Commit 0c0fc2b5 authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Gerd Hoffmann
Browse files

audio: intel-hda: check stream entry count during transfer 



Intel HDA emulator uses stream of buffers during DMA data
transfers. Each entry has buffer length and buffer pointer
position, which are used to derive bytes to 'copy'. If this
length and buffer pointer were to be same, 'copy' could be
set to zero(0), leading to an infinite loop. Add check to
avoid it.

Reported-by: default avatarHuawei PSIRT <psirt@huawei.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent ede0cbeb

hw/audio/intel-hda.c

+2 −1
Original line number Diff line number Diff line
@@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, 
    }



    left = len;

    while (left > 0) {

    s = st->bentries;

    while (left > 0 && s-- > 0) {

        copy = left;

        if (copy > st->bsize - st->lpib)

            copy = st->bsize - st->lpib;