motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 08:13:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

hw/audio/sb16: Restrict I/O sampling rate range for command 41h/42h

Browse source 
The I/O sampling rate range is enforced to 5000 to 45000HZ according to
commit a2cd86a9. Setting I/O sampling rate with command 41h/42h, a guest
user can break this assumption and trigger an assertion in audio_calloc
via command 0xd4. This patch restricts the I/O sampling rate range for
command 41h/42h.

Fixes: 85571bc741 ("audio merge (malc)")
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Message-Id: <1624502687-5214-1-git-send-email-cyruscyliu@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Qiang Liu 2021-06-24 10:44:47 +08:00 • committed by Gerd Hoffmann
parent eb1a35e47a
commit 60e543f5ce
2 changed files with 36 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tests/qtest/fuzz-sb16-test.c
View file

@ -37,6 +37,22 @@ static void test_fuzz_sb16_0x91(void)
qtest_quit(s);
}
/*
* This used to trigger the assert in audio_calloc
* through command 0xd4
*/
static void test_fuzz_sb16_0xd4(void)
{
QTestState *s = qtest_init("-M pc -display none "
"-device sb16,audiodev=none "
"-audiodev id=none,driver=none");
qtest_outb(s, 0x22c, 0x41);
qtest_outb(s, 0x22c, 0x00);
qtest_outb(s, 0x22c, 0x14);
qtest_outb(s, 0x22c, 0xd4);
qtest_quit(s);
}
int main(int argc, char **argv)
{
const char *arch = qtest_get_arch();
@ -46,6 +62,7 @@ int main(int argc, char **argv)
if (strcmp(arch, "i386") == 0) {
qtest_add_func("fuzz/test_fuzz_sb16/1c", test_fuzz_sb16_0x1c);
qtest_add_func("fuzz/test_fuzz_sb16/91", test_fuzz_sb16_0x91);
qtest_add_func("fuzz/test_fuzz_sb16/d4", test_fuzz_sb16_0xd4);
}
return g_test_run();