falso
/
qemu-irix
mirror of https://github.com/n64decomp/qemu-irix.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
adding Irix (and, to a lesser extent, Solaris) userland emulation to QEMU
40,528 Commits 28 Branches 227 Tags 202 MiB
C 91.8%
Dylan 2.4%
Python 1.9%
Shell 1.3%
C++ 1%
Other 1.5%
Go to file
Gerd Hoffmann eb8934b041 vnc: fix memory corruption (CVE-2015-5225) 
The _cmp_bytes variable added by commit "bea60dd ui/vnc: fix potential
memory corruption issues" can become negative.  Result is (possibly
exploitable) memory corruption.  Reason for that is it uses the stride
instead of bytes per scanline to apply limits.

For the server surface is is actually fine.  vnc creates that itself,
there is never any padding and thus scanline length always equals stride.

For the guest surface scanline length and stride are typically identical
too, but it doesn't has to be that way.  So add and use a new variable
(guest_ll) for the guest scanline length.  Also rename min_stride to
line_bytes to make more clear what it actually is.  Finally sprinkle
in an assert() to make sure we never use a negative _cmp_bytes again.

Reported-by: 范祚至(库特) <zuozhi.fzz@alibaba-inc.com>
Reviewed-by: P J P <ppandit@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
 		2015-08-26 17:54:33 +02:00
audio ossaudio: fix memory leak 2015-07-08 13:11:01 +02:00
backends hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init() 2015-07-22 15:09:25 -03:00
block mirror: Fix coroutine reentrance 2015-08-14 09:51:31 -04:00
bsd-user linux-user: remove --enable-guest-base/--disable-guest-base 2015-08-24 11:14:17 -07:00
crypto crypto: fix built-in AES decrypt function 2015-07-27 12:22:01 +02:00
default-configs smbios: move smbios code into a common folder 2015-08-13 14:08:30 +03:00
disas disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR 2015-07-21 11:18:45 +01:00
docs AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
dtc@65cc4d2748 dtc: Update dtc / libfdt submodule to version 1.4.0 2015-06-03 23:56:49 +02:00
fpu target-s390x: define default NaN values 2015-06-05 01:37:58 +02:00
fsdev virtfs-proxy-helper: fail gracefully if socket path is too long 2015-06-16 20:32:29 +05:30
gdb-xml gdb-xml: Include XML for s390 vector registers 2015-05-27 17:52:03 +02:00
hw xlnx-zynqmp: Connect the four OCM banks 2015-08-25 15:45:06 +01:00
include cputlb: Add functions for flushing TLB for a single MMU index 2015-08-25 16:18:33 +01:00
libcacard libcacard: pkgconfig: tidy dependent libs 2015-06-23 19:57:28 +03:00
libdecnumber remove libdecnumber/dpd/decimal128Local.h 2015-06-23 19:57:27 +03:00
linux-headers linux-headers: Update to 4.2-rc1 2015-07-06 17:59:01 +02:00
linux-user linux-user: remove useless macros GUEST_BASE and RESERVED_VA 2015-08-24 11:14:30 -07:00
migration migration: Fix global state with Xen. 2015-08-03 16:13:23 +00:00
net net: Flush queued packets when guest resumes 2015-07-20 18:11:24 +01:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
pixman@87eea99e44
…
po
…
qapi qapi/qmp-event.c: Don't manually include os-win32.h/os-posix.h 2015-08-19 16:29:53 +01:00
qga qga: fixed versions for guest bus types in qapi-schema 2015-07-21 14:36:06 -05:00
qobject Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qom exec: drop cpu_can_do_io, just read cpu->can_do_io 2015-08-14 23:40:32 +02:00
roms pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
scripts virtio-input: move sys/ioctl.h include 2015-07-16 17:34:41 +02:00
slirp qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
stubs main-loop: introduce qemu_mutex_iothread_locked 2015-07-01 15:45:50 +02:00
target-alpha tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-arm target-arm: Implement AArch64 TLBI operations on IPAs 2015-08-25 16:18:33 +01:00
target-cris tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-i386 target-i386: Remove x86_cpu_compat_set_features() 2015-08-13 14:08:25 +03:00
target-lm32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-m68k tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-microblaze tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-mips tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-moxie cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-openrisc tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-ppc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-s390x tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-sh4 tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-sparc tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-tricore tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
target-unicore32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-xtensa tcg: Remove tcg_gen_trunc_i64_i32 2015-08-24 11:10:54 -07:00
tcg linux-user: remove useless macros GUEST_BASE and RESERVED_VA 2015-08-24 11:14:30 -07:00
tests * SCSI fixes from Stefan and Fam 2015-08-18 17:06:41 +01:00
trace
…
ui vnc: fix memory corruption (CVE-2015-5225) 2015-08-26 17:54:33 +02:00
util * SCSI fixes from Stefan and Fam 2015-08-18 17:06:41 +01:00
.exrc
…
.gitignore gitignore: Ignore shader generated files 2015-07-27 22:44:47 +03:00
.gitmodules
…
.mailmap
…
.travis.yml
…
CODING_STYLE
…
COPYING
…
COPYING.LIB
…
Changelog
…
HACKING
…
LICENSE
…
MAINTAINERS MAINTAINERS: Add ZynqMP to MAINTAINERS file 2015-08-25 15:45:07 +01:00
Makefile make: Clean build messages 2015-07-27 22:44:47 +03:00
Makefile.objs crypto: introduce new module for computing hash digests 2015-07-07 12:04:07 +02:00
Makefile.target migration: move savevm.c inside migration/ 2015-06-12 06:42:30 +02:00
README
…
VERSION Open 2.5 development tree 2015-08-11 23:15:55 +01:00
accel.c
…
aio-posix.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
aio-win32.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
arch_init.c smbios: move smbios code into a common folder 2015-08-13 14:08:30 +03:00
async.c AioContext: force event loop iteration using BH 2015-07-29 10:02:06 +01:00
balloon.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
block.c block: Fix backing file child when modifying graph 2015-07-14 17:15:23 +02:00
blockdev-nbd.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
blockdev.c throttle: refuse bps_max/iops_max without bps/iops 2015-08-05 12:53:48 +01:00
blockjob.c blockjob: add block_job_release function 2015-07-07 14:27:14 +01:00
bootdevice.c
…
bt-host.c
…
bt-vhci.c
…
configure linux-user: remove --enable-guest-base/--disable-guest-base 2015-08-24 11:14:17 -07:00
coroutine-gthread.c
…
coroutine-sigaltstack.c
…
coroutine-ucontext.c
…
coroutine-win32.c
…
cpu-exec.c exec: drop cpu_can_do_io, just read cpu->can_do_io 2015-08-14 23:40:32 +02:00
cpus.c exec: drop cpu_can_do_io, just read cpu->can_do_io 2015-08-14 23:40:32 +02:00
cputlb.c cputlb: Add functions for flushing TLB for a single MMU index 2015-08-25 16:18:33 +01:00
device-hotplug.c
…
device_tree.c device_tree: Fix a typo 2015-07-27 22:44:47 +03:00
disas.c disas: Defeature print_target_address 2015-08-14 23:40:32 +02:00
dma-helpers.c range: remove useless inclusions 2015-04-30 16:05:48 +03:00
dump.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
exec.c exec: use macro ROUND_UP for alignment 2015-08-14 23:40:32 +02:00
gdbstub.c gdbstub: Set current CPU on interruptions 2015-07-27 22:46:16 +03:00
hmp-commands.hx qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
hmp.c qmp: Add optional bool "unmap" to drive-mirror 2015-07-02 10:06:23 +01:00
hmp.h qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
iohandler.c iohandler: Change return type of qemu_set_fd_handler to "void" 2015-06-12 13:26:21 +01:00
ioport.c - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan) 2015-04-30 12:04:11 +01:00
iothread.c rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
kvm-all.c VFIO updates for 2.4-rc0 2015-07-07 09:22:40 +01:00
kvm-stub.c kvm: some fixes to kvm_resamplefds_allowed 2015-07-06 12:15:14 -06:00
main-loop.c main-loop: fix qemu_notify_event for aio_notify optimization 2015-07-27 17:12:19 +01:00
memory.c Merge memory_region_init_reservation() into memory_region_init_io() 2015-08-13 11:26:21 +01:00
memory_mapping.c memory_mapping: Rework cpu related includes 2015-06-26 16:00:50 +02:00
module-common.c
…
monitor.c osdep.h: Remove qemu_printf 2015-08-19 16:29:53 +01:00
nbd.c qemu-nbd: only send a limited number of errno codes on the wire 2015-05-08 14:45:11 +02:00
numa.c numa: Fix memory leak in numa_set_mem_node_id() 2015-07-15 16:57:50 -03:00
os-posix.c
…
os-win32.c
…
page_cache.c
…
qapi-schema.json qapi: add missing @ 2015-07-27 22:44:47 +03:00
qdev-monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qdict-test-data.txt
…
qemu-bridge-helper.c
…
qemu-char.c qemu-char: Fix missed data on unix socket 2015-07-23 07:37:38 +02:00
qemu-coroutine-io.c
…
qemu-coroutine-lock.c coroutine: remove unnecessary parentheses in qemu_co_queue_empty 2015-04-30 16:05:49 +03:00
qemu-coroutine-sleep.c
…
qemu-coroutine.c
…
qemu-doc.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-img-cmds.hx
…
qemu-img.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qemu-img.texi
…
qemu-io-cmds.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-io.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-log.c
…
qemu-nbd.c qemu-nbd: remove unnecessary qemu_notify_event() 2015-08-14 23:40:32 +02:00
qemu-nbd.texi
…
qemu-options-wrapper.h
…
qemu-options.h
…
qemu-options.hx qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-seccomp.c
…
qemu-tech.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-timer.c qemu-timer: initialize "timers_done_ev" to set 2015-07-22 12:41:32 +01:00
qemu.nsi
…
qemu.sasl
…
qjson.c QJSON: Use OBJECT_CHECK 2015-05-11 08:59:07 -04:00
qmp-commands.hx migration: Write documetation for events capabilites 2015-07-15 09:07:54 +02:00
qmp.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
qtest.c qtest: pre-buffer hex nibs 2015-05-22 15:58:22 -04:00
rules.mak make: load only required dependency files. 2015-08-13 14:08:25 +03:00
softmmu_template.h exec: drop cpu_can_do_io, just read cpu->can_do_io 2015-08-14 23:40:32 +02:00
spice-qemu-char.c spice: fix spice_chr_add_watch() pre-condition 2015-05-29 09:56:01 +02:00
tcg-runtime.c
…
tci.c tcg: implement real ext_i32_i64 and extu_i32_i64 ops 2015-08-24 11:10:54 -07:00
thread-pool.c
…
thunk.c linux-user: Allocate thunk size dynamically 2015-06-15 11:36:58 +03:00
tpm.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
trace-events block/mirror: limit qiov to IOV_MAX elements 2015-08-06 04:41:09 -04:00
translate-all.c linux-user: remove --enable-guest-base/--disable-guest-base 2015-08-24 11:14:17 -07:00
translate-all.h translate-all: remove unnecessary argument to tb_invalidate_phys_range 2015-06-05 17:09:59 +02:00
user-exec.c osdep.h: Remove qemu_printf 2015-08-19 16:29:53 +01:00
version.rc
…
vl.c smbios: move smbios code into a common folder 2015-08-13 14:08:30 +03:00
xen-common-stub.c
…
xen-common.c migration: Fix regression for xenfv and pc,accel=xen machine. 2015-08-03 16:13:40 +00:00
xen-hvm-stub.c
…
xen-hvm.c xen-220615, more SOB lines 2015-06-23 17:46:20 +01:00
xen-mapcache.c
…

README 

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team