From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58646) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bx9n3-0007VA-5E for qemu-devel@nongnu.org; Thu, 20 Oct 2016 05:37:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bx9n0-0002Zz-35 for qemu-devel@nongnu.org; Thu, 20 Oct 2016 05:37:33 -0400 Received: from mail-lf0-x241.google.com ([2a00:1450:4010:c07::241]:34868) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1bx9mz-0002Za-Qm for qemu-devel@nongnu.org; Thu, 20 Oct 2016 05:37:30 -0400 Received: by mail-lf0-x241.google.com with SMTP id x79so6661943lff.2 for ; Thu, 20 Oct 2016 02:37:29 -0700 (PDT) Date: Thu, 20 Oct 2016 10:37:26 +0100 From: Stefan Hajnoczi Message-ID: <20161020093726.GA7599@stefanha-x1.localdomain> References: <1476949224-6865-1-git-send-email-ppandit@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="nFreZHaLTZJo0R7j" Content-Disposition: inline In-Reply-To: <1476949224-6865-1-git-send-email-ppandit@redhat.com> Subject: Re: [Qemu-devel] [PATCH] audio: intel-hda: check stream entry count during transfer List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P Cc: Qemu Developers , Huawei PSIRT , Gerd Hoffmann , Prasad J Pandit --nFreZHaLTZJo0R7j Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Oct 20, 2016 at 01:10:24PM +0530, P J P wrote: > From: Prasad J Pandit >=20 > Intel HDA emulator uses stream of buffers during DMA data > transfers. Each entry has buffer length and buffer pointer > position, which are used to derive bytes to 'copy'. If this > length and buffer pointer were to be same, 'copy' could be > set to zero(0), leading to an infinite loop. Add check to > avoid it. >=20 > Reported-by: Huawei PSIRT > Signed-off-by: Prasad J Pandit > --- > hw/audio/intel-hda.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Reviewed-by: Stefan Hajnoczi --nFreZHaLTZJo0R7j Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEcBAEBAgAGBQJYCJBWAAoJEJykq7OBq3PIia0H/jktzlWXeEIeqLzHMC0XyYyL zcTCec7ubGSkV2+eTt/XkhwCeZcYCoQNL/tGhZK6xFwH+B/OQFtEK+g3Zldmap/8 g9tNDV+RDMyLLhB3v5lMK2zmBxMtvkYanDdJYOkpAHSZjHwke9rzp+NNZwZ7x3d0 C02m4CgQsScgl8KESixHfeKHYKRhueUYiC+y1VZCCsI7W0DX+sUaDaHq0p5RQe5s 6CkiYxkINsA0fYOcmvJfLLhOgxMAHmFEM2JVnflJ1rkUvePjho/P1tcjwseb2Tg8 fROPpK1DOYyuAqE/k5ljBDKarOSX2hxMidKjc/gPVQSR0UojXFQbn8LgdUyBt+0= =NFu/ -----END PGP SIGNATURE----- --nFreZHaLTZJo0R7j--