[gentoo-commits] proj/qemu-kvm:qemu-kvm-1.1.2-gentoo commit in: /

[Doug Goldstein]

commit:     bf2164613a3bca292fcbba17b9dfd935fd79da72
Author:     David Gibson <david <AT> gibson <DOT> dropbear <DOT> id <DOT> au>
AuthorDate: Mon Sep 10 02:30:56 2012 +0000
Commit:     Doug Goldstein <cardoe <AT> gentoo <DOT> org>
CommitDate: Wed Oct 24 07:03:04 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/qemu-kvm.git;a=commit;h=bf216461

qemu-char: BUGFIX, don't call FD_ISSET with negative fd

tcp_chr_connect(), unlike for example udp_chr_update_read_handler() does
not check if the fd it is using is valid (>= 0) before passing it to
qemu_set_fd_handler2().  If using e.g. a TCP serial port, which is not
initially connected, this can result in -1 being passed to FD_ISSET, which
has undefined behaviour.  On x86 it seems to harmlessly return 0, but on
PowerPC, it causes a fortify buffer overflow error to be thrown.

This patch fixes this by putting an extra test in tcp_chr_connect(), and
also adds an assert qemu_set_fd_handler2() to catch other such errors on
all platforms, rather than just some.

Signed-off-by: David Gibson <david <AT> gibson.dropbear.id.au>
Signed-off-by: Anthony Liguori <aliguori <AT> us.ibm.com>
(cherry picked from commit bbdd2ad0814ea0911076419ea21b7957505cf1cc)

---
 iohandler.c |    2 ++
 qemu-char.c |    6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/iohandler.c b/iohandler.c
index dea4355..a2d871b 100644
--- a/iohandler.c
+++ b/iohandler.c
@@ -56,6 +56,8 @@ int qemu_set_fd_handler2(int fd,
 {
     IOHandlerRecord *ioh;
 
+    assert(fd >= 0);
+
     if (!fd_read && !fd_write) {
         QLIST_FOREACH(ioh, &io_handlers, next) {
             if (ioh->fd == fd) {

diff --git a/qemu-char.c b/qemu-char.c
index fe1126f..3a68430 100644
--- a/qemu-char.c
+++ b/qemu-char.c
@@ -2321,8 +2321,10 @@ static void tcp_chr_connect(void *opaque)
     TCPCharDriver *s = chr->opaque;
 
     s->connected = 1;
-    qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
-                         tcp_chr_read, NULL, chr);
+    if (s->fd >= 0) {
+        qemu_set_fd_handler2(s->fd, tcp_chr_read_poll,
+                             tcp_chr_read, NULL, chr);
+    }
     qemu_chr_generic_open(chr);
 }