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1JJZg9-0001L5-Io for qemu-devel@nongnu.org; Mon, 28 Jan 2008 20:30:01 +0100 Received: from aurel32 by volta.aurel32.net with local (Exim 4.68) (envelope-from ) id 1JJZgH-00052M-7g for qemu-devel@nongnu.org; Mon, 28 Jan 2008 20:30:09 +0100 Date: Mon, 28 Jan 2008 20:30:09 +0100 From: Aurelien Jarno Message-ID: <20080128193009.GA19255@volta.aurel32.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Disposition: inline Subject: [Qemu-devel] [PATCH] Fix an infinite loop in the emulated SB16 device Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org This patch from Tavis Ormandy fixes an infinite loop in the emulated SB16 device. See http://taviso.decsystem.org/virtsec.pdf for more details. --- hw/sb16.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/hw/sb16.c b/hw/sb16.c index c22de7a..b2a3a70 100644 --- a/hw/sb16.c +++ b/hw/sb16.c @@ -1246,8 +1246,10 @@ static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len) s->block_size); #endif - while (s->left_till_irq <= 0) { - s->left_till_irq = s->block_size + s->left_till_irq; + if (s->block_size) { + while (s->left_till_irq <= 0) { + s->left_till_irq = s->block_size + s->left_till_irq; + } } return dma_pos; -- .''`. Aurelien Jarno | GPG: 1024D/F1BCDB73 : :' : Debian developer | Electrical Engineer `. `' aurel32@debian.org | aurelien@aurel32.net `- people.debian.org/~aurel32 | www.aurel32.net