From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LkhQb-0002Ug-Ur for qemu-devel@nongnu.org; Fri, 20 Mar 2009 12:18:37 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LkhQb-0002TW-1w for qemu-devel@nongnu.org; Fri, 20 Mar 2009 12:18:37 -0400 Received: from [199.232.76.173] (port=50774 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LkhQa-0002TH-T8 for qemu-devel@nongnu.org; Fri, 20 Mar 2009 12:18:36 -0400 Received: from savannah.gnu.org ([199.232.41.3]:39741 helo=sv.gnu.org) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LkhQa-0001sY-Nh for qemu-devel@nongnu.org; Fri, 20 Mar 2009 12:18:36 -0400 Received: from cvs.savannah.gnu.org ([199.232.41.69]) by sv.gnu.org with esmtp (Exim 4.69) (envelope-from ) id 1LkhQa-0007fq-5Y for qemu-devel@nongnu.org; Fri, 20 Mar 2009 16:18:36 +0000 Received: from aliguori by cvs.savannah.gnu.org with local (Exim 4.69) (envelope-from ) id 1LkhQZ-0007fm-Ph for qemu-devel@nongnu.org; Fri, 20 Mar 2009 16:18:36 +0000 MIME-Version: 1.0 Errors-To: aliguori Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Anthony Liguori Message-Id: Date: Fri, 20 Mar 2009 16:18:35 +0000 Subject: [Qemu-devel] [6866] x86: Add NULL check to lsl (Jan Kiszka) Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Revision: 6866 http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6866 Author: aliguori Date: 2009-03-20 16:18:35 +0000 (Fri, 20 Mar 2009) Log Message: ----------- x86: Add NULL check to lsl (Jan Kiszka) According to the Intel specs, lsl performs a check against NULL for the provided selector, just like lar does. helper_lar() includes the corresponding code, helper_lsl() was lacking it so far. Signed-off-by: Jan Kiszka Signed-off-by: Anthony Liguori Modified Paths: -------------- branches/stable_0_10_0/target-i386/op_helper.c Modified: branches/stable_0_10_0/target-i386/op_helper.c =================================================================== --- branches/stable_0_10_0/target-i386/op_helper.c 2009-03-20 16:13:50 UTC (rev 6865) +++ branches/stable_0_10_0/target-i386/op_helper.c 2009-03-20 16:18:35 UTC (rev 6866) @@ -3241,6 +3241,8 @@ selector = selector1 & 0xffff; eflags = helper_cc_compute_all(CC_OP); + if ((selector & 0xfffc) == 0) + goto fail; if (load_segment(&e1, &e2, selector) != 0) goto fail; rpl = selector & 3;