Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:Update
xen.10696
CVE-2018-18438-qemuu-008-integer-overflow-in-cc...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2018-18438-qemuu-008-integer-overflow-in-ccid_card_vscard_read-allows-memory-corruption.patch of Package xen.10696
References: bsc#1112188 CVE-2018-18438 Suggested-by: Paolo Bonzini <address@hidden> Signed-off-by: Philippe Mathieu-Daudé <address@hidden> --- backends/rng-egd.c | 4 ++-- chardev/char-mux.c | 2 +- gdbstub.c | 2 +- hw/arm/pxa2xx.c | 2 +- hw/arm/strongarm.c | 2 +- hw/char/bcm2835_aux.c | 2 +- hw/char/cadence_uart.c | 4 ++-- hw/char/cmsdk-apb-uart.c | 2 +- hw/char/digic-uart.c | 2 +- hw/char/escc.c | 6 +++--- hw/char/etraxfs_ser.c | 2 +- hw/char/exynos4210_uart.c | 2 +- hw/char/grlib_apbuart.c | 2 +- hw/char/imx_serial.c | 2 +- hw/char/ipoctal232.c | 4 ++-- hw/char/lm32_juart.c | 2 +- hw/char/lm32_uart.c | 2 +- hw/char/mcf_uart.c | 2 +- hw/char/milkymist-uart.c | 2 +- hw/char/parallel.c | 2 +- hw/char/pl011.c | 4 ++-- hw/char/sclpconsole-lm.c | 2 +- hw/char/sclpconsole.c | 4 ++-- hw/char/serial.c | 4 ++-- hw/char/sh_serial.c | 4 ++-- hw/char/spapr_vty.c | 2 +- hw/char/stm32f2xx_usart.c | 2 +- hw/char/terminal3270.c | 2 +- hw/char/virtio-console.c | 2 +- hw/char/xen_console.c | 2 +- hw/char/xilinx_uartlite.c | 2 +- hw/ipmi/ipmi_bmc_extern.c | 2 +- hw/misc/ivshmem.c | 2 +- hw/riscv/riscv_htif.c | 2 +- hw/riscv/sifive_uart.c | 2 +- hw/usb/ccid-card-passthru.c | 2 +- hw/usb/dev-serial.c | 2 +- hw/usb/redirect.c | 2 +- include/qemu/main-loop.h | 2 +- monitor.c | 2 +- net/colo-compare.c | 2 +- net/filter-mirror.c | 2 +- net/slirp.c | 2 +- qtest.c | 2 +- target/xtensa/xtensa-semi.c | 2 +- 45 files changed, 54 insertions(+), 54 deletions(-) Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/qemu-char.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/qemu-char.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/qemu-char.c @@ -413,7 +413,7 @@ static void mux_chr_accept_input(CharDri } } -static int mux_chr_can_read(void *opaque) +static size_t mux_chr_can_read(void *opaque) { CharDriverState *chr = opaque; MuxDriver *d = chr->opaque; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/misc/ivshmem.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/misc/ivshmem.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/misc/ivshmem.c @@ -267,7 +267,7 @@ static void ivshmem_receive(void *opaque IVSHMEM_DPRINTF("ivshmem_receive 0x%02x\n", *buf); } -static int ivshmem_can_receive(void * opaque) +static size_t ivshmem_can_receive(void * opaque) { return 8; } Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/ccid-card-passthru.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/usb/ccid-card-passthru.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/ccid-card-passthru.c @@ -104,7 +104,7 @@ static void ccid_card_vscard_send_init(P (uint8_t *)&msg, sizeof(msg)); } -static int ccid_card_vscard_can_read(void *opaque) +static size_t ccid_card_vscard_can_read(void *opaque) { PassthruState *card = opaque; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/dev-serial.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/usb/dev-serial.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/dev-serial.c @@ -410,7 +410,7 @@ static void usb_serial_handle_data(USBDe } } -static int usb_serial_can_read(void *opaque) +static size_t usb_serial_can_read(void *opaque) { USBSerialState *s = opaque; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/redirect.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/hw/usb/redirect.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/hw/usb/redirect.c @@ -1188,7 +1188,7 @@ static void usbredir_do_attach(void *opa * chardev callbacks */ -static int usbredir_chardev_can_read(void *opaque) +static size_t usbredir_chardev_can_read(void *opaque) { USBRedirDevice *dev = opaque; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/include/qemu/main-loop.h =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/include/qemu/main-loop.h +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/include/qemu/main-loop.h @@ -169,7 +169,7 @@ void qemu_del_wait_object(HANDLE handle, /* async I/O support */ typedef void IOReadHandler(void *opaque, const uint8_t *buf, size_t size); -typedef int IOCanReadHandler(void *opaque); +typedef size_t IOCanReadHandler(void *opaque); /** * qemu_set_fd_handler2: Register a file descriptor with the main loop Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/monitor.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/monitor.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/monitor.c @@ -4489,7 +4489,7 @@ cleanup: free_cmdline_args(args, nb_args); } -static int monitor_can_read(void *opaque) +static size_t monitor_can_read(void *opaque) { Monitor *mon = opaque; Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/net/slirp.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/net/slirp.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/net/slirp.c @@ -584,7 +584,7 @@ struct GuestFwd { Slirp *slirp; }; -static int guestfwd_can_read(void *opaque) +static size_t guestfwd_can_read(void *opaque) { struct GuestFwd *fwd = opaque; return slirp_socket_can_recv(fwd->slirp, fwd->server, fwd->port); Index: xen-4.5.5-testing/tools/qemu-xen-dir-remote/qtest.c =================================================================== --- xen-4.5.5-testing.orig/tools/qemu-xen-dir-remote/qtest.c +++ xen-4.5.5-testing/tools/qemu-xen-dir-remote/qtest.c @@ -459,7 +459,7 @@ static void qtest_read(void *opaque, con qtest_process_inbuf(chr, inbuf); } -static int qtest_can_read(void *opaque) +static size_t qtest_can_read(void *opaque) { return 1024; }
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor