From: Prasad J Pandit Date: Thu, 20 Oct 2016 13:10:24 +0530 Subject: [PATCH] audio: intel-hda: check stream entry count during transfer Intel HDA emulator uses stream of buffers during DMA data transfers. Each entry has buffer length and buffer pointer position, which are used to derive bytes to 'copy'. If this length and buffer pointer were to be same, 'copy' could be set to zero(0), leading to an infinite loop. Add check to avoid it. Reported-by: Huawei PSIRT Signed-off-by: Prasad J Pandit Reviewed-by: Stefan Hajnoczi Message-id: 1476949224-6865-1-git-send-email-ppandit@redhat.com Signed-off-by: Gerd Hoffmann (cherry picked from commit 0c0fc2b5fd534786051889459848764edd798050) --- hw/audio/intel-hda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c index cd95340..537face 100644 --- a/hw/audio/intel-hda.c +++ b/hw/audio/intel-hda.c @@ -416,7 +416,8 @@ static bool intel_hda_xfer(HDACodecDevice *dev, uint32_t stnr, bool output, } left = len; - while (left > 0) { + s = st->bentries; + while (left > 0 && s-- > 0) { copy = left; if (copy > st->bsize - st->lpib) copy = st->bsize - st->lpib;