[Pkg-xen-changes] r539 - in trunk/xen-3/debian: . patches

[Bastian Blank]

Author: waldi
Date: Fri Mar  7 13:19:18 2008
New Revision: 539

Log:
* debian/changelog: Update.
* debian/patches/CVE-2008-0928: Add.
* debian/patches/series: Add new patch.


Added:
   trunk/xen-3/debian/patches/CVE-2008-0928
Modified:
   trunk/xen-3/debian/changelog
   trunk/xen-3/debian/patches/series

Modified: trunk/xen-3/debian/changelog
==============================================================================
--- trunk/xen-3/debian/changelog	(original)
+++ trunk/xen-3/debian/changelog	Fri Mar  7 13:19:18 2008
@@ -1,6 +1,8 @@
 xen-3 (3.2.0-4) UNRELEASED; urgency=low
 
   * Pull in newer xen-utils-common.
+  * Fix missing size checks in the ioemu block driver. (closes: #469654)
+    See: CVE-2008-0928
 
  -- Bastian Blank <waldi at debian.org>  Thu, 06 Mar 2008 20:46:15 +0100
 

Added: trunk/xen-3/debian/patches/CVE-2008-0928
==============================================================================
--- (empty file)
+++ trunk/xen-3/debian/patches/CVE-2008-0928	Fri Mar  7 13:19:18 2008
@@ -0,0 +1,114 @@
+diff -r 511ab2b89ced -r e3c722d483f5 tools/ioemu/block.c
+--- a/tools/ioemu/block.c	Wed Feb 20 17:42:12 2008 +0000
++++ b/tools/ioemu/block.c	Wed Feb 20 17:46:10 2008 +0000
+@@ -120,6 +120,24 @@ void path_combine(char *dest, int dest_s
+     }
+ }
+ 
++static int bdrv_rw_badreq_sectors(BlockDriverState *bs,
++				int64_t sector_num, int nb_sectors)
++{
++    return
++	nb_sectors < 0 ||
++	nb_sectors > bs->total_sectors ||
++	sector_num > bs->total_sectors - nb_sectors;
++}
++
++static int bdrv_rw_badreq_bytes(BlockDriverState *bs,
++				  int64_t offset, int count)
++{
++    int64_t size = bs->total_sectors << SECTOR_BITS;
++    return
++	count < 0 ||
++	count > size ||
++	offset > size - count;
++}
+ 
+ void bdrv_register(BlockDriver *bdrv)
+ {
+@@ -372,6 +390,7 @@ int bdrv_open2(BlockDriverState *bs, con
+     }
+     bs->drv = drv;
+     bs->opaque = qemu_mallocz(drv->instance_size);
++    bs->total_sectors = 0; /* driver will set if it does not do getlength */
+     if (bs->opaque == NULL && drv->instance_size > 0)
+         return -1;
+     /* Note: for compatibility, we open disk image files as RDWR, and
+@@ -437,6 +456,7 @@ void bdrv_close(BlockDriverState *bs)
+         bs->drv = NULL;
+ 
+         /* call the change callback */
++	bs->total_sectors = 0;
+         bs->media_changed = 1;
+         if (bs->change_cb)
+             bs->change_cb(bs->change_opaque);
+@@ -502,9 +522,8 @@ int bdrv_read(BlockDriverState *bs, int6
+     if (!drv)
+         return -ENOMEDIUM;
+ 
+-    if (sector_num < 0)
+-	return -EINVAL;
+-
++    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
++	return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+             memcpy(buf, bs->boot_sector_data, 512);
+         sector_num++;
+@@ -542,8 +561,8 @@ int bdrv_write(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (bs->read_only)
+         return -EACCES;
+-    if (sector_num < 0)
+-	return -EINVAL;
++    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
++	return -EDOM;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);   
+     }
+@@ -666,6 +685,8 @@ int bdrv_pread(BlockDriverState *bs, int
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pread)
+         return bdrv_pread_em(bs, offset, buf1, count1);
++    if (bdrv_rw_badreq_bytes(bs, offset, count1))
++	return -EDOM;
+     return drv->bdrv_pread(bs, offset, buf1, count1);
+ }
+ 
+@@ -681,6 +702,8 @@ int bdrv_pwrite(BlockDriverState *bs, in
+         return -ENOMEDIUM;
+     if (!drv->bdrv_pwrite)
+         return bdrv_pwrite_em(bs, offset, buf1, count1);
++    if (bdrv_rw_badreq_bytes(bs, offset, count1))
++	return -EDOM;
+     return drv->bdrv_pwrite(bs, offset, buf1, count1);
+ }
+ 
+@@ -922,6 +945,8 @@ int bdrv_write_compressed(BlockDriverSta
+         return -ENOMEDIUM;
+     if (!drv->bdrv_write_compressed)
+         return -ENOTSUP;
++    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
++	return -EDOM;
+     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
+ }
+     
+@@ -1067,7 +1092,9 @@ BlockDriverAIOCB *bdrv_aio_read(BlockDri
+ 
+     if (!drv)
+         return NULL;
+-    
++    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
++	return NULL;
++
+     /* XXX: we assume that nb_sectors == 0 is suppored by the async read */
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(buf, bs->boot_sector_data, 512);
+@@ -1089,6 +1116,8 @@ BlockDriverAIOCB *bdrv_aio_write(BlockDr
+         return NULL;
+     if (bs->read_only)
+         return NULL;
++    if (bdrv_rw_badreq_sectors(bs, sector_num, nb_sectors))
++	return NULL;
+     if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) {
+         memcpy(bs->boot_sector_data, buf, 512);   
+     }

Modified: trunk/xen-3/debian/patches/series
==============================================================================
--- trunk/xen-3/debian/patches/series	(original)
+++ trunk/xen-3/debian/patches/series	Fri Mar  7 13:19:18 2008
@@ -14,3 +14,4 @@
 disable-features.diff
 tools-misc-xend-race.diff
 doc-remove-unused.diff
+CVE-2008-0928