commit 54f3a180a3d0b334c55d0f61d6e9fe5c7c6d42d5
author Peter Maydell <peter.maydell@linaro.org> Thu Dec 04 12:22:46 2014 +0000
committer Peter Maydell <peter.maydell@linaro.org> Thu Dec 04 12:22:46 2014 +0000
tree 161803eaee28497ac0d2e0ee46a6a1116fc87a8b
parent 0d7954c288e91b8a457f15a0a8e8244facf6594b
parent bf25983345ca44aec3dd92c57142be45452bd38a

Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging

cirrus: fix blit region check

# gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-cve-2014-8106-20141204-1:
  cirrus: don't overflow CirrusVGAState->cirrus_bltbuf
  cirrus: fix blit region check

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

VERSION

diff --git a/VERSION b/VERSION
index 9be10bc..9b218e8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.1.93
+2.1.94

hw/scsi/vhost-scsi.c

diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 308b393..dcb2bc5 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -233,6 +233,7 @@
                                vhost_dummy_handle_output);
     if (err != NULL) {
         error_propagate(errp, err);
+        close(vhostfd);
         return;
     }
 

hw/virtio/vhost.c

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 5d7c40a..5a12861 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -817,10 +817,12 @@
     int i, r;
 
     if (vhost_set_backend_type(hdev, backend_type) < 0) {
+        close((uintptr_t)opaque);
         return -1;
     }
 
     if (hdev->vhost_ops->vhost_backend_init(hdev, opaque) < 0) {
+        close((uintptr_t)opaque);
         return -errno;
     }