diff options
Diffstat (limited to 'app-emulation/xen-pvgrub/files/xen-4-CVE-2012-6075-XSA-41.patch')
| -rw-r--r-- | app-emulation/xen-pvgrub/files/xen-4-CVE-2012-6075-XSA-41.patch | 39 |
1 files changed, 0 insertions, 39 deletions
diff --git a/app-emulation/xen-pvgrub/files/xen-4-CVE-2012-6075-XSA-41.patch b/app-emulation/xen-pvgrub/files/xen-4-CVE-2012-6075-XSA-41.patch deleted file mode 100644 index 7513ac3..0000000 --- a/app-emulation/xen-pvgrub/files/xen-4-CVE-2012-6075-XSA-41.patch +++ /dev/null @@ -1,39 +0,0 @@ -authorMichael Contreras <michael@inetric.com> - Mon, 3 Dec 2012 04:11:22 +0000 (20:11 -0800) -committerAnthony Liguori <aliguori@us.ibm.com> - Mon, 3 Dec 2012 14:14:10 +0000 (08:14 -0600) - -The e1000_receive function for the e1000 needs to discard packets longer than -1522 bytes if the SBP and LPE flags are disabled. The linux driver assumes -this behavior and allocates memory based on this assumption. - -Signed-off-by: Michael Contreras <michael@inetric.com> -Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> -hw/e1000.c - ---- tools/qemu-xen/hw/e1000.c -+++ tools/qemu-xen/hw/e1000.c -@@ -59,6 +59,9 @@ static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL); - #define PNPMMIO_SIZE 0x20000 - #define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */ - -+/* this is the size past which hardware will drop packets when setting LPE=0 */ -+#define MAXIMUM_ETHERNET_VLAN_SIZE 1522 -+ - /* - * HW models: - * E1000_DEV_ID_82540EM works with Windows and Linux -@@ -805,6 +808,13 @@ e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size) - size = sizeof(min_buf); - } - -+ /* Discard oversized packets if !LPE and !SBP. */ -+ if (size > MAXIMUM_ETHERNET_VLAN_SIZE -+ && !(s->mac_reg[RCTL] & E1000_RCTL_LPE) -+ && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { -+ return size; -+ } -+ - if (!receive_filter(s, buf, size)) - return size; - |