diff options
| author | Mark H Weaver <mhw@netris.org> | 2015-08-18 22:23:57 -0400 |
|---|---|---|
| committer | Mark H Weaver <mhw@netris.org> | 2015-08-18 23:57:25 -0400 |
| commit | 7cb6f648b2486b0e6060a333564432a0830637de (patch) | |
| tree | be5152f2b7171f58bf9cfa8036536dccee8d810f /gnu/packages/patches/qemu-CVE-2015-5745.patch | |
| parent | 2376963411a096aa0c8e77f27c4d1db1a9a7fa42 (diff) | |
gnu: qemu: Update to 2.3.1. Add fix for CVE-2015-5745.
* gnu/packages/patches/qemu-CVE-2015-5745.patch: New file.
* gnu/packages/patches/qemu-CVE-2015-3456.patch,
gnu/packages/patches/qemu-CVE-2015-5154-pt1.patch,
gnu/packages/patches/qemu-CVE-2015-5154-pt2.patch,
gnu/packages/patches/qemu-CVE-2015-5154-pt3.patch,
gnu/packages/patches/qemu-CVE-2015-5158.patch: Delete files.
* gnu-system.am (dist_patch_DATA): Add new file and remove the deleted ones.
* gnu/packages/qemu.scm (qemu): Update to 2.3.1. Add new patch and remove the
deleted ones.
Diffstat (limited to 'gnu/packages/patches/qemu-CVE-2015-5745.patch')
| -rw-r--r-- | gnu/packages/patches/qemu-CVE-2015-5745.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/gnu/packages/patches/qemu-CVE-2015-5745.patch b/gnu/packages/patches/qemu-CVE-2015-5745.patch new file mode 100644 index 0000000000..2326279026 --- /dev/null +++ b/gnu/packages/patches/qemu-CVE-2015-5745.patch @@ -0,0 +1,32 @@ +From 7882080388be5088e72c425b02223c02e6cb4295 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" <mst@redhat.com> +Date: Thu, 23 Jul 2015 17:52:02 +0300 +Subject: [PATCH] virtio-serial: fix ANY_LAYOUT + +Don't assume a specific layout for control messages. +Required by virtio 1. + +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Amit Shah <amit.shah@redhat.com> +Reviewed-by: Jason Wang <jasowang@redhat.com> +--- + hw/char/virtio-serial-bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c +index 78c73e5..929e49c 100644 +--- a/hw/char/virtio-serial-bus.c ++++ b/hw/char/virtio-serial-bus.c +@@ -195,7 +195,8 @@ static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len) + return 0; + } + +- memcpy(elem.in_sg[0].iov_base, buf, len); ++ /* TODO: detect a buffer that's too short, set NEEDS_RESET */ ++ iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len); + + virtqueue_push(vq, &elem, len); + virtio_notify(VIRTIO_DEVICE(vser), vq); +-- +2.4.3 + |