rpms/qemu/F-12 qemu-parallels-image-format-overflow.patch, NONE, 1.1 qemu-slirp-use-after-free.patch, NONE, 1.1 qemu.spec, 1.148, 1.149

[Mark McLoughlin]

Author: markmc

Update of /cvs/pkgs/rpms/qemu/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv7421

Modified Files:
	qemu.spec 
Added Files:
	qemu-parallels-image-format-overflow.patch 
	qemu-slirp-use-after-free.patch 
Log Message:
* Fri Nov 20 2009 Mark McLoughlin <markmc at redhat.com> - 2:0.11.0-12
- Fix a use-after-free crasher in the slirp code (#539583)
- Fix overflow in the parallels image format support (#533573)


qemu-parallels-image-format-overflow.patch:
 parallels.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- NEW FILE qemu-parallels-image-format-overflow.patch ---
>From ff1a1e986f2e167c2538160d0476ac61cda31f77 Mon Sep 17 00:00:00 2001
From: David Woodhouse <dwmw2 at infradead.org>
Date: Sat, 7 Nov 2009 14:10:01 +0000
Subject: [PATCH] Fix 32-bit overflow in parallels image support

(cherry picked from commit c34d2451ed32651e14e309f94009be07d231ee96)

Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
Signed-off-by: Anthony Liguori <aliguori at us.ibm.com>
Signed-off-by: Mark McLoughlin <markmc at redhat.com>
Fedora-patch: qemu-parallels-image-format-overflow.patch
---
 block/parallels.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/parallels.c b/block/parallels.c
index 0b64a5c..63b6738 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -119,7 +119,8 @@ fail:
 static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
 {
     BDRVParallelsState *s = bs->opaque;
-    uint32_t index, offset, position;
+    uint32_t index, offset;
+    uint64_t position;
 
     index = sector_num / s->tracks;
     offset = sector_num % s->tracks;
@@ -128,7 +129,7 @@ static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num)
     if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0))
 	return -1;
 
-    position = (s->catalog_bitmap[index] + offset) * 512;
+    position = (uint64_t)(s->catalog_bitmap[index] + offset) * 512;
 
 //    fprintf(stderr, "sector: %llx index=%x offset=%x pointer=%x position=%x\n",
 //	sector_num, index, offset, s->catalog_bitmap[index], position);
-- 
1.6.2.5


qemu-slirp-use-after-free.patch:
 mbuf.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- NEW FILE qemu-slirp-use-after-free.patch ---
>From 56d370091cb01878c580f528011cd1717f8077fa Mon Sep 17 00:00:00 2001
From: Mark McLoughlin <markmc at redhat.com>
Date: Fri, 20 Nov 2009 18:07:15 +0000
Subject: [PATCH] slirp: fix use-after-free

460fec67ee introduced a use-after free in slirp.

Cc: Jan Kiszka <jan.kiszka at siemens.com>
Signed-off-by: Mark McLoughlin <markmc at redhat.com>
Fedora-patch: qemu-slirp-use-after-free.patch
---
 slirp/mbuf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/slirp/mbuf.c b/slirp/mbuf.c
index 7652fea..87508ba 100644
--- a/slirp/mbuf.c
+++ b/slirp/mbuf.c
@@ -95,8 +95,8 @@ m_free(struct mbuf *m)
 	 * Either free() it or put it on the free list
 	 */
 	if (m->m_flags & M_DOFREE) {
-		free(m);
 		m->slirp->mbuf_alloced--;
+		free(m);
 	} else if ((m->m_flags & M_FREELIST) == 0) {
 		insque(m,&m->slirp->m_freelist);
 		m->m_flags = M_FREELIST; /* Clobber other flags */
-- 
1.6.2.5



Index: qemu.spec
===================================================================
RCS file: /cvs/pkgs/rpms/qemu/F-12/qemu.spec,v
retrieving revision 1.148
retrieving revision 1.149
diff -u -p -r1.148 -r1.149
--- qemu.spec	4 Nov 2009 17:37:52 -0000	1.148
+++ qemu.spec	20 Nov 2009 18:28:23 -0000	1.149
@@ -1,7 +1,7 @@
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 0.11.0
-Release: 11%{?dist}
+Release: 12%{?dist}
 # Epoch because we pushed a qemu-1.0 package
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
@@ -61,6 +61,12 @@ Patch12: qemu-fix-dropped-packets-with-n
 # Temporarily disable preadv/pwritev support (#526549)
 Patch13: qemu-disable-preadv-support.patch
 
+# Fix a use-after-free crasher in the slirp code (#539583)
+Patch14: qemu-slirp-use-after-free.patch
+
+# Fix overflow in the parallels image format support (#533573)
+Patch15: qemu-parallels-image-format-overflow.patch
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: SDL-devel zlib-devel which texi2html gnutls-devel cyrus-sasl-devel
 BuildRequires: rsync dev86 iasl
@@ -261,6 +267,8 @@ such as kvmtrace and kvm_stat.
 %patch11 -p1
 %patch12 -p1
 %patch13 -p1
+%patch14 -p1
+%patch15 -p1
 
 %build
 # --build-id option is used fedora 8 onwards for giving info to the debug packages.
@@ -542,6 +550,10 @@ fi
 %{_mandir}/man1/qemu-img.1*
 
 %changelog
+* Fri Nov 20 2009 Mark McLoughlin <markmc at redhat.com> - 2:0.11.0-12
+- Fix a use-after-free crasher in the slirp code (#539583)
+- Fix overflow in the parallels image format support (#533573)
+
 * Wed Nov  4 2009 Mark McLoughlin <markmc at redhat.com> - 2:0.11.0-11
 - Temporarily disable preadv/pwritev support to fix data corruption (#526549)