diff options
| author | Prasad J Pandit | 2016-10-20 09:40:24 +0200 |
|---|---|---|
| committer | Gerd Hoffmann | 2016-10-26 14:51:44 +0200 |
| commit | 0c0fc2b5fd534786051889459848764edd798050 (patch) | |
| tree | 8c265e4925492b05d20044cf8d69692311ce0184 /hw/audio | |
| parent | Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2016-10-25' into ... (diff) | |
| download | qemu-0c0fc2b5fd534786051889459848764edd798050.tar.gz qemu-0c0fc2b5fd534786051889459848764edd798050.tar.xz qemu-0c0fc2b5fd534786051889459848764edd798050.zip | |
audio: intel-hda: check stream entry count during transfer
Intel HDA emulator uses stream of buffers during DMA data
transfers. Each entry has buffer length and buffer pointer
position, which are used to derive bytes to 'copy'. If this
length and buffer pointer were to be same, 'copy' could be
set to zero(0), leading to an infinite loop. Add check to
avoid it.
Reported-by: Huawei PSIRT <psirt@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/audio')
| -rw-r--r-- | hw/audio/intel-hda.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340cd9..537face94d 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib; |