From a2798cc2bfa4fa4540f4f0c4fd2df12bbe032299 Mon Sep 17 00:00:00 2001 From: Horst Schirmeier Date: Sat, 6 Aug 2016 16:12:40 +0200 Subject: [PATCH] bochs: backport PCI IDE buffer-overflow fix Upstream SVN r10244: "Fixed possible buffer overflow causing segfault or memory corruption. The buffers are not large enough for the maximum sector count in LBA48 mode. Now resetting buffer pointers after processing a PRD (and move remaining data if necessary). This should fix the SF bug items #3190970 and #3077616." This happened to us when booting Debian 8 with a Linux 3.16 kernel from "flat" or "volatile" disk images, in the end corrupting the VGA card's ("theVga") internal state and segfaulting. Change-Id: I6a80432093a547dc2eb5270845369d0918e1e49b --- simulators/bochs/iodev/pci_ide.cc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/simulators/bochs/iodev/pci_ide.cc b/simulators/bochs/iodev/pci_ide.cc index 98e99e69..a8a9639e 100644 --- a/simulators/bochs/iodev/pci_ide.cc +++ b/simulators/bochs/iodev/pci_ide.cc @@ -301,6 +301,14 @@ void bx_pci_ide_c::timer() BX_PIDE_THIS s.bmdma[channel].prd_current = 0; DEV_hd_bmdma_complete(channel); } else { + // To avoid buffer overflow reset buffer pointers and copy data if necessary + count = BX_PIDE_THIS s.bmdma[channel].buffer_top - BX_PIDE_THIS s.bmdma[channel].buffer_idx; + if (count > 0) { + memcpy(BX_PIDE_THIS s.bmdma[channel].buffer, BX_PIDE_THIS s.bmdma[channel].buffer_idx, count); + } + BX_PIDE_THIS s.bmdma[channel].buffer_top = BX_PIDE_THIS s.bmdma[channel].buffer + count; + BX_PIDE_THIS s.bmdma[channel].buffer_idx = BX_PIDE_THIS s.bmdma[channel].buffer; + // Prepare for next PRD BX_PIDE_THIS s.bmdma[channel].prd_current += 8; DEV_MEM_READ_PHYSICAL(BX_PIDE_THIS s.bmdma[channel].prd_current, 4, (Bit8u *)&prd.addr); DEV_MEM_READ_PHYSICAL(BX_PIDE_THIS s.bmdma[channel].prd_current+4, 4, (Bit8u *)&prd.size);