gwj / at91sam9263 · Commits

Commit b3bc154098f211db7014de151c79b4234ae5029b

Authored by blueswir1
1 parent 6ef05b95

FDC: Fix buffer overflow (Hervé Poussineau) 

In floppy controller, programming PIO writes which are more than one sector
long leads to a buffer overflow of the fdtrl->fifo[] array.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4293 c046a42c-6fe2-441c-8c8c-71466251a162
Inline Side-by-side
Showing 1 changed file with 4 additions and 2 deletions
hw/fdc.c
  View file @b3bc154
... ... @@ -1770,8 +1770,10 @@ static void fdctrl_write_data (fdctrl_t *fdctrl, uint32_t value)
1770 1770 /* Is it write command time ? */
1771 1771 if (fdctrl->msr & FD_MSR_NONDMA) {
1772 1772 /* FIFO data write */
1773   - fdctrl->fifo[fdctrl->data_pos++] = value;
1774   - if (fdctrl->data_pos % FD_SECTOR_LEN == (FD_SECTOR_LEN - 1) ||
  1773 + pos = fdctrl->data_pos++;
  1774 + pos %= FD_SECTOR_LEN;
  1775 + fdctrl->fifo[pos] = value;
  1776 + if (pos == FD_SECTOR_LEN - 1 ||
1775 1777 fdctrl->data_pos == fdctrl->data_len) {
1776 1778 cur_drv = get_cur_drv(fdctrl);
1777 1779 if (bdrv_write(cur_drv->bs, fd_sector(cur_drv), fdctrl->fifo, 1) < 0) {
... ...