From 0c0fc2b5fd534786051889459848764edd798050 Mon Sep 17 00:00:00 2001 From: Prasad J Pandit Date: Thu, 20 Oct 2016 13:10:24 +0530 Subject: [PATCH] audio: intel-hda: check stream entry count during transfer Intel HDA emulator uses stream of buffers during DMA data transfers. Each entry has buffer length and buffer pointer position, which are used to derive bytes to 'copy'. If this length and buffer pointer were to be same, 'copy' could be set to zero(0), leading to an infinite loop. Add check to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit Reviewed-by: Stefan Hajnoczi Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann --- hw/audio/intel-hda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340cd9..537face94d 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib;