[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 18/50] char: serial: check divider value against baud
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 18/50] char: serial: check divider value against baud base |
Date: |
Mon, 24 Oct 2016 15:47:03 +0200 |
From: Prasad J Pandit <address@hidden>
16550A UART device uses an oscillator to generate frequencies
(baud base), which decide communication speed. This speed could
be changed by dividing it by a divider. If the divider is
greater than the baud base, speed is set to zero, leading to a
divide by zero error. Add check to avoid it.
Reported-by: Huawei PSIRT <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/char/serial.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 3442f47..eec72b7 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -153,8 +153,9 @@ static void serial_update_parameters(SerialState *s)
int speed, parity, data_bits, stop_bits, frame_size;
QEMUSerialSetParams ssp;
- if (s->divider == 0)
+ if (s->divider == 0 || s->divider > s->baudbase) {
return;
+ }
/* Start bit. */
frame_size = 1;
--
1.8.3.1
- [Qemu-devel] [PULL 09/50] atomic: base mb_read/mb_set on load-acquire and store-release, (continued)
- [Qemu-devel] [PULL 09/50] atomic: base mb_read/mb_set on load-acquire and store-release, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 10/50] qht-bench: relax test_start/stop atomic accesses, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 13/50] tcg: try sti when moving a constant into a dead memory temp, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 14/50] memory: eliminate global MemoryListeners, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 17/50] memory: optimize memory_region_sync_dirty_bitmap, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 15/50] memory: add a per-AddressSpace list of listeners, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 20/50] rng: remove unused included header, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 16/50] memory: optimize memory_global_dirty_log_sync, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 19/50] char.h: misc doc fix, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 21/50] char: remove use-after-free on win-stdio, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 18/50] char: serial: check divider value against baud base,
Paolo Bonzini <=
- [Qemu-devel] [PULL 22/50] ringbuf: fix chr_write return value, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 23/50] sun4uv: fix serial initialization regression, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 28/50] char: introduce CharBackend, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 24/50] malta: replace chr init by CHR_EVENT_OPENED handler, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 25/50] char: remove init callback, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 26/50] xilinx: fix buffer overflow on realize, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 27/50] mux: split mux_chr_update_read_handler(), Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 29/50] char: start converting mux driver to use CharBackend, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 33/50] colo: claim in find_and_check_chardev, Paolo Bonzini, 2016/10/24
- [Qemu-devel] [PULL 32/50] char: rename some frontend functions, Paolo Bonzini, 2016/10/24