Merge ~paelzer/ubuntu/+source/qemu:lp-1871830-fix-potential-off-by-one into ubuntu/+source/qemu:ubuntu/focal-devel

[Christian Ehrhardt ]

[Rafael David Tinoco (rafaeldtinoco)]

# checklist for fixes
----------------------------

 [.] changelog entry correct, targeted to correct codename
 [.] update-maintainer has been run previously
 ----
 [-] changes forwarded upstream/debian (if appropriate)
 [.] patches match what was proposed upstream
 ----
 [.] patches correctly included in debian/patches/series?
 [.] patches have correct DEP3 metadata
 ----
 [-] verified dpkg-buildpackage -S and -b
 [.] autopkgtest against PPA or built package passes
 ----
 [-] testcase provided
 [-] was able to reproduce
 [-] fix solved provided testcase

----------------------------
 [.] = ok
 [x] = not ok
 [?] = question
 [!] = note
 [-] = n/a

+1 from me. PPA still building arm binaries.

review: Approve

[Christian Ehrhardt  (paelzer)]

This is superseded by wider changes including riscv and some CVEs.
Thanks, marking this one rejected

Unmerged commits

2b429c5... by Christian Ehrhardt  on 2020-04-09

changelog: avoid a crash if using env QEMU_MODULE_DIR (LP: #1871830)

Signed-off-by: Christian Ehrhardt <email address hidden>

ca4164e... by Christian Ehrhardt  on 2020-04-09

d/p/ubuntu/lp-1871830-fix-potential-off-by-one.patch: avoid a crash if using env QEMU_MODULE_DIR (LP: #1871830)

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 4338791..aaf05b9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+qemu (1:4.2-3ubuntu5) focal; urgency=medium
+
+  * d/p/ubuntu/lp-1871830-fix-potential-off-by-one.patch: avoid a crash if
+    using env QEMU_MODULE_DIR (LP: #1871830)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 09 Apr 2020 13:42:40 +0200
+
 qemu (1:4.2-3ubuntu4) focal; urgency=medium
 
   * d/p/ubuntu/lp-1835546-*: backport the s390x protvirt feature (LP: #1835546)
diff --git a/debian/patches/series b/debian/patches/series
index a2a7a54..5c64305 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -77,3 +77,4 @@ ubuntu/lp-1835546-s390x-protvirt-Move-IO-control-structures-over-SIDA.patch
 ubuntu/lp-1835546-s390x-protvirt-Handle-SIGP-store-status-correctly.patch
 ubuntu/lp-1835546-s390x-Add-unpack-facility-feature-to-GA1.patch
 ubuntu/lp-1835546-s390x-protvirt-Fix-stray-error_report_err.patch
+ubuntu/lp-1871830-fix-potential-off-by-one.patch
diff --git a/debian/patches/ubuntu/lp-1871830-fix-potential-off-by-one.patch b/debian/patches/ubuntu/lp-1871830-fix-potential-off-by-one.patch
new file mode 100644
index 0000000..e261d69
--- /dev/null
+++ b/debian/patches/ubuntu/lp-1871830-fix-potential-off-by-one.patch
@@ -0,0 +1,25 @@
+Description: fix potential grow out of array
+ Since bd83c86 "modules: load modules from versioned /var/run dir"
+ we could exceed the "dirs" array if using CONFIG_MODULE_UPGRADES
+ and at the same time env QEMU_MODULE_DIR.
+ Increase the dirs array in that case to reflect the new max size.
+Forwarded: no
+X-Not-Forwarded-Reason: experiemental for now
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1871830
+Last-Update: 2020-04-09
+--- a/util/module.c
++++ b/util/module.c
+@@ -168,9 +168,11 @@ bool module_load_one(const char *prefix,
+     char *exec_dir;
+ #ifdef CONFIG_MODULE_UPGRADES
+     char *version_dir;
++    char *dirs[5];
++#else
++    char *dirs[4];
+ #endif
+     const char *search_dir;
+-    char *dirs[4];
+     char *module_name;
+     int i = 0, n_dirs = 0;
+     int ret;