1. 05 12月, 2011 29 次提交
  2. 02 12月, 2011 1 次提交
  3. 30 11月, 2011 2 次提交
  4. 29 11月, 2011 8 次提交
    • A
      Update version for 1.0-rc4 · 85e83264
      Anthony Liguori 提交于
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      85e83264
    • M
      ccid: Fix buffer overrun in handling of VSC_ATR message · 7e62255a
      Markus Armbruster 提交于
      ATR size exceeding the limit is diagnosed, but then we merrily use it
      anyway, overrunning card->atr[].
      
      The message is read from a character device.  Obvious security
      implications unless the other end of the character device is trusted.
      
      Spotted by Coverity.  CVE-2011-4111.
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      7e62255a
    • A
      Revert "fix out of tree build" · aea317aa
      Anthony Liguori 提交于
      This reverts commit be85c90b.
      
      This patch is incorrect and breaks the build with a freshly cloned git tree.
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      aea317aa
    • M
      configure: avoid screening of --{en, dis}able-usb-redir options · 023ddd74
      Max Filippov 提交于
      --*dir) option pattern precede --{en,dis}able-usb-redir) patterns in the
      option analysis switch, making the latter options have no effect.
      
      There were some --*dir that are supported by Autoconf and not by QEMU configure.
      The aim was to let QEMU packagers use the rpm (or similar) macro that overrides
      directories for their distribution.
      
      Replace --*dir with exact option names.
      Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
      Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      023ddd74
    • M
      cutils: Make strtosz & friends leave follow set to callers · eba90e4e
      Markus Armbruster 提交于
      strtosz() & friends require the size to be at the end of the string,
      or be followed by whitespace or ','.  I find this surprising, because
      the name suggests it works like strtol().
      
      The check simplifies callers that accept exactly that follow set
      slightly.  No such callers exist.
      
      The check is redundant for callers that accept a smaller follow set,
      and thus need to check themselves anyway.  Right now, this is the case
      for all but one caller.  All of them neglected to check, or checked
      incorrectly, but the previous few commits fixed them up.
      
      Finally, the check is problematic for callers that accept a larger
      follow set.  This is the case in monitor_parse_command().
      Fortunately, the problems there are relatively harmless.
      
      monitor_parse_command() uses strtosz() for argument type 'o'.  When
      the last argument is of type 'o', a trailing ',' is diagnosed
      differently than other trailing junk:
      
          (qemu) migrate_set_speed 1x
          invalid size
          (qemu) migrate_set_speed 1,
          migrate_set_speed: extraneous characters at the end of line
      
      A related inconsistency exists with non-last arguments.  No such
      command exists, but let's use memsave to explore the inconsistency.
      
      The monitor permits, but does not require whitespace between
      arguments.  For instance, "memsave (1-1)1024foo" is parsed as command
      memsave with three arguments 0, 1024 and "foo".  Yes, this is daft,
      but at least it's consistently daft.
      
      If I change memsave's second argument from 'i' to 'o', then "memsave
      (1-1)1foo" is rejected, because the size is followed by an 'f'.  But
      "memsave (1-1)1," is still accepted, and duly saves to file ",".
      
      We don't have any users of strtosz that profit from the check.  In the
      users we have, it appears to encourage sloppy error checking, or gets
      in the way.  Drop the bothersome check.
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      eba90e4e
    • M
      qemu-img: Tighten parsing of size arguments · e36b3695
      Markus Armbruster 提交于
      strtosz_suffix() fails unless the size is followed by 0, whitespace or
      ','.  Useless here, because we need to fail for any junk following the
      size, even if it starts with whitespace or ','.  Check manually.
      Things like "qemu-img create xxx 1024," and "qemu-img convert -S '1024
      junk'" are now caught.
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      e36b3695
    • M
      x86/cpuid: Tighten parsing of tsc_freq=FREQ · 45009a30
      Markus Armbruster 提交于
      cpu_x86_find_by_name() uses strtosz_suffix_unit(), but screws up the
      error checking.  It detects some failures, but not all.  Undetected
      failures result in a zero tsc_khz value (error value -1 divided by
      1000), which means "no tsc_freq set".
      
      To reproduce, try "-cpu qemu64,tsc_freq=9999999T".
      strtosz_suffix_unit() fails, because the value overflows int64_t,
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      45009a30
    • M
      vl: Tighten parsing of -m argument · 961b42b9
      Markus Armbruster 提交于
      strtosz_suffix() fails unless the size is followed by 0, whitespace or
      ','.  Useless here, because we need to fail for any junk following the
      size, even if it starts with whitespace or ','.  Check manually.
      Things like "-m 1024," are now caught.
      Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      961b42b9