tree 94c601e5faf63509c6d9f43f98db955566d9033b
parent 9dacf32d2cbd66cbcce7944ebdfd6b2df20e33b8
author Petr Matousek <pmatouse@redhat.com> 1434537971 +0200
committer Paolo Bonzini <pbonzini@redhat.com> 1434549827 +0200

i8254: fix out-of-bounds memory access in pit_ioport_read()

Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

Reported-by: Matt Tait <matttait@google.com>
Fixes: 0505bcdec8228d8de39ab1a02644e71999e7c052
Cc: qemu-stable@nongnu.org
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>