mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
40,301 Commits 50 Branches 394 Tags 404 MiB
C 82.6%
C++ 6.5%
Python 3.4%
Dylan 2.9%
Shell 1.6%
Other 2.8%
b15deac795
Go to file
Jeff Cody b15deac795 block: vpc - prevent overflow if max_table_entries >= 0x40000000 
When we allocate the pagetable based on max_table_entries, we multiply
the max table entry value by 4 to accomodate a table of 32-bit integers.
However, max_table_entries is a uint32_t, and the VPC driver accepts
ranges for that entry over 0x40000000.  So during this allocation:

s->pagetable = qemu_try_blockalign(bs->file, s->max_table_entries * 4);

The size arg overflows, allocating significantly less memory than
expected.

Since qemu_try_blockalign() size argument is size_t, cast the
multiplication correctly to prevent overflow.

The value of "max_table_entries * 4" is used elsewhere in the code as
well, so store the correct value for use in all those cases.

We also check the Max Tables Entries value, to make sure that it is <
SIZE_MAX / 4, so we know the pagetable size will fit in size_t.

Cc: qemu-stable@nongnu.org
Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
2015-07-27 17:19:06 +02:00
audio ossaudio: fix memory leak 2015-07-08 13:11:01 +02:00
backends hostmem: Fix qemu_opt_get_bool() crash in host_memory_backend_init() 2015-07-22 15:09:25 -03:00
block block: vpc - prevent overflow if max_table_entries >= 0x40000000 2015-07-27 17:19:06 +02:00
bsd-user cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
crypto crypto: Fix aes_decrypt_wrapper() 2015-07-20 13:35:45 +02:00
default-configs acpi: split out ICH ACPI support 2015-07-07 13:11:57 +03:00
disas disas/arm-a64: Add missing compiler attribute GCC_FMT_ATTR 2015-07-21 11:18:45 +01:00
docs AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
dtc@65cc4d2748 dtc: Update dtc / libfdt submodule to version 1.4.0 2015-06-03 23:56:49 +02:00
fpu target-s390x: define default NaN values 2015-06-05 01:37:58 +02:00
fsdev virtfs-proxy-helper: fail gracefully if socket path is too long 2015-06-16 20:32:29 +05:30
gdb-xml gdb-xml: Include XML for s390 vector registers 2015-05-27 17:52:03 +02:00
hw Pull request 2015-07-27 14:53:42 +01:00
include hw/net: add simple phy support to mcf_fec driver 2015-07-27 14:12:04 +01:00
libcacard libcacard: pkgconfig: tidy dependent libs 2015-06-23 19:57:28 +03:00
libdecnumber remove libdecnumber/dpd/decimal128Local.h 2015-06-23 19:57:27 +03:00
linux-headers linux-headers: Update to 4.2-rc1 2015-07-06 17:59:01 +02:00
linux-user linux-user: Fix MIPS N64 trap and break instruction bug 2015-07-15 14:07:25 +01:00
migration rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
net net: Flush queued packets when guest resumes 2015-07-20 18:11:24 +01:00
pc-bios pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
pixman@87eea99e44 pixman: update internal copy to pixman-0.32.6 2014-09-15 08:14:19 +02:00
po po: fix conflict with %.mo rule in rules.mak 2014-09-26 13:35:08 +02:00
qapi migration: create migration event 2015-07-07 14:54:55 +02:00
qga qga: fixed versions for guest bus types in qapi-schema 2015-07-21 14:36:06 -05:00
qobject Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qom cpu: Convert cpu_index into a bitmap 2015-07-09 15:20:40 +02:00
roms pseries: Update SLOF firmware image to qemu-slof-20150429 2015-07-07 17:44:49 +02:00
scripts virtio-input: move sys/ioctl.h include 2015-07-16 17:34:41 +02:00
slirp qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
stubs main-loop: introduce qemu_mutex_iothread_locked 2015-07-01 15:45:50 +02:00
target-alpha cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-arm target-arm: kvm: Differentiate registers based on write-back levels 2015-07-21 11:18:45 +01:00
target-cris disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-i386 target-i386/FPU: a misprint in helper_fistll_ST0 2015-07-24 13:57:45 +02:00
target-lm32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-m68k cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-microblaze disas: microblaze: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
target-mips mips/kvm: Sign extend registers written to KVM 2015-07-16 20:00:20 +02:00
target-moxie cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-openrisc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-ppc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-s390x cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sh4 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-sparc cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-tricore cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-unicore32 cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
target-xtensa cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
tcg tcg/optimize: fix tcg_opt_gen_movi 2015-07-23 20:37:12 -07:00
tests rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
trace Remove superfluous '\n' around error_report() 2015-03-10 08:15:33 +03:00
ui vnc: fix memory leak 2015-07-24 13:57:44 +02:00
util rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
.exrc
.gitignore gitignore: Ignore more .pod files. 2015-04-04 09:45:59 +03:00
.gitmodules PPC: Add u-boot firmware for e500 2014-06-16 13:24:35 +02:00
.mailmap
.travis.yml .travis.yml: Add "--enable-modules" 2015-01-26 12:27:05 +01:00
accel.c accel: Create accel object when initializing machine 2014-10-09 15:36:14 +02:00
aio-posix.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
aio-win32.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
arch_init.c migration: reduce include files 2015-06-12 06:42:34 +02:00
async.c AioContext: optimize clearing the EventNotifier 2015-07-22 12:41:40 +01:00
balloon.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
block.c block: Fix backing file child when modifying graph 2015-07-14 17:15:23 +02:00
blockdev-nbd.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
blockdev.c mirror: correct buf_size 2015-07-14 21:50:13 -04:00
blockjob.c blockjob: add block_job_release function 2015-07-07 14:27:14 +01:00
bootdevice.c misc: fix typos in copyright declaration 2015-03-26 14:21:43 +01:00
bt-host.c
bt-vhci.c
Changelog
CODING_STYLE CODING_STYLE: Section about conditional statement 2014-08-15 18:54:06 +04:00
configure crypto: fix build with nettle >= 3.0.0 2015-07-16 20:00:20 +02:00
COPYING
COPYING.LIB
coroutine-gthread.c glib-compat.h: add new thread API emulation on top of pre-2.31 API 2014-06-10 07:44:01 +02:00
coroutine-sigaltstack.c coroutine-sigaltstack: Change jmp_buf to sigjmp_buf 2014-11-11 11:07:55 +03:00
coroutine-ucontext.c coroutine-ucontext: use __thread 2015-01-13 13:43:28 +00:00
coroutine-win32.c coroutine-win32.c: Add noinline attribute to work around gcc bug 2014-06-26 14:08:14 +01:00
cpu-exec.c cpu-exec: Purge all uses of ENV_GET_CPU() 2015-07-09 15:20:40 +02:00
cpus.c rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
cputlb.c memory: replace cpu_physical_memory_reset_dirty() with test-and-clear 2015-06-05 17:10:00 +02:00
device_tree.c device-tree: Make a common-obj 2015-06-03 14:21:24 +03:00
device-hotplug.c pci-hotplug-old: Has been dead for five major releases, bury 2015-03-01 12:37:54 +01:00
disas.c disas: cris: QOMify target specific disas setup 2015-07-09 15:20:41 +02:00
dma-helpers.c range: remove useless inclusions 2015-04-30 16:05:48 +03:00
dump.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
exec.c exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb() 2015-07-23 07:37:38 +02:00
gdbstub.c gdbstub: Use cpu_set_pc() helper 2015-07-09 15:20:40 +02:00
HACKING
hmp-commands.hx qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
hmp.c qmp: Add optional bool "unmap" to drive-mirror 2015-07-02 10:06:23 +01:00
hmp.h qmp/hmp: add rocker device support 2015-06-12 13:42:17 +01:00
iohandler.c iohandler: Change return type of qemu_set_fd_handler to "void" 2015-06-12 13:26:21 +01:00
ioport.c - miscellaneous cleanups for TCG (Emilio) and NBD (Bogdan) 2015-04-30 12:04:11 +01:00
iothread.c rcu: actually register threads that have RCU read-side critical sections 2015-07-24 13:57:45 +02:00
kvm-all.c VFIO updates for 2.4-rc0 2015-07-07 09:22:40 +01:00
kvm-stub.c kvm: some fixes to kvm_resamplefds_allowed 2015-07-06 12:15:14 -06:00
LICENSE vfio: move hw/misc/vfio.c to hw/vfio/pci.c Move vfio.h into include/hw/vfio 2014-12-19 15:24:06 -07:00
main-loop.c Change qemu_set_fd_handler2(..., NULL, ...) to qemu_set_fd_handler 2015-06-12 13:26:21 +01:00
MAINTAINERS MAINTAINERS: update email address 2015-07-14 17:15:23 +02:00
Makefile Makefile: Add "make ctags" 2015-06-23 20:23:39 +03:00
Makefile.objs crypto: introduce new module for computing hash digests 2015-07-07 12:04:07 +02:00
Makefile.target migration: move savevm.c inside migration/ 2015-06-12 06:42:30 +02:00
memory_mapping.c memory_mapping: Rework cpu related includes 2015-06-26 16:00:50 +02:00
memory.c memory: count number of active VGA logging clients 2015-07-24 13:57:45 +02:00
module-common.c
monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
nbd.c qemu-nbd: only send a limited number of errno codes on the wire 2015-05-08 14:45:11 +02:00
numa.c numa: Fix memory leak in numa_set_mem_node_id() 2015-07-15 16:57:50 -03:00
os-posix.c rcu: do not create thread in pthread_atfork callback 2015-04-01 10:06:38 +02:00
os-win32.c pidfile: stop making pidfile error a special case 2014-11-02 10:04:34 +03:00
page_cache.c xbzrle: rebuild the cache_is_cached function 2015-01-15 17:49:43 +05:30
qapi-schema.json Revert "vhost-user: add multi queue support" 2015-07-20 14:19:40 +03:00
qdev-monitor.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qdict-test-data.txt
qemu-bridge-helper.c qemu-bridge-helper: Fix fd leak in main() 2014-06-27 10:39:10 +02:00
qemu-char.c qemu-char: Fix missed data on unix socket 2015-07-23 07:37:38 +02:00
qemu-coroutine-io.c coroutine-io: Return -errno in case of error 2015-03-18 12:07:21 +01:00
qemu-coroutine-lock.c coroutine: remove unnecessary parentheses in qemu_co_queue_empty 2015-04-30 16:05:49 +03:00
qemu-coroutine-sleep.c coroutine: Drop co_sleep_ns 2014-08-29 10:46:58 +01:00
qemu-coroutine.c coroutine: Clean up qemu_coroutine_enter() 2015-03-09 11:11:59 +01:00
qemu-doc.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-img-cmds.hx qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-img.c Include qapi/qmp/qerror.h exactly where needed 2015-06-22 18:20:41 +02:00
qemu-img.texi qemu-img: Add progress output for amend 2014-11-03 11:41:48 +00:00
qemu-io-cmds.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-io.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-log.c qemu-log: Correct help text of 'log cpu_reset' 2015-02-10 09:27:20 +03:00
qemu-nbd.c qerror: Move #include out of qerror.h 2015-06-22 18:20:40 +02:00
qemu-nbd.texi nbd: Miscellaneous typo fixes. 2014-05-24 00:07:29 +04:00
qemu-options-wrapper.h
qemu-options.h
qemu-options.hx qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-seccomp.c seccomp: add mlockall to whitelist 2015-01-23 14:07:08 +01:00
qemu-tech.texi qemu-doc: fix typos 2015-07-24 13:57:45 +02:00
qemu-timer.c qemu-timer: initialize "timers_done_ev" to set 2015-07-22 12:41:32 +01:00
qemu.nsi
qemu.sasl
qjson.c QJSON: Use OBJECT_CHECK 2015-05-11 08:59:07 -04:00
qmp-commands.hx migration: Write documetation for events capabilites 2015-07-15 09:07:54 +02:00
qmp.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
qtest.c qtest: pre-buffer hex nibs 2015-05-22 15:58:22 -04:00
README
rules.mak rules.mak: Force CFLAGS for all objects in DSO 2015-05-08 14:45:11 +02:00
softmmu_template.h softmmu: Add probe_write() 2015-06-11 10:13:28 +01:00
spice-qemu-char.c spice: fix spice_chr_add_watch() pre-condition 2015-05-29 09:56:01 +02:00
tcg-runtime.c tcg: Push tcg-runtime routines into exec/helper-* 2014-05-28 09:33:54 -07:00
tci.c tcg: Mask TCGMemOp appropriately for indexing 2015-06-09 06:35:29 -07:00
thread-pool.c thread-pool: clean up thread_pool_completion_bh() 2015-04-28 15:36:09 +02:00
thunk.c linux-user: Allocate thunk size dynamically 2015-06-15 11:36:58 +03:00
tpm.c Include monitor/monitor.h exactly where needed 2015-06-22 18:20:41 +02:00
trace-events milkymist-minimac2: Flush queued packets when link comes up 2015-07-27 14:12:18 +01:00
translate-all.c translate-all: Change tb_flush() env argument to cpu 2015-07-09 15:20:40 +02:00
translate-all.h translate-all: remove unnecessary argument to tb_invalidate_phys_range 2015-06-05 17:09:59 +02:00
user-exec.c exec: move functions to translate-all.h 2015-06-05 17:09:59 +02:00
VERSION Update version for v2.4.0-rc2 release 2015-07-22 18:17:19 +01:00
version.rc
vl.c vl: Fix compiler warning for builds without VNC 2015-07-24 13:57:45 +02:00
xen-common-stub.c accel: Move Xen registration code to xen-common.c 2014-10-04 08:59:15 +02:00
xen-common.c accel: Pass MachineState object to accel init functions 2014-10-09 12:57:10 +02:00
xen-hvm-stub.c xen: Remove xen_cmos_set_s3_resume() 2015-03-10 08:15:33 +03:00
xen-hvm.c xen-220615, more SOB lines 2015-06-23 17:46:20 +01:00
xen-mapcache.c xen: add a lock for the mapcache 2015-01-20 14:24:17 +00:00

README 

Read the documentation in qemu-doc.html or on http://wiki.qemu-project.org

- QEMU team