)]}'
{
  "commit": "d2ff85854512574e7209f295e87b0835d5b032c6",
  "tree": "9fba823cb661266b430e52912111e8460c1de9d7",
  "parents": [
    "f793d97e454a56d17e404004867985622ca1a63b"
  ],
  "author": {
    "name": "Kevin Wolf",
    "email": "kwolf@redhat.com",
    "time": "Sun Jul 26 23:42:53 2015 -0400"
  },
  "committer": {
    "name": "John Snow",
    "email": "jsnow@redhat.com",
    "time": "Sun Jul 26 23:42:53 2015 -0400"
  },
  "message": "ide: Check array bounds before writing to io_buffer (CVE-2015-5154)\n\nIf the end_transfer_func of a command is called because enough data has\nbeen read or written for the current PIO transfer, and it fails to\ncorrectly call the command completion functions, the DRQ bit in the\nstatus register and s-\u003eend_transfer_func may remain set. This allows the\nguest to access further bytes in s-\u003eio_buffer beyond s-\u003edata_end, and\neventually overflowing the io_buffer.\n\nOne case where this currently happens is emulation of the ATAPI command\nSTART STOP UNIT.\n\nThis patch fixes the problem by adding explicit array bounds checks\nbefore accessing the buffer instead of relying on end_transfer_func to\nfunction correctly.\n\nCc: qemu-stable@nongnu.org\nSigned-off-by: Kevin Wolf \u003ckwolf@redhat.com\u003e\nReviewed-by: John Snow \u003cjsnow@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "122e9550844e643efac758d6a2b01e033cae5bb7",
      "old_mode": 33188,
      "old_path": "hw/ide/core.c",
      "new_id": "44fcc234b2f1306d9e4e8a963b04c54e9fdcc901",
      "new_mode": 33188,
      "new_path": "hw/ide/core.c"
    }
  ]
}