xin1997/devign_seq2seq

1,source,target20,"static void filter_mirror_setup(NetFilterState *nf, Error **errp) { MirrorState *s = FILTER_MIRROR(nf); Chardev *chr; chr = qemu_chr_find(s->outdev); if (chr == NULL) { error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND, ""Device '%s' not found"", s->outdev); qemu_chr_fe_init(&s->chr_out, chr, errp);","Yes, it is vulnerable."31,"static inline int64_t sub64(const int64_t a, const int64_t b) { return a - b; }","Yes, it is vulnerable."42,"void fw_cfg_add_callback(FWCfgState *s, uint16_t key, FWCfgCallback callback, void *callback_opaque, uint8_t *data, size_t len) { int arch = !!(key & FW_CFG_ARCH_LOCAL); assert(key & FW_CFG_WRITE_CHANNEL); key &= FW_CFG_ENTRY_MASK; assert(key < FW_CFG_MAX_ENTRY && len <= 65535); s->entries[arch][key].data = data; s->entries[arch][key].len = len; s->entries[arch][key].callback_opaque = callback_opaque; s->entries[arch][key].callback = callback; }","Yes, it is vulnerable."53,"static void emulated_push_error(EmulatedState *card, uint64_t code) { EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent)); assert(event); event->p.error.type = EMUL_ERROR; event->p.error.code = code; emulated_push_event(card, event); }","Yes, it is vulnerable."64,"static void do_busid_cmd(ESPState *s, uint8_t *buf, uint8_t busid) { int32_t datalen; int lun; DPRINTF(""do_busid_cmd: busid 0x%x\n"", busid); lun = busid & 7; s->current_req = scsi_req_new(s->current_dev, 0, lun, NULL); datalen = scsi_req_enqueue(s->current_req, buf); s->ti_size = datalen; if (datalen != 0) { s->rregs[ESP_RSTAT] = STAT_TC; s->dma_left = 0; s->dma_counter = 0; if (datalen > 0) { s->rregs[ESP_RSTAT] |= STAT_DI; } else { s->rregs[ESP_RSTAT] |= STAT_DO; } scsi_req_continue(s->current_req); } s->rregs[ESP_RINTR] = INTR_BS | INTR_FC; s->rregs[ESP_RSEQ] = SEQ_CD; esp_raise_irq(s); }","No, it is non-vulnerable."75,"static void rtas_ibm_change_msi(PowerPCCPU *cpu, sPAPRMachineState *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { uint32_t config_addr = rtas_ld(args, 0); uint64_t buid = rtas_ldq(args, 1); unsigned int func = rtas_ld(args, 3); unsigned int req_num = rtas_ld(args, 4); /* 0 == remove all */ unsigned int seq_num = rtas_ld(args, 5); unsigned int ret_intr_type; unsigned int irq, max_irqs = 0, num = 0; sPAPRPHBState *phb = NULL; PCIDevice *pdev = NULL; spapr_pci_msi *msi; int *config_addr_key; switch (func) { case RTAS_CHANGE_MSI_FN: case RTAS_CHANGE_FN: ret_intr_type = RTAS_TYPE_MSI; break; case RTAS_CHANGE_MSIX_FN: ret_intr_type = RTAS_TYPE_MSIX; break; default: error_report(""rtas_ibm_change_msi(%u) is not implemented"", func); rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR); return; } /* Fins sPAPRPHBState */ phb = spapr_pci_find_phb(spapr, buid); if (phb) { pdev = spapr_pci_find_dev(spapr, buid, config_addr); } if (!phb || !pdev) { rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR); return; } /* Releasing MSIs */ if (!req_num) { msi = (spapr_pci_msi *) g_hash_table_lookup(phb->msi, &config_addr); if (!msi) { trace_spapr_pci_msi(""Releasing wrong config"", config_addr); rtas_st(rets, 0, RTAS_OUT_HW_ERROR); return; } xics_free(spapr->icp, msi->first_irq, msi->num); if (msi_present(pdev)) { spapr_msi_setmsg(pdev, 0, false, 0, num); } if (msix_present(pdev)) { spapr_msi_setmsg(pdev, 0, true, 0, num); } g_hash_table_remove(phb->msi, &config_addr); trace_spapr_pci_msi(""Released MSIs"", config_addr); rtas_st(rets, 0, RTAS_OUT_SUCCESS); rtas_st(rets, 1, 0); return; } /* Enabling MSI */ /* Check if the device supports as many IRQs as requested */ if (ret_intr_type == RTAS_TYPE_MSI) { max_irqs = msi_nr_vectors_allocated(pdev); } else if (ret_intr_type == RTAS_TYPE_MSIX) { max_irqs = pdev->msix_entries_nr; } if (!max_irqs) { error_report(""Requested interrupt type %d is not enabled for device %x"", ret_intr_type, config_addr); rtas_st(rets, 0, -1); /* Hardware error */ return; } /* Correct the number if the guest asked for too many */ if (req_num > max_irqs) { trace_spapr_pci_msi_retry(config_addr, req_num, max_irqs); req_num = max_irqs; irq = 0; /* to avoid misleading trace */ goto out; } /* Allocate MSIs */ irq = xics_alloc_block(spapr->icp, 0, req_num, false, ret_intr_type == RTAS_TYPE_MSI); if (!irq) { error_report(""Cannot allocate MSIs for device %x"", config_addr); rtas_st(rets, 0, RTAS_OUT_HW_ERROR); return; } /* Setup MSI/MSIX vectors in the device (via cfgspace or MSIX BAR) */ spapr_msi_setmsg(pdev, SPAPR_PCI_MSI_WINDOW, ret_intr_type == RTAS_TYPE_MSIX, irq, req_num); /* Add MSI device to cache */ msi = g_new(spapr_pci_msi, 1); msi->first_irq = irq; msi->num = req_num; config_addr_key = g_new(int, 1); *config_addr_key = config_addr; g_hash_table_insert(phb->msi, config_addr_key, msi); out: rtas_st(rets, 0, RTAS_OUT_SUCCESS); rtas_st(rets, 1, req_num); rtas_st(rets, 2, ++seq_num); if (nret > 3) { rtas_st(rets, 3, ret_intr_type); } trace_spapr_pci_rtas_ibm_change_msi(config_addr, func, req_num, irq); }","No, it is non-vulnerable."86,"void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...) { va_list va; char buf[256]; char *p; target_ulong addr; uint64_t i64; GDBState *s; s = gdbserver_state; if (!s) return; gdb_current_syscall_cb = cb; s->state = RS_SYSCALL; #ifndef CONFIG_USER_ONLY vm_stop(EXCP_DEBUG); #endif s->state = RS_IDLE; va_start(va, fmt); p = buf; *(p++) = 'F'; while (*fmt) { if (*fmt == '%') { fmt++; switch (*fmt++) { case 'x': addr = va_arg(va, target_ulong); p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr); break; case 'l': if (*(fmt++) != 'x') goto bad_format; i64 = va_arg(va, uint64_t); p += snprintf(p, &buf[sizeof(buf)] - p, ""%"" PRIx64, i64); break; case 's': addr = va_arg(va, target_ulong); p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx ""/%x"", addr, va_arg(va, int)); break; default: bad_format: fprintf(stderr, ""gdbstub: Bad syscall format string '%s'\n"", fmt - 1); break; } } else { *(p++) = *(fmt++); } } *p = 0; va_end(va); put_packet(s, buf); #ifdef CONFIG_USER_ONLY gdb_handlesig(s->c_cpu, 0); #else cpu_interrupt(s->c_cpu, CPU_INTERRUPT_EXIT); #endif }","No, it is non-vulnerable."97,"static void gen_cp0 (CPUState *env, DisasContext *ctx, uint32_t opc, int rt, int rd) { const char *opn = ""ldst""; switch (opc) { case OPC_MFC0: if (rt == 0) { /* Treat as NOP */ return; } gen_mfc0(ctx, rd, ctx->opcode & 0x7); gen_op_store_T0_gpr(rt); opn = ""mfc0""; break; case OPC_MTC0: GEN_LOAD_REG_TN(T0, rt); gen_mtc0(ctx, rd, ctx->opcode & 0x7); opn = ""mtc0""; break; #ifdef TARGET_MIPS64 case OPC_DMFC0: if (rt == 0) { /* Treat as NOP */ return; } gen_dmfc0(ctx, rd, ctx->opcode & 0x7); gen_op_store_T0_gpr(rt); opn = ""dmfc0""; break; case OPC_DMTC0: GEN_LOAD_REG_TN(T0, rt); gen_dmtc0(ctx, rd, ctx->opcode & 0x7); opn = ""dmtc0""; break; #endif case OPC_TLBWI: opn = ""tlbwi""; if (!env->do_tlbwi) goto die; gen_op_tlbwi(); break; case OPC_TLBWR: opn = ""tlbwr""; if (!env->do_tlbwr) goto die; gen_op_tlbwr(); break; case OPC_TLBP: opn = ""tlbp""; if (!env->do_tlbp) goto die; gen_op_tlbp(); break; case OPC_TLBR: opn = ""tlbr""; if (!env->do_tlbr) goto die; gen_op_tlbr(); break; case OPC_ERET: opn = ""eret""; save_cpu_state(ctx, 0); gen_op_eret(); ctx->bstate = BS_EXCP; break; case OPC_DERET: opn = ""deret""; if (!(ctx->hflags & MIPS_HFLAG_DM)) { MIPS_INVAL(opn); generate_exception(ctx, EXCP_RI); } else { save_cpu_state(ctx, 0); gen_op_deret(); ctx->bstate = BS_EXCP; } break; case OPC_WAIT: opn = ""wait""; /* If we get an exception, we want to restart at next instruction */ ctx->pc += 4; save_cpu_state(ctx, 1); ctx->pc -= 4; gen_op_wait(); ctx->bstate = BS_EXCP; break; default: die: MIPS_INVAL(opn); generate_exception(ctx, EXCP_RI); return; } MIPS_DEBUG(""%s %s %d"", opn, regnames[rt], rd); }","No, it is non-vulnerable."108,"static void tricore_cpu_initfn(Object *obj) { CPUState *cs = CPU(obj); TriCoreCPU *cpu = TRICORE_CPU(obj); CPUTriCoreState *env = &cpu->env; cs->env_ptr = env; cpu_exec_init(cs, &error_abort); if (tcg_enabled()) { tricore_tcg_init(); } }","Yes, it is vulnerable."119,"static int mxf_read_content_storage(MXFContext *mxf, ByteIOContext *pb, int tag) { switch (tag) { case 0x1901: mxf->packages_count = get_be32(pb); if (mxf->packages_count >= UINT_MAX / sizeof(UID)) return -1; mxf->packages_refs = av_malloc(mxf->packages_count * sizeof(UID)); if (!mxf->packages_refs) return -1; url_fskip(pb, 4); /* useless size of objects, always 16 according to specs */ get_buffer(pb, (uint8_t *)mxf->packages_refs, mxf->packages_count * sizeof(UID)); break; } return 0; }","Yes, it is vulnerable."1210,"int av_reallocp_array(void *ptr, size_t nmemb, size_t size) { void **ptrptr = ptr; void *ret; if (size <= 0 || nmemb >= INT_MAX / size) return AVERROR(ENOMEM); if (nmemb <= 0) { av_freep(ptr); return 0; } ret = av_realloc(*ptrptr, nmemb * size); if (!ret) { av_freep(ptr); return AVERROR(ENOMEM); } *ptrptr = ret; return 0; }","No, it is non-vulnerable."1311,"void ff_put_h264_qpel16_mc31_msa(uint8_t *dst, const uint8_t *src, ptrdiff_t stride) { avc_luma_hv_qrt_16w_msa(src - 2, src - (stride * 2) + sizeof(uint8_t), stride, dst, stride, 16); }","No, it is non-vulnerable."1412,"struct vhost_net *vhost_net_init(VLANClientState *backend, int devfd, bool force) { return NULL; }","Yes, it is vulnerable."1513,"static int bit8x8_c(MpegEncContext *s, uint8_t *src1, uint8_t *src2, ptrdiff_t stride, int h) { const uint8_t *scantable = s->intra_scantable.permutated; LOCAL_ALIGNED_16(int16_t, temp, [64]); int i, last, run, bits, level, start_i; const int esc_length = s->ac_esc_length; uint8_t *length, *last_length; av_assert2(h == 8); s->pdsp.diff_pixels(temp, src1, src2, stride); s->block_last_index[0 /* FIXME */] = last = s->fast_dct_quantize(s, temp, 0 /* FIXME */, s->qscale, &i); bits = 0; if (s->mb_intra) { start_i = 1; length = s->intra_ac_vlc_length; last_length = s->intra_ac_vlc_last_length; bits += s->luma_dc_vlc_length[temp[0] + 256]; // FIXME: chroma } else { start_i = 0; length = s->inter_ac_vlc_length; last_length = s->inter_ac_vlc_last_length; } if (last >= start_i) { run = 0; for (i = start_i; i < last; i++) { int j = scantable[i]; level = temp[j]; if (level) { level += 64; if ((level & (~127)) == 0) bits += length[UNI_AC_ENC_INDEX(run, level)]; else bits += esc_length; run = 0; } else run++; } i = scantable[last]; level = temp[i] + 64; av_assert2(level - 64); if ((level & (~127)) == 0) bits += last_length[UNI_AC_ENC_INDEX(run, level)]; else bits += esc_length; } return bits; }","Yes, it is vulnerable."1614,"static void ehci_mem_writew(void *ptr, target_phys_addr_t addr, uint32_t val) { fprintf(stderr, ""EHCI doesn't handle 16-bit writes to MMIO\n""); exit(1); }","Yes, it is vulnerable."1715,"static void xendev_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->props = xendev_properties; set_bit(DEVICE_CATEGORY_MISC, dc->categories); }","Yes, it is vulnerable."1816,static uint64_t qdev_get_prop_mask64(Property *prop) { assert(prop->info == &qdev_prop_bit); return 0x1 << prop->bitnr; },"Yes, it is vulnerable."1917,"static int create_ppc_opcodes (CPUPPCState *env, ppc_def_t *def) { opcode_t *opc, *start, *end; fill_new_table(env->opcodes, 0x40); #if defined(PPC_DUMP_CPU) printf(""* PowerPC instructions for PVR %08x: %s flags %016"" PRIx64 "" %08x\n"", def->pvr, def->name, def->insns_flags, def->flags); #endif if (&opc_start < &opc_end) { start = &opc_start; end = &opc_end; } else { start = &opc_end; end = &opc_start; } for (opc = start + 1; opc != end; opc++) { if ((opc->handler.type & def->insns_flags) != 0) { if (register_insn(env->opcodes, opc) < 0) { printf(""*** ERROR initializing PowerPC instruction "" ""0x%02x 0x%02x 0x%02x\n"", opc->opc1, opc->opc2, opc->opc3); return -1; } #if defined(PPC_DUMP_CPU) if (opc1 != 0x00) { if (opc->opc3 == 0xFF) { if (opc->opc2 == 0xFF) { printf("" %02x -- -- (%2d ----) : %s\n"", opc->opc1, opc->opc1, opc->oname); } else { printf("" %02x %02x -- (%2d %4d) : %s\n"", opc->opc1, opc->opc2, opc->opc1, opc->opc2, opc->oname); } } else { printf("" %02x %02x %02x (%2d %4d) : %s\n"", opc->opc1, opc->opc2, opc->opc3, opc->opc1, (opc->opc3 << 5) | opc->opc2, opc->oname); } } #endif } } fix_opcode_tables(env->opcodes); fflush(stdout); fflush(stderr); return 0; }","No, it is non-vulnerable."2018,"static void smp_parse(const char *optarg) { int smp, sockets = 0, threads = 0, cores = 0; char *endptr; char option[128]; smp = strtoul(optarg, &endptr, 10); if (endptr != optarg) { if (*endptr == ',') { endptr++; } } if (get_param_value(option, 128, ""sockets"", endptr) != 0) sockets = strtoull(option, NULL, 10); if (get_param_value(option, 128, ""cores"", endptr) != 0) cores = strtoull(option, NULL, 10); if (get_param_value(option, 128, ""threads"", endptr) != 0) threads = strtoull(option, NULL, 10); if (get_param_value(option, 128, ""maxcpus"", endptr) != 0) max_cpus = strtoull(option, NULL, 10); /* compute missing values, prefer sockets over cores over threads */ if (smp == 0 || sockets == 0) { sockets = sockets > 0 ? sockets : 1; cores = cores > 0 ? cores : 1; threads = threads > 0 ? threads : 1; if (smp == 0) { smp = cores * threads * sockets; } } else { if (cores == 0) { threads = threads > 0 ? threads : 1; cores = smp / (sockets * threads); } else { threads = smp / (cores * sockets); } } smp_cpus = smp; smp_cores = cores > 0 ? cores : 1; smp_threads = threads > 0 ? threads : 1; if (max_cpus == 0) max_cpus = smp_cpus; }","No, it is non-vulnerable."2119,"static inline void mix_2f_1r_to_dolby(AC3DecodeContext *ctx) { int i; float (*output)[256] = ctx->audio_block.block_output; for (i = 0; i < 256; i++) { output[1][i] -= output[3][i]; output[2][i] += output[3][i]; } memset(output[3], 0, sizeof(output[3])); }","No, it is non-vulnerable."2220,"static int config_props(AVFilterLink *outlink) { AVFilterContext *ctx = outlink->src; AVFilterLink *inlink = outlink->src->inputs[0]; ScaleContext *scale = ctx->priv; int64_t w, h; if (!(w = scale->w)) w = inlink->w; if (!(h = scale->h)) h = inlink->h; if (w == -1) w = av_rescale(h, inlink->w, inlink->h); if (h == -1) h = av_rescale(w, inlink->h, inlink->w); if (w > INT_MAX || h > INT_MAX || (h * inlink->w) > INT_MAX || (w * inlink->h) > INT_MAX) av_log(ctx, AV_LOG_ERROR, ""Rescaled value for width or height is too big.\n""); outlink->w = w; outlink->h = h; /* TODO: make algorithm configurable */ scale->sws = sws_getContext(inlink ->w, inlink ->h, inlink ->format, outlink->w, outlink->h, outlink->format, SWS_BILINEAR, NULL, NULL, NULL); av_log(ctx, AV_LOG_INFO, ""w:%d h:%d fmt:%s\n"", outlink->w, outlink->h, av_pix_fmt_descriptors[outlink->format].name); scale->input_is_pal = inlink->format == PIX_FMT_PAL8 || inlink->format == PIX_FMT_BGR4_BYTE || inlink->format == PIX_FMT_RGB4_BYTE || inlink->format == PIX_FMT_BGR8 || inlink->format == PIX_FMT_RGB8; return !scale->sws; }","No, it is non-vulnerable."2321,"static uint64_t omap_pwt_read(void *opaque, target_phys_addr_t addr, unsigned size) { struct omap_pwt_s *s = (struct omap_pwt_s *) opaque; int offset = addr & OMAP_MPUI_REG_MASK; if (size != 1) { return omap_badwidth_read8(opaque, addr); } switch (offset) { case 0x00: /* FRC */ return s->frc; case 0x04: /* VCR */ return s->vrc; case 0x08: /* GCR */ return s->gcr; } OMAP_BAD_REG(addr); return 0; }","No, it is non-vulnerable."2422,"uint32_t lduw_be_phys(target_phys_addr_t addr) { return lduw_phys_internal(addr, DEVICE_BIG_ENDIAN); }","No, it is non-vulnerable."2523,static int find_stream_index(AVFormatContext *s) { int i; AVStream *st; if (s->nb_streams <= 0) return -1; for(i = 0; i < s->nb_streams; i++) { st = s->streams[i]; if (st->codec.codec_type == CODEC_TYPE_VIDEO) { return i; } } return 0; },"No, it is non-vulnerable."2624,"gen_intermediate_code_internal(MIPSCPU *cpu, TranslationBlock *tb, bool search_pc) { CPUState *cs = CPU(cpu); CPUMIPSState *env = &cpu->env; DisasContext ctx; target_ulong pc_start; uint16_t *gen_opc_end; CPUBreakpoint *bp; int j, lj = -1; int num_insns; int max_insns; int insn_bytes; int is_branch; if (search_pc) qemu_log(""search pc %d\n"", search_pc); pc_start = tb->pc; gen_opc_end = tcg_ctx.gen_opc_buf + OPC_MAX_SIZE; ctx.pc = pc_start; ctx.saved_pc = -1; ctx.singlestep_enabled = cs->singlestep_enabled; ctx.insn_flags = env->insn_flags; ctx.tb = tb; ctx.bstate = BS_NONE; /* Restore delay slot state from the tb context. */ ctx.hflags = (uint32_t)tb->flags; /* FIXME: maybe use 64 bits here? */ restore_cpu_state(env, &ctx); #ifdef CONFIG_USER_ONLY ctx.mem_idx = MIPS_HFLAG_UM; #else ctx.mem_idx = ctx.hflags & MIPS_HFLAG_KSU; #endif num_insns = 0; max_insns = tb->cflags & CF_COUNT_MASK; if (max_insns == 0) max_insns = CF_COUNT_MASK; LOG_DISAS(""\ntb %p idx %d hflags %04x\n"", tb, ctx.mem_idx, ctx.hflags); gen_tb_start(); while (ctx.bstate == BS_NONE) { if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) { QTAILQ_FOREACH(bp, &env->breakpoints, entry) { if (bp->pc == ctx.pc) { save_cpu_state(&ctx, 1); ctx.bstate = BS_BRANCH; gen_helper_0e0i(raise_exception, EXCP_DEBUG); /* Include the breakpoint location or the tb won't * be flushed when it must be. */ ctx.pc += 4; goto done_generating; } } } if (search_pc) { j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf; if (lj < j) { lj++; while (lj < j) tcg_ctx.gen_opc_instr_start[lj++] = 0; } tcg_ctx.gen_opc_pc[lj] = ctx.pc; gen_opc_hflags[lj] = ctx.hflags & MIPS_HFLAG_BMASK; gen_opc_btarget[lj] = ctx.btarget; tcg_ctx.gen_opc_instr_start[lj] = 1; tcg_ctx.gen_opc_icount[lj] = num_insns; } if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO)) gen_io_start(); is_branch = 0; if (!(ctx.hflags & MIPS_HFLAG_M16)) { ctx.opcode = cpu_ldl_code(env, ctx.pc); insn_bytes = 4; decode_opc(env, &ctx, &is_branch); } else if (ctx.insn_flags & ASE_MICROMIPS) { ctx.opcode = cpu_lduw_code(env, ctx.pc); insn_bytes = decode_micromips_opc(env, &ctx, &is_branch); } else if (ctx.insn_flags & ASE_MIPS16) { ctx.opcode = cpu_lduw_code(env, ctx.pc); insn_bytes = decode_mips16_opc(env, &ctx, &is_branch); } else { generate_exception(&ctx, EXCP_RI); ctx.bstate = BS_STOP; break; } if (!is_branch) { handle_delay_slot(&ctx, insn_bytes); } ctx.pc += insn_bytes; num_insns++; /* Execute a branch and its delay slot as a single instruction. This is what GDB expects and is consistent with what the hardware does (e.g. if a delay slot instruction faults, the reported PC is the PC of the branch). */ if (cs->singlestep_enabled && (ctx.hflags & MIPS_HFLAG_BMASK) == 0) { break; } if ((ctx.pc & (TARGET_PAGE_SIZE - 1)) == 0) break; if (tcg_ctx.gen_opc_ptr >= gen_opc_end) { break; } if (num_insns >= max_insns) break; if (singlestep) break; } if (tb->cflags & CF_LAST_IO) { gen_io_end(); } if (cs->singlestep_enabled && ctx.bstate != BS_BRANCH) { save_cpu_state(&ctx, ctx.bstate == BS_NONE); gen_helper_0e0i(raise_exception, EXCP_DEBUG); } else { switch (ctx.bstate) { case BS_STOP: gen_goto_tb(&ctx, 0, ctx.pc); break; case BS_NONE: save_cpu_state(&ctx, 0); gen_goto_tb(&ctx, 0, ctx.pc); break; case BS_EXCP: tcg_gen_exit_tb(0); break; case BS_BRANCH: default: break; } } done_generating: gen_tb_end(tb, num_insns); *tcg_ctx.gen_opc_ptr = INDEX_op_end; if (search_pc) { j = tcg_ctx.gen_opc_ptr - tcg_ctx.gen_opc_buf; lj++; while (lj <= j) tcg_ctx.gen_opc_instr_start[lj++] = 0; } else { tb->size = ctx.pc - pc_start; tb->icount = num_insns; } #ifdef DEBUG_DISAS LOG_DISAS(""\n""); if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) { qemu_log(""IN: %s\n"", lookup_symbol(pc_start)); log_target_disas(env, pc_start, ctx.pc - pc_start, 0); qemu_log(""\n""); } #endif }","Yes, it is vulnerable."2725,"static void parse_type_bool(Visitor *v, const char *name, bool *obj, Error **errp) { StringInputVisitor *siv = to_siv(v); if (siv->string) { if (!strcasecmp(siv->string, ""on"") || !strcasecmp(siv->string, ""yes"") || !strcasecmp(siv->string, ""true"")) { *obj = true; return; } if (!strcasecmp(siv->string, ""off"") || !strcasecmp(siv->string, ""no"") || !strcasecmp(siv->string, ""false"")) { *obj = false; return; } } error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : ""null"", ""boolean""); }","Yes, it is vulnerable."2826,"void ff_rtsp_undo_setup(AVFormatContext *s) { RTSPState *rt = s->priv_data; int i; for (i = 0; i < rt->nb_rtsp_streams; i++) { RTSPStream *rtsp_st = rt->rtsp_streams[i]; if (!rtsp_st) continue; if (rtsp_st->transport_priv) { if (s->oformat) { AVFormatContext *rtpctx = rtsp_st->transport_priv; av_write_trailer(rtpctx); if (rt->lower_transport == RTSP_LOWER_TRANSPORT_TCP) { uint8_t *ptr; url_close_dyn_buf(rtpctx->pb, &ptr); av_free(ptr); } else { url_fclose(rtpctx->pb); } av_metadata_free(&rtpctx->streams[0]->metadata); av_metadata_free(&rtpctx->metadata); av_free(rtpctx->streams[0]); av_free(rtpctx); } else if (rt->transport == RTSP_TRANSPORT_RDT && CONFIG_RTPDEC) ff_rdt_parse_close(rtsp_st->transport_priv); else if (CONFIG_RTPDEC) rtp_parse_close(rtsp_st->transport_priv); } rtsp_st->transport_priv = NULL; if (rtsp_st->rtp_handle) url_close(rtsp_st->rtp_handle); rtsp_st->rtp_handle = NULL; } }","Yes, it is vulnerable."2927,"static void musb_rx_req(MUSBState *s, int epnum) { MUSBEndPoint *ep = s->ep + epnum; int total; /* If we already have a packet, which didn't fit into the * 64 bytes of the FIFO, only move the FIFO start and return. (Obsolete) */ if (ep->packey[1].p.pid == USB_TOKEN_IN && ep->status[1] >= 0 && (ep->fifostart[1]) + ep->rxcount < ep->packey[1].p.len) { TRACE(""0x%08x, %d"", ep->fifostart[1], ep->rxcount ); ep->fifostart[1] += ep->rxcount; ep->fifolen[1] = 0; ep->rxcount = MIN(ep->packey[0].p.len - (ep->fifostart[1]), ep->maxp[1]); ep->csr[1] &= ~MGC_M_RXCSR_H_REQPKT; if (!epnum) ep->csr[0] &= ~MGC_M_CSR0_H_REQPKT; /* Clear all of the error bits first */ ep->csr[1] &= ~(MGC_M_RXCSR_H_ERROR | MGC_M_RXCSR_H_RXSTALL | MGC_M_RXCSR_DATAERROR); if (!epnum) ep->csr[0] &= ~(MGC_M_CSR0_H_ERROR | MGC_M_CSR0_H_RXSTALL | MGC_M_CSR0_H_NAKTIMEOUT | MGC_M_CSR0_H_NO_PING); ep->csr[1] |= MGC_M_RXCSR_FIFOFULL | MGC_M_RXCSR_RXPKTRDY; if (!epnum) ep->csr[0] |= MGC_M_CSR0_RXPKTRDY; musb_rx_intr_set(s, epnum, 1); return; } /* The driver sets maxp[1] to 64 or less because it knows the hardware * FIFO is this deep. Bigger packets get split in * usb_generic_handle_packet but we can also do the splitting locally * for performance. It turns out we can also have a bigger FIFO and * ignore the limit set in ep->maxp[1]. The Linux MUSB driver deals * OK with single packets of even 32KB and we avoid splitting, however * usb_msd.c sometimes sends a packet bigger than what Linux expects * (e.g. 8192 bytes instead of 4096) and we get an OVERRUN. Splitting * hides this overrun from Linux. Up to 4096 everything is fine * though. Currently this is disabled. * * XXX: mind ep->fifosize. */ total = MIN(ep->maxp[1] & 0x3ff, sizeof(s->buf)); #ifdef SETUPLEN_HACK /* Why should *we* do that instead of Linux? */ if (!epnum) { if (ep->packey[0].p.devaddr == 2) { total = MIN(s->setup_len, 8); } else { total = MIN(s->setup_len, 64); } s->setup_len -= total; } #endif return musb_packet(s, ep, epnum, USB_TOKEN_IN, total, musb_rx_packet_complete, 1); }","Yes, it is vulnerable."3028,"static uint64_t sp804_read(void *opaque, target_phys_addr_t offset, unsigned size) { sp804_state *s = (sp804_state *)opaque; if (offset < 0x20) { return arm_timer_read(s->timer[0], offset); } if (offset < 0x40) { return arm_timer_read(s->timer[1], offset - 0x20); } /* TimerPeriphID */ if (offset >= 0xfe0 && offset <= 0xffc) { return sp804_ids[(offset - 0xfe0) >> 2]; } switch (offset) { /* Integration Test control registers, which we won't support */ case 0xf00: /* TimerITCR */ case 0xf04: /* TimerITOP (strictly write only but..) */ return 0; } hw_error(""%s: Bad offset %x\n"", __func__, (int)offset); return 0; }","No, it is non-vulnerable."3129,static void timerlist_rearm(QEMUTimerList *timer_list) { /* Interrupt execution to force deadline recalculation. */ if (timer_list->clock->type == QEMU_CLOCK_VIRTUAL) { qemu_start_warp_timer(); } timerlist_notify(timer_list); },"No, it is non-vulnerable."3230,"CharDriverState *text_console_init(DisplayState *ds, const char *p) { CharDriverState *chr; TextConsole *s; unsigned width; unsigned height; static int color_inited; chr = qemu_mallocz(sizeof(CharDriverState)); if (!chr) return NULL; s = new_console(ds, TEXT_CONSOLE); if (!s) { free(chr); return NULL; } if (!p) p = DEFAULT_MONITOR_SIZE; chr->opaque = s; chr->chr_write = console_puts; chr->chr_send_event = console_send_event; s->chr = chr; s->out_fifo.buf = s->out_fifo_buf; s->out_fifo.buf_size = sizeof(s->out_fifo_buf); s->kbd_timer = qemu_new_timer(rt_clock, kbd_send_chars, s); if (!color_inited) { color_inited = 1; console_color_init(s->ds); } s->y_displayed = 0; s->y_base = 0; s->total_height = DEFAULT_BACKSCROLL; s->x = 0; s->y = 0; width = s->ds->width; height = s->ds->height; if (p != 0) { width = strtoul(p, (char **)&p, 10); if (*p == 'C') { p++; width *= FONT_WIDTH; } if (*p == 'x') { p++; height = strtoul(p, (char **)&p, 10); if (*p == 'C') { p++; height *= FONT_HEIGHT; } } } s->g_width = width; s->g_height = height; s->hw_invalidate = text_console_invalidate; s->hw_text_update = text_console_update; s->hw = s; /* Set text attribute defaults */ s->t_attrib_default.bold = 0; s->t_attrib_default.uline = 0; s->t_attrib_default.blink = 0; s->t_attrib_default.invers = 0; s->t_attrib_default.unvisible = 0; s->t_attrib_default.fgcol = COLOR_WHITE; s->t_attrib_default.bgcol = COLOR_BLACK; /* set current text attributes to default */ s->t_attrib = s->t_attrib_default; text_console_resize(s); qemu_chr_reset(chr); return chr; }","No, it is non-vulnerable."3331,"static void tcg_liveness_analysis(TCGContext *s) { uint8_t *dead_temps, *mem_temps; int oi, oi_prev, nb_ops; nb_ops = s->gen_next_op_idx; s->op_dead_args = tcg_malloc(nb_ops * sizeof(uint16_t)); s->op_sync_args = tcg_malloc(nb_ops * sizeof(uint8_t)); dead_temps = tcg_malloc(s->nb_temps); mem_temps = tcg_malloc(s->nb_temps); tcg_la_func_end(s, dead_temps, mem_temps); for (oi = s->gen_last_op_idx; oi >= 0; oi = oi_prev) { int i, nb_iargs, nb_oargs; TCGOpcode opc_new, opc_new2; bool have_opc_new2; uint16_t dead_args; uint8_t sync_args; TCGArg arg; TCGOp * const op = &s->gen_op_buf[oi]; TCGArg * const args = &s->gen_opparam_buf[op->args]; TCGOpcode opc = op->opc; const TCGOpDef *def = &tcg_op_defs[opc]; oi_prev = op->prev; switch (opc) { case INDEX_op_call: { int call_flags; nb_oargs = op->callo; nb_iargs = op->calli; call_flags = args[nb_oargs + nb_iargs + 1]; /* pure functions can be removed if their result is unused */ if (call_flags & TCG_CALL_NO_SIDE_EFFECTS) { for (i = 0; i < nb_oargs; i++) { arg = args[i]; if (!dead_temps[arg] || mem_temps[arg]) { goto do_not_remove_call; } } goto do_remove; } else { do_not_remove_call: /* output args are dead */ dead_args = 0; sync_args = 0; for (i = 0; i < nb_oargs; i++) { arg = args[i]; if (dead_temps[arg]) { dead_args |= (1 << i); } if (mem_temps[arg]) { sync_args |= (1 << i); } dead_temps[arg] = 1; mem_temps[arg] = 0; } if (!(call_flags & TCG_CALL_NO_READ_GLOBALS)) { /* globals should be synced to memory */ memset(mem_temps, 1, s->nb_globals); } if (!(call_flags & (TCG_CALL_NO_WRITE_GLOBALS | TCG_CALL_NO_READ_GLOBALS))) { /* globals should go back to memory */ memset(dead_temps, 1, s->nb_globals); } /* input args are live */ for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) { arg = args[i]; if (arg != TCG_CALL_DUMMY_ARG) { if (dead_temps[arg]) { dead_args |= (1 << i); } dead_temps[arg] = 0; } } s->op_dead_args[oi] = dead_args; s->op_sync_args[oi] = sync_args; } } break; case INDEX_op_debug_insn_start: break; case INDEX_op_discard: /* mark the temporary as dead */ dead_temps[args[0]] = 1; mem_temps[args[0]] = 0; break; case INDEX_op_add2_i32: opc_new = INDEX_op_add_i32; goto do_addsub2; case INDEX_op_sub2_i32: opc_new = INDEX_op_sub_i32; goto do_addsub2; case INDEX_op_add2_i64: opc_new = INDEX_op_add_i64; goto do_addsub2; case INDEX_op_sub2_i64: opc_new = INDEX_op_sub_i64; do_addsub2: nb_iargs = 4; nb_oargs = 2; /* Test if the high part of the operation is dead, but not the low part. The result can be optimized to a simple add or sub. This happens often for x86_64 guest when the cpu mode is set to 32 bit. */ if (dead_temps[args[1]] && !mem_temps[args[1]]) { if (dead_temps[args[0]] && !mem_temps[args[0]]) { goto do_remove; } /* Replace the opcode and adjust the args in place, leaving 3 unused args at the end. */ op->opc = opc = opc_new; args[1] = args[2]; args[2] = args[4]; /* Fall through and mark the single-word operation live. */ nb_iargs = 2; nb_oargs = 1; } goto do_not_remove; case INDEX_op_mulu2_i32: opc_new = INDEX_op_mul_i32; opc_new2 = INDEX_op_muluh_i32; have_opc_new2 = TCG_TARGET_HAS_muluh_i32; goto do_mul2; case INDEX_op_muls2_i32: opc_new = INDEX_op_mul_i32; opc_new2 = INDEX_op_mulsh_i32; have_opc_new2 = TCG_TARGET_HAS_mulsh_i32; goto do_mul2; case INDEX_op_mulu2_i64: opc_new = INDEX_op_mul_i64; opc_new2 = INDEX_op_muluh_i64; have_opc_new2 = TCG_TARGET_HAS_muluh_i64; goto do_mul2; case INDEX_op_muls2_i64: opc_new = INDEX_op_mul_i64; opc_new2 = INDEX_op_mulsh_i64; have_opc_new2 = TCG_TARGET_HAS_mulsh_i64; goto do_mul2; do_mul2: nb_iargs = 2; nb_oargs = 2; if (dead_temps[args[1]] && !mem_temps[args[1]]) { if (dead_temps[args[0]] && !mem_temps[args[0]]) { /* Both parts of the operation are dead. */ goto do_remove; } /* The high part of the operation is dead; generate the low. */ op->opc = opc = opc_new; args[1] = args[2]; args[2] = args[3]; } else if (have_opc_new2 && dead_temps[args[0]] && !mem_temps[args[0]]) { /* The low part of the operation is dead; generate the high. */ op->opc = opc = opc_new2; args[0] = args[1]; args[1] = args[2]; args[2] = args[3]; } else { goto do_not_remove; } /* Mark the single-word operation live. */ nb_oargs = 1; goto do_not_remove; default: /* XXX: optimize by hardcoding common cases (e.g. triadic ops) */ nb_iargs = def->nb_iargs; nb_oargs = def->nb_oargs; /* Test if the operation can be removed because all its outputs are dead. We assume that nb_oargs == 0 implies side effects */ if (!(def->flags & TCG_OPF_SIDE_EFFECTS) && nb_oargs != 0) { for (i = 0; i < nb_oargs; i++) { arg = args[i]; if (!dead_temps[arg] || mem_temps[arg]) { goto do_not_remove; } } do_remove: tcg_op_remove(s, op); } else { do_not_remove: /* output args are dead */ dead_args = 0; sync_args = 0; for (i = 0; i < nb_oargs; i++) { arg = args[i]; if (dead_temps[arg]) { dead_args |= (1 << i); } if (mem_temps[arg]) { sync_args |= (1 << i); } dead_temps[arg] = 1; mem_temps[arg] = 0; } /* if end of basic block, update */ if (def->flags & TCG_OPF_BB_END) { tcg_la_bb_end(s, dead_temps, mem_temps); } else if (def->flags & TCG_OPF_SIDE_EFFECTS) { /* globals should be synced to memory */ memset(mem_temps, 1, s->nb_globals); } /* input args are live */ for (i = nb_oargs; i < nb_oargs + nb_iargs; i++) { arg = args[i]; if (dead_temps[arg]) { dead_args |= (1 << i); } dead_temps[arg] = 0; } s->op_dead_args[oi] = dead_args; s->op_sync_args[oi] = sync_args; } break; } } }","No, it is non-vulnerable."3432,"bool error_is_type(Error *err, const char *fmt) { const char *error_class; char *ptr; char *end; if (!err) { return false; } ptr = strstr(fmt, ""'class': '""); assert(ptr != NULL); ptr += strlen(""'class': '""); end = strchr(ptr, '\''); assert(end != NULL); error_class = error_get_field(err, ""class""); if (strlen(error_class) != end - ptr) { return false; } return strncmp(ptr, error_class, end - ptr) == 0; }","No, it is non-vulnerable."3533,"static inline int onenand_load_main(OneNANDState *s, int sec, int secn, void *dest) { if (s->bdrv_cur) return bdrv_read(s->bdrv_cur, sec, dest, secn) < 0; else if (sec + secn > s->secs_cur) return 1; memcpy(dest, s->current + (sec << 9), secn << 9); return 0; }","No, it is non-vulnerable."3634,"static void generate_offset_lut(DiracGolombLUT *lut, int off) { int idx; for (idx = 0; idx < LUT_SIZE; idx++) { DiracGolombLUT *l = &lut[idx]; INIT_RESIDUE(res); SET_RESIDUE(res, idx, LUT_BITS); l->preamble = CONVERT_TO_RESIDUE(res >> (RSIZE_BITS - off), off); l->preamble_bits = off; l->sign = ((l->preamble >> (RSIZE_BITS - l->preamble_bits)) & 1) ? -1 : +1; search_for_golomb(l, res << off, LUT_BITS - off); } }","Yes, it is vulnerable."3735,"vmxnet3_pop_next_tx_descr(VMXNET3State *s, int qidx, struct Vmxnet3_TxDesc *txd, uint32_t *descr_idx) { Vmxnet3Ring *ring = &s->txq_descr[qidx].tx_ring; PCIDevice *d = PCI_DEVICE(s); vmxnet3_ring_read_curr_cell(d, ring, txd); if (txd->gen == vmxnet3_ring_curr_gen(ring)) { /* Only read after generation field verification */ smp_rmb(); /* Re-read to be sure we got the latest version */ vmxnet3_ring_read_curr_cell(d, ring, txd); VMXNET3_RING_DUMP(VMW_RIPRN, ""TX"", qidx, ring); *descr_idx = vmxnet3_ring_curr_cell_idx(ring); vmxnet3_inc_tx_consumption_counter(s, qidx); return true; } return false; }","Yes, it is vulnerable."3836,static void init_excp_BookE (CPUPPCState *env) { #if !defined(CONFIG_USER_ONLY) env->excp_vectors[POWERPC_EXCP_CRITICAL] = 0x00000000; env->excp_vectors[POWERPC_EXCP_MCHECK] = 0x00000000; env->excp_vectors[POWERPC_EXCP_DSI] = 0x00000000; env->excp_vectors[POWERPC_EXCP_ISI] = 0x00000000; env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x00000000; env->excp_vectors[POWERPC_EXCP_ALIGN] = 0x00000000; env->excp_vectors[POWERPC_EXCP_PROGRAM] = 0x00000000; env->excp_vectors[POWERPC_EXCP_FPU] = 0x00000000; env->excp_vectors[POWERPC_EXCP_SYSCALL] = 0x00000000; env->excp_vectors[POWERPC_EXCP_APU] = 0x00000000; env->excp_vectors[POWERPC_EXCP_DECR] = 0x00000000; env->excp_vectors[POWERPC_EXCP_FIT] = 0x00000000; env->excp_vectors[POWERPC_EXCP_WDT] = 0x00000000; env->excp_vectors[POWERPC_EXCP_DTLB] = 0x00000000; env->excp_vectors[POWERPC_EXCP_ITLB] = 0x00000000; env->excp_vectors[POWERPC_EXCP_DEBUG] = 0x00000000; env->excp_prefix = 0x00000000; env->ivor_mask = 0x0000FFE0; env->ivpr_mask = 0xFFFF0000; /* Hardware reset vector */ env->hreset_vector = 0xFFFFFFFCUL; #endif },"Yes, it is vulnerable."3937,"DISAS_INSN(divw) { TCGv reg; TCGv tmp; TCGv src; int sign; sign = (insn & 0x100) != 0; reg = DREG(insn, 9); if (sign) { tcg_gen_ext16s_i32(QREG_DIV1, reg); } else { tcg_gen_ext16u_i32(QREG_DIV1, reg); } SRC_EA(env, src, OS_WORD, sign, NULL); tcg_gen_mov_i32(QREG_DIV2, src); if (sign) { gen_helper_divs(cpu_env, tcg_const_i32(1)); } else { gen_helper_divu(cpu_env, tcg_const_i32(1)); } tmp = tcg_temp_new(); src = tcg_temp_new(); tcg_gen_ext16u_i32(tmp, QREG_DIV1); tcg_gen_shli_i32(src, QREG_DIV2, 16); tcg_gen_or_i32(reg, tmp, src); set_cc_op(s, CC_OP_FLAGS); }","Yes, it is vulnerable."4038,"static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int depth, const uint8_t *data, int srcsize) { uint8_t *output, *output_end; const uint8_t* src = data; int p1, p2, line=avctx->height, pos=0, i; uint16_t pix16; uint32_t pix32; output = pic->data[0] + (avctx->height - 1) * pic->linesize[0]; output_end = pic->data[0] + (avctx->height) * pic->linesize[0]; while(src < data + srcsize) { p1 = *src++; if(p1 == 0) { //Escape code p2 = *src++; if(p2 == 0) { //End-of-line output = pic->data[0] + (--line) * pic->linesize[0]; if (line < 0){ av_log(avctx, AV_LOG_ERROR, ""Next line is beyond picture bounds\n""); return -1; } pos = 0; continue; } else if(p2 == 1) { //End-of-picture return 0; } else if(p2 == 2) { //Skip p1 = *src++; p2 = *src++; line -= p2; if (line < 0){ av_log(avctx, AV_LOG_ERROR, ""Skip beyond picture bounds\n""); return -1; } pos += p1; output = pic->data[0] + line * pic->linesize[0] + pos * (depth >> 3); continue; } // Copy data if (output + p2 * (depth >> 3) > output_end) { src += p2 * (depth >> 3); continue; } if ((depth == 8) || (depth == 24)) { for(i = 0; i < p2 * (depth >> 3); i++) { *output++ = *src++; } // RLE8 copy is actually padded - and runs are not! if(depth == 8 && (p2 & 1)) { src++; } } else if (depth == 16) { for(i = 0; i < p2; i++) { pix16 = AV_RL16(src); src += 2; *(uint16_t*)output = pix16; output += 2; } } else if (depth == 32) { for(i = 0; i < p2; i++) { pix32 = AV_RL32(src); src += 4; *(uint32_t*)output = pix32; output += 4; } } pos += p2; } else { //Run of pixels uint8_t pix[3]; //original pixel switch(depth){ case 8: pix[0] = *src++; break; case 16: pix16 = AV_RL16(src); src += 2; break; case 24: pix[0] = *src++; pix[1] = *src++; pix[2] = *src++; break; case 32: pix32 = AV_RL32(src); src += 4; break; } if (output + p1 * (depth >> 3) > output_end) continue; for(i = 0; i < p1; i++) { switch(depth){ case 8: *output++ = pix[0]; break; case 16: *(uint16_t*)output = pix16; output += 2; break; case 24: *output++ = pix[0]; *output++ = pix[1]; *output++ = pix[2]; break; case 32: *(uint32_t*)output = pix32; output += 4; break; } } pos += p1; } } av_log(avctx, AV_LOG_WARNING, ""MS RLE warning: no End-of-picture code\n""); return 0; }","Yes, it is vulnerable."4139,"static void RENAME(vertical_compose53iL0)(uint8_t *_b0, uint8_t *_b1, uint8_t *_b2, int width) { int i; TYPE *b0 = (TYPE *)_b0; TYPE *b1 = (TYPE *)_b1; TYPE *b2 = (TYPE *)_b2; for (i = 0; i < width; i++) b1[i] -= (b0[i] + b2[i] + 2) >> 2; }","Yes, it is vulnerable."4240,"static void handle_user_command(Monitor *mon, const char *cmdline) { QDict *qdict; const mon_cmd_t *cmd; qdict = qdict_new(); cmd = monitor_parse_command(mon, cmdline, 0, mon->cmd_table, qdict); if (!cmd) goto out; if (handler_is_async(cmd)) { user_async_cmd_handler(mon, cmd, qdict); } else if (handler_is_qobject(cmd)) { QObject *data = NULL; /* XXX: ignores the error code */ cmd->mhandler.cmd_new(mon, qdict, &data); assert(!monitor_has_error(mon)); if (data) { cmd->user_print(mon, data); qobject_decref(data); } } else { cmd->mhandler.cmd(mon, qdict); } out: QDECREF(qdict); }","Yes, it is vulnerable."4341,"static void gen_exception_return(DisasContext *s, TCGv pc) { TCGv tmp; store_reg(s, 15, pc); tmp = load_cpu_field(spsr); gen_set_cpsr(tmp, 0xffffffff); dead_tmp(tmp); s->is_jmp = DISAS_UPDATE; }","Yes, it is vulnerable."4442,"static int fourxm_read_packet(AVFormatContext *s, AVPacket *pkt) { FourxmDemuxContext *fourxm = s->priv_data; ByteIOContext *pb = &s->pb; unsigned int fourcc_tag; unsigned int size, out_size; int ret = 0; int track_number; int packet_read = 0; unsigned char header[8]; int64_t pts_inc; int audio_frame_count; while (!packet_read) { if ((ret = get_buffer(&s->pb, header, 8)) < 0) return ret; fourcc_tag = LE_32(&header[0]); size = LE_32(&header[4]); if (url_feof(pb)) return AVERROR_IO; switch (fourcc_tag) { case LIST_TAG: /* this is a good time to bump the video pts */ fourxm->video_pts += fourxm->video_pts_inc; /* skip the LIST-* tag and move on to the next fourcc */ get_le32(pb); break; case ifrm_TAG: case pfrm_TAG: case cfrm_TAG:{ /* allocate 8 more bytes than 'size' to account for fourcc * and size */ if (av_new_packet(pkt, size + 8)) return AVERROR_IO; pkt->stream_index = fourxm->video_stream_index; pkt->pts = fourxm->video_pts; memcpy(pkt->data, header, 8); ret = get_buffer(&s->pb, &pkt->data[8], size); if (ret < 0) av_free_packet(pkt); else packet_read = 1; break; } case snd__TAG: track_number = get_le32(pb); out_size= get_le32(pb); size-=8; if (track_number == fourxm->selected_track) { if (av_new_packet(pkt, size)) return AVERROR_IO; pkt->stream_index = fourxm->tracks[fourxm->selected_track].stream_index; pkt->pts = fourxm->audio_pts; ret = get_buffer(&s->pb, pkt->data, size); if (ret < 0) av_free_packet(pkt); else packet_read = 1; /* pts accounting */ audio_frame_count = size; if (fourxm->tracks[fourxm->selected_track].adpcm) audio_frame_count -= 2 * (fourxm->tracks[fourxm->selected_track].channels); audio_frame_count /= fourxm->tracks[fourxm->selected_track].channels; if (fourxm->tracks[fourxm->selected_track].adpcm) audio_frame_count *= 2; else audio_frame_count /= (fourxm->tracks[fourxm->selected_track].bits / 8); pts_inc = audio_frame_count; pts_inc *= 90000; pts_inc /= fourxm->tracks[fourxm->selected_track].sample_rate; fourxm->audio_pts += pts_inc; } else { url_fseek(pb, size, SEEK_CUR); } break; default: url_fseek(pb, size, SEEK_CUR); break; } } return ret; }","Yes, it is vulnerable."4543,"static bool bdrv_drain_recurse(BlockDriverState *bs, bool begin) { BdrvChild *child, *tmp; bool waited; /* Ensure any pending metadata writes are submitted to bs->file. */ bdrv_drain_invoke(bs, begin); /* Wait for drained requests to finish */ waited = BDRV_POLL_WHILE(bs, atomic_read(&bs->in_flight) > 0); QLIST_FOREACH_SAFE(child, &bs->children, next, tmp) { BlockDriverState *bs = child->bs; bool in_main_loop = qemu_get_current_aio_context() == qemu_get_aio_context(); assert(bs->refcnt > 0); if (in_main_loop) { /* In case the recursive bdrv_drain_recurse processes a * block_job_defer_to_main_loop BH and modifies the graph, * let's hold a reference to bs until we are done. * * IOThread doesn't have such a BH, and it is not safe to call * bdrv_unref without BQL, so skip doing it there. */ bdrv_ref(bs); } waited |= bdrv_drain_recurse(bs, begin); if (in_main_loop) { bdrv_unref(bs); } } return waited; }","Yes, it is vulnerable."4644,"static int count_paired_channels(uint8_t (*layout_map)[3], int tags, int pos, int *current) { int num_pos_channels = 0; int first_cpe = 0; int sce_parity = 0; int i; for (i = *current; i < tags; i++) { if (layout_map[i][2] != pos) break; if (layout_map[i][0] == TYPE_CPE) { if (sce_parity) { if (pos == AAC_CHANNEL_FRONT || !first_cpe) { sce_parity = 0; } else { return -1; } } num_pos_channels += 2; first_cpe = 1; } else { num_pos_channels++; sce_parity ^= 1; } } if (sce_parity && ((pos == AAC_CHANNEL_FRONT && first_cpe) || pos == AAC_CHANNEL_SIDE)) return -1; *current = i; return num_pos_channels; }","No, it is non-vulnerable."4745,"uint64_t helper_sublv (uint64_t op1, uint64_t op2) { uint64_t tmp = op1; op1 = (uint32_t)(op1 - op2); if (unlikely(((~tmp) ^ op1 ^ (-1UL)) & ((~tmp) ^ op2) & (1UL << 31))) { helper_excp(EXCP_ARITH, EXCP_ARITH_OVERFLOW); } return op1; }","Yes, it is vulnerable."4846,"static int decode_slice(struct AVCodecContext *avctx, void *arg) { H264Context *h = *(void **)arg; int lf_x_start = h->mb_x; h->mb_skip_run = -1; av_assert0(h->block_offset[15] == (4 * ((scan8[15] - scan8[0]) & 7) << h->pixel_shift) + 4 * h->linesize * ((scan8[15] - scan8[0]) >> 3)); h->is_complex = FRAME_MBAFF(h) || h->picture_structure != PICT_FRAME || avctx->codec_id != AV_CODEC_ID_H264 || (CONFIG_GRAY && (h->flags & CODEC_FLAG_GRAY)); if (!(h->avctx->active_thread_type & FF_THREAD_SLICE) && h->picture_structure == PICT_FRAME) { const int start_i = av_clip(h->resync_mb_x + h->resync_mb_y * h->mb_width, 0, h->mb_num - 1); if (start_i) { int prev_status = h->er.error_status_table[h->er.mb_index2xy[start_i - 1]]; prev_status &= ~ VP_START; if (prev_status != (ER_MV_END | ER_DC_END | ER_AC_END)) h->er.error_occurred = 1; } } if (h->pps.cabac) { /* realign */ align_get_bits(&h->gb); /* init cabac */ ff_init_cabac_decoder(&h->cabac, h->gb.buffer + get_bits_count(&h->gb) / 8, (get_bits_left(&h->gb) + 7) / 8); ff_h264_init_cabac_states(h); for (;;) { // START_TIMER int ret = ff_h264_decode_mb_cabac(h); int eos; // STOP_TIMER(""decode_mb_cabac"") if (ret >= 0) ff_h264_hl_decode_mb(h); // FIXME optimal? or let mb_decode decode 16x32 ? if (ret >= 0 && FRAME_MBAFF(h)) { h->mb_y++; ret = ff_h264_decode_mb_cabac(h); if (ret >= 0) ff_h264_hl_decode_mb(h); h->mb_y--; } eos = get_cabac_terminate(&h->cabac); if ((h->workaround_bugs & FF_BUG_TRUNCATED) && h->cabac.bytestream > h->cabac.bytestream_end + 2) { er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1, h->mb_y, ER_MB_END); if (h->mb_x >= lf_x_start) loop_filter(h, lf_x_start, h->mb_x + 1); return 0; } if (h->cabac.bytestream > h->cabac.bytestream_end + 2 ) av_log(h->avctx, AV_LOG_DEBUG, ""bytestream overread %td\n"", h->cabac.bytestream_end - h->cabac.bytestream); if (ret < 0 || h->cabac.bytestream > h->cabac.bytestream_end + 4) { av_log(h->avctx, AV_LOG_ERROR, ""error while decoding MB %d %d, bytestream (%td)\n"", h->mb_x, h->mb_y, h->cabac.bytestream_end - h->cabac.bytestream); er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x, h->mb_y, ER_MB_ERROR); return -1; } if (++h->mb_x >= h->mb_width) { loop_filter(h, lf_x_start, h->mb_x); h->mb_x = lf_x_start = 0; decode_finish_row(h); ++h->mb_y; if (FIELD_OR_MBAFF_PICTURE(h)) { ++h->mb_y; if (FRAME_MBAFF(h) && h->mb_y < h->mb_height) predict_field_decoding_flag(h); } } if (eos || h->mb_y >= h->mb_height) { tprintf(h->avctx, ""slice end %d %d\n"", get_bits_count(&h->gb), h->gb.size_in_bits); er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1, h->mb_y, ER_MB_END); if (h->mb_x > lf_x_start) loop_filter(h, lf_x_start, h->mb_x); return 0; } } } else { for (;;) { int ret = ff_h264_decode_mb_cavlc(h); if (ret >= 0) ff_h264_hl_decode_mb(h); // FIXME optimal? or let mb_decode decode 16x32 ? if (ret >= 0 && FRAME_MBAFF(h)) { h->mb_y++; ret = ff_h264_decode_mb_cavlc(h); if (ret >= 0) ff_h264_hl_decode_mb(h); h->mb_y--; } if (ret < 0) { av_log(h->avctx, AV_LOG_ERROR, ""error while decoding MB %d %d\n"", h->mb_x, h->mb_y); er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x, h->mb_y, ER_MB_ERROR); return -1; } if (++h->mb_x >= h->mb_width) { loop_filter(h, lf_x_start, h->mb_x); h->mb_x = lf_x_start = 0; decode_finish_row(h); ++h->mb_y; if (FIELD_OR_MBAFF_PICTURE(h)) { ++h->mb_y; if (FRAME_MBAFF(h) && h->mb_y < h->mb_height) predict_field_decoding_flag(h); } if (h->mb_y >= h->mb_height) { tprintf(h->avctx, ""slice end %d %d\n"", get_bits_count(&h->gb), h->gb.size_in_bits); if ( get_bits_left(&h->gb) == 0 || get_bits_left(&h->gb) > 0 && !(h->avctx->err_recognition & AV_EF_AGGRESSIVE)) { er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1, h->mb_y, ER_MB_END); return 0; } else { er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x, h->mb_y, ER_MB_END); return -1; } } } if (get_bits_left(&h->gb) <= 0 && h->mb_skip_run <= 0) { tprintf(h->avctx, ""slice end %d %d\n"", get_bits_count(&h->gb), h->gb.size_in_bits); if (get_bits_left(&h->gb) == 0) { er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x - 1, h->mb_y, ER_MB_END); if (h->mb_x > lf_x_start) loop_filter(h, lf_x_start, h->mb_x); return 0; } else { er_add_slice(h, h->resync_mb_x, h->resync_mb_y, h->mb_x, h->mb_y, ER_MB_ERROR); return -1; } } } } }","Yes, it is vulnerable."4947,"static int img_read_packet(AVFormatContext *s1, AVPacket *pkt) { VideoData *s = s1->priv_data; char filename[1024]; int ret; ByteIOContext f1, *f; if (get_frame_filename(filename, sizeof(filename), s->path, s->img_number) < 0) return -EIO; if (!s->is_pipe) { f = &f1; if (url_fopen(f, filename, URL_RDONLY) < 0) return -EIO; } else { f = &s1->pb; if (url_feof(f)) return -EIO; } av_new_packet(pkt, s->img_size); pkt->stream_index = 0; switch(s->img_fmt) { case IMGFMT_PGMYUV: ret = pgm_read(s, f, pkt->data, pkt->size, 1); break; case IMGFMT_PGM: ret = pgm_read(s, f, pkt->data, pkt->size, 0); break; case IMGFMT_YUV: ret = yuv_read(s, filename, pkt->data, pkt->size); break; case IMGFMT_PPM: ret = ppm_read(s, f, pkt->data, pkt->size); break; default: return -EIO; } if (!s->is_pipe) { url_fclose(f); } if (ret < 0) { av_free_packet(pkt); return -EIO; /* signal EOF */ } else { s->img_number++; return 0; } }","Yes, it is vulnerable."5048,"void configure_alarms(char const *opt) { int i; int cur = 0; int count = ARRAY_SIZE(alarm_timers) - 1; char *arg; char *name; struct qemu_alarm_timer tmp; if (!strcmp(opt, ""?"")) { show_available_alarms(); exit(0); } arg = g_strdup(opt); /* Reorder the array */ name = strtok(arg, "",""); while (name) { for (i = 0; i < count && alarm_timers[i].name; i++) { if (!strcmp(alarm_timers[i].name, name)) break; } if (i == count) { fprintf(stderr, ""Unknown clock %s\n"", name); goto next; } if (i < cur) /* Ignore */ goto next; /* Swap */ tmp = alarm_timers[i]; alarm_timers[i] = alarm_timers[cur]; alarm_timers[cur] = tmp; cur++; next: name = strtok(NULL, "",""); } g_free(arg); if (cur) { /* Disable remaining timers */ for (i = cur; i < count; i++) alarm_timers[i].name = NULL; } else { show_available_alarms(); exit(1); } }","Yes, it is vulnerable."5149,"static int motion_inter_4v_block (bit_buffer_t *bitbuf, uint8_t *current, uint8_t *previous, int pitch, svq1_pmv_t *motion,int x, int y) { uint8_t *src; uint8_t *dst; svq1_pmv_t mv; svq1_pmv_t *pmv[4]; int i, result; /* predict and decode motion vector (0) */ pmv[0] = &motion[0]; pmv[1] = &motion[(x / 8) + 2]; pmv[2] = &motion[(x / 8) + 4]; if (y == 0) { pmv[1] = pmv[0]; pmv[2] = pmv[0]; } result = decode_motion_vector (bitbuf, &mv, pmv); if (result != 0) return result; /* predict and decode motion vector (1) */ pmv[0] = &mv; pmv[1] = &motion[(x / 8) + 3]; if (y == 0) { pmv[1] = pmv[0]; pmv[2] = pmv[0]; } result = decode_motion_vector (bitbuf, &motion[0], pmv); if (result != 0) return result; /* predict and decode motion vector (2) */ pmv[1] = &motion[0]; pmv[2] = &motion[(x / 8) + 1]; result = decode_motion_vector (bitbuf, &motion[(x / 8) + 2], pmv); if (result != 0) return result; /* predict and decode motion vector (3) */ pmv[2] = &motion[(x / 8) + 2]; pmv[3] = &motion[(x / 8) + 3]; result = decode_motion_vector (bitbuf, pmv[3], pmv); if (result != 0) return result; /* form predictions */ for (i=0; i < 4; i++) { src = &previous[(x + (pmv[i]->x >> 1)) + (y + (pmv[i]->y >> 1))*pitch]; dst = current; put_pixels_tab[((pmv[i]->y & 1) << 1) | (pmv[i]->x & 1)](dst,src,pitch,8); /* select next block */ if (i & 1) { current += 8*(pitch - 1); previous += 8*(pitch - 1); } else { current += 8; previous += 8; } } return 0; }","No, it is non-vulnerable."5250,"void ide_sector_read(IDEState *s) { int64_t sector_num; int ret, n; s->status = READY_STAT | SEEK_STAT; s->error = 0; /* not needed by IDE spec, but needed by Windows */ sector_num = ide_get_sector(s); n = s->nsector; if (n == 0) { /* no more sector to read from disk */ ide_transfer_stop(s); } else { #if defined(DEBUG_IDE) printf(""read sector=%"" PRId64 ""\n"", sector_num); #endif if (n > s->req_nb_sectors) n = s->req_nb_sectors; bdrv_acct_start(s->bs, &s->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ); ret = bdrv_read(s->bs, sector_num, s->io_buffer, n); bdrv_acct_done(s->bs, &s->acct); if (ret != 0) { if (ide_handle_rw_error(s, -ret, BM_STATUS_PIO_RETRY | BM_STATUS_RETRY_READ)) { return; } } ide_transfer_start(s, s->io_buffer, 512 * n, ide_sector_read); ide_set_irq(s->bus); ide_set_sector(s, sector_num + n); s->nsector -= n; } }","No, it is non-vulnerable."5351,"static void cpu_ioreq_pio(ioreq_t *req) { int i; if (req->dir == IOREQ_READ) { if (!req->data_is_ptr) { req->data = do_inp(req->addr, req->size); } else { uint32_t tmp; for (i = 0; i < req->count; i++) { tmp = do_inp(req->addr, req->size); write_phys_req_item(req->data, req, i, &tmp); } } } else if (req->dir == IOREQ_WRITE) { if (!req->data_is_ptr) { do_outp(req->addr, req->size, req->data); } else { for (i = 0; i < req->count; i++) { uint32_t tmp = 0; read_phys_req_item(req->data, req, i, &tmp); do_outp(req->addr, req->size, tmp); } } } }","No, it is non-vulnerable."5452,"static void rtas_display_character(sPAPREnvironment *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { uint8_t c = rtas_ld(args, 0); VIOsPAPRDevice *sdev = vty_lookup(spapr, 0); if (!sdev) { rtas_st(rets, 0, -1); } else { vty_putchars(sdev, &c, sizeof(c)); rtas_st(rets, 0, 0); } }","No, it is non-vulnerable."5553,"static int xmv_read_header(AVFormatContext *s) { XMVDemuxContext *xmv = s->priv_data; AVIOContext *pb = s->pb; uint32_t file_version; uint32_t this_packet_size; uint16_t audio_track; int ret; s->ctx_flags |= AVFMTCTX_NOHEADER; avio_skip(pb, 4); /* Next packet size */ this_packet_size = avio_rl32(pb); avio_skip(pb, 4); /* Max packet size */ avio_skip(pb, 4); /* ""xobX"" */ file_version = avio_rl32(pb); if ((file_version != 4) && (file_version != 2)) avpriv_request_sample(s, ""Uncommon version %""PRIu32"""", file_version); /* Video tracks */ xmv->video_width = avio_rl32(pb); xmv->video_height = avio_rl32(pb); xmv->video_duration = avio_rl32(pb); /* Audio tracks */ xmv->audio_track_count = avio_rl16(pb); avio_skip(pb, 2); /* Unknown (padding?) */ xmv->audio = av_mallocz_array(xmv->audio_track_count, sizeof(XMVAudioPacket)); if (!xmv->audio) { ret = AVERROR(ENOMEM); goto fail; } for (audio_track = 0; audio_track < xmv->audio_track_count; audio_track++) { XMVAudioPacket *packet = &xmv->audio[audio_track]; packet->compression = avio_rl16(pb); packet->channels = avio_rl16(pb); packet->sample_rate = avio_rl32(pb); packet->bits_per_sample = avio_rl16(pb); packet->flags = avio_rl16(pb); packet->bit_rate = packet->bits_per_sample * packet->sample_rate * packet->channels; packet->block_align = XMV_BLOCK_ALIGN_SIZE * packet->channels; packet->block_samples = 64; packet->codec_id = ff_wav_codec_get_id(packet->compression, packet->bits_per_sample); packet->stream_index = -1; packet->frame_size = 0; packet->block_count = 0; /* TODO: ADPCM'd 5.1 sound is encoded in three separate streams. * Those need to be interleaved to a proper 5.1 stream. */ if (packet->flags & XMV_AUDIO_ADPCM51) av_log(s, AV_LOG_WARNING, ""Unsupported 5.1 ADPCM audio stream "" ""(0x%04X)\n"", packet->flags); if (!packet->channels || !packet->sample_rate || packet->channels >= UINT16_MAX / XMV_BLOCK_ALIGN_SIZE) { av_log(s, AV_LOG_ERROR, ""Invalid parameters for audio track %""PRIu16"".\n"", audio_track); ret = AVERROR_INVALIDDATA; goto fail; } } /* Initialize the packet context */ xmv->next_packet_offset = avio_tell(pb); xmv->next_packet_size = this_packet_size - xmv->next_packet_offset; xmv->stream_count = xmv->audio_track_count + 1; return 0; fail: xmv_read_close(s); return ret; }","No, it is non-vulnerable."5654,"static int bdrv_rd_badreq_sectors(BlockDriverState *bs, int64_t sector_num, int nb_sectors) { return nb_sectors < 0 || sector_num < 0 || nb_sectors > bs->total_sectors || sector_num > bs->total_sectors - nb_sectors; }","Yes, it is vulnerable."5755,"static int handle_update_file_cred(int dirfd, const char *name, FsCred *credp) { int fd, ret; fd = openat(dirfd, name, O_NONBLOCK | O_NOFOLLOW); if (fd < 0) { return fd; } ret = fchmod(fd, credp->fc_mode & 07777); if (ret < 0) { goto err_out; } ret = fchownat(fd, """", credp->fc_uid, credp->fc_gid, AT_EMPTY_PATH); err_out: close(fd); return ret; }","Yes, it is vulnerable."5856,"static av_cold int ffv1_encode_init(AVCodecContext *avctx) { FFV1Context *s = avctx->priv_data; const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(avctx->pix_fmt); int i, j, k, m, ret; ffv1_common_init(avctx); s->version = 0; if ((avctx->flags & (CODEC_FLAG_PASS1 | CODEC_FLAG_PASS2)) || avctx->slices > 1) s->version = FFMAX(s->version, 2); if (avctx->level == 3) { s->version = 3; } if (s->ec < 0) { s->ec = (s->version >= 3); } if (s->version >= 2 && avctx->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL) { av_log(avctx, AV_LOG_ERROR, ""Version %d requested, please set -strict experimental in "" ""order to enable it\n"", s->version); return AVERROR(ENOSYS); } s->ac = avctx->coder_type > 0 ? 2 : 0; s->plane_count = 3; switch (avctx->pix_fmt) { case AV_PIX_FMT_YUV444P9: case AV_PIX_FMT_YUV422P9: case AV_PIX_FMT_YUV420P9: if (!avctx->bits_per_raw_sample) s->bits_per_raw_sample = 9; case AV_PIX_FMT_YUV444P10: case AV_PIX_FMT_YUV420P10: case AV_PIX_FMT_YUV422P10: s->packed_at_lsb = 1; if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) s->bits_per_raw_sample = 10; case AV_PIX_FMT_GRAY16: case AV_PIX_FMT_YUV444P16: case AV_PIX_FMT_YUV422P16: case AV_PIX_FMT_YUV420P16: if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) { s->bits_per_raw_sample = 16; } else if (!s->bits_per_raw_sample) { s->bits_per_raw_sample = avctx->bits_per_raw_sample; } if (s->bits_per_raw_sample <= 8) { av_log(avctx, AV_LOG_ERROR, ""bits_per_raw_sample invalid\n""); return AVERROR_INVALIDDATA; } if (!s->ac && avctx->coder_type == -1) { av_log(avctx, AV_LOG_INFO, ""bits_per_raw_sample > 8, forcing coder 1\n""); s->ac = 2; } if (!s->ac) { av_log( avctx, AV_LOG_ERROR, ""bits_per_raw_sample of more than 8 needs -coder 1 currently\n""); return AVERROR_INVALIDDATA; } s->version = FFMAX(s->version, 1); case AV_PIX_FMT_GRAY8: case AV_PIX_FMT_YUV444P: case AV_PIX_FMT_YUV440P: case AV_PIX_FMT_YUV422P: case AV_PIX_FMT_YUV420P: case AV_PIX_FMT_YUV411P: case AV_PIX_FMT_YUV410P: s->chroma_planes = desc->nb_components < 3 ? 0 : 1; s->colorspace = 0; break; case AV_PIX_FMT_YUVA444P: case AV_PIX_FMT_YUVA422P: case AV_PIX_FMT_YUVA420P: s->chroma_planes = 1; s->colorspace = 0; s->transparency = 1; break; case AV_PIX_FMT_RGB32: s->colorspace = 1; s->transparency = 1; break; case AV_PIX_FMT_GBRP9: if (!avctx->bits_per_raw_sample) s->bits_per_raw_sample = 9; case AV_PIX_FMT_GBRP10: if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) s->bits_per_raw_sample = 10; case AV_PIX_FMT_GBRP16: if (!avctx->bits_per_raw_sample && !s->bits_per_raw_sample) s->bits_per_raw_sample = 16; else if (!s->bits_per_raw_sample) s->bits_per_raw_sample = avctx->bits_per_raw_sample; s->colorspace = 1; s->chroma_planes = 1; s->version = FFMAX(s->version, 1); break; default: av_log(avctx, AV_LOG_ERROR, ""format not supported\n""); return AVERROR_INVALIDDATA; } if (s->transparency) { av_log( avctx, AV_LOG_WARNING, ""Storing alpha plane, this will require a recent FFV1 decoder to playback!\n""); } if (avctx->context_model > 1U) { av_log(avctx, AV_LOG_ERROR, ""Invalid context model %d, valid values are 0 and 1\n"", avctx->context_model); return AVERROR(EINVAL); } if (s->ac > 1) for (i = 1; i < 256; i++) s->state_transition[i] = ffv1_ver2_state[i]; for (i = 0; i < 256; i++) { s->quant_table_count = 2; if (s->bits_per_raw_sample <= 8) { s->quant_tables[0][0][i] = ffv1_quant11[i]; s->quant_tables[0][1][i] = ffv1_quant11[i] * 11; s->quant_tables[0][2][i] = ffv1_quant11[i] * 11 * 11; s->quant_tables[1][0][i] = ffv1_quant11[i]; s->quant_tables[1][1][i] = ffv1_quant11[i] * 11; s->quant_tables[1][2][i] = ffv1_quant5[i] * 11 * 11; s->quant_tables[1][3][i] = ffv1_quant5[i] * 5 * 11 * 11; s->quant_tables[1][4][i] = ffv1_quant5[i] * 5 * 5 * 11 * 11; } else { s->quant_tables[0][0][i] = ffv1_quant9_10bit[i]; s->quant_tables[0][1][i] = ffv1_quant9_10bit[i] * 11; s->quant_tables[0][2][i] = ffv1_quant9_10bit[i] * 11 * 11; s->quant_tables[1][0][i] = ffv1_quant9_10bit[i]; s->quant_tables[1][1][i] = ffv1_quant9_10bit[i] * 11; s->quant_tables[1][2][i] = ffv1_quant5_10bit[i] * 11 * 11; s->quant_tables[1][3][i] = ffv1_quant5_10bit[i] * 5 * 11 * 11; s->quant_tables[1][4][i] = ffv1_quant5_10bit[i] * 5 * 5 * 11 * 11; } } s->context_count[0] = (11 * 11 * 11 + 1) / 2; s->context_count[1] = (11 * 11 * 5 * 5 * 5 + 1) / 2; memcpy(s->quant_table, s->quant_tables[avctx->context_model], sizeof(s->quant_table)); for (i = 0; i < s->plane_count; i++) { PlaneContext *const p = &s->plane[i]; memcpy(p->quant_table, s->quant_table, sizeof(p->quant_table)); p->quant_table_index = avctx->context_model; p->context_count = s->context_count[p->quant_table_index]; } if ((ret = ffv1_allocate_initial_states(s)) < 0) return ret; avctx->coded_frame = av_frame_alloc(); if (!avctx->coded_frame) return AVERROR(ENOMEM); avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I; if (!s->transparency) s->plane_count = 2; av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &s->chroma_h_shift, &s->chroma_v_shift); s->picture_number = 0; if (avctx->flags & (CODEC_FLAG_PASS1 | CODEC_FLAG_PASS2)) { for (i = 0; i < s->quant_table_count; i++) { s->rc_stat2[i] = av_mallocz(s->context_count[i] * sizeof(*s->rc_stat2[i])); if (!s->rc_stat2[i]) return AVERROR(ENOMEM); } } if (avctx->stats_in) { char *p = avctx->stats_in; uint8_t best_state[256][256]; int gob_count = 0; char *next; av_assert0(s->version >= 2); for (;; ) { for (j = 0; j < 256; j++) for (i = 0; i < 2; i++) { s->rc_stat[j][i] = strtol(p, &next, 0); if (next == p) { av_log(avctx, AV_LOG_ERROR, ""2Pass file invalid at %d %d [%s]\n"", j, i, p); return AVERROR_INVALIDDATA; } p = next; } for (i = 0; i < s->quant_table_count; i++) for (j = 0; j < s->context_count[i]; j++) { for (k = 0; k < 32; k++) for (m = 0; m < 2; m++) { s->rc_stat2[i][j][k][m] = strtol(p, &next, 0); if (next == p) { av_log(avctx, AV_LOG_ERROR, ""2Pass file invalid at %d %d %d %d [%s]\n"", i, j, k, m, p); return AVERROR_INVALIDDATA; } p = next; } } gob_count = strtol(p, &next, 0); if (next == p || gob_count <= 0) { av_log(avctx, AV_LOG_ERROR, ""2Pass file invalid\n""); return AVERROR_INVALIDDATA; } p = next; while (*p == '\n' || *p == ' ') p++; if (p[0] == 0) break; } sort_stt(s, s->state_transition); find_best_state(best_state, s->state_transition); for (i = 0; i < s->quant_table_count; i++) { for (j = 0; j < s->context_count[i]; j++) for (k = 0; k < 32; k++) { double p = 128; if (s->rc_stat2[i][j][k][0] + s->rc_stat2[i][j][k][1]) { p = 256.0 * s->rc_stat2[i][j][k][1] / (s->rc_stat2[i][j][k][0] + s->rc_stat2[i][j][k][1]); } s->initial_states[i][j][k] = best_state[av_clip(round(p), 1, 255)][av_clip((s->rc_stat2[i][j][k][0] + s->rc_stat2[i][j][k][1]) / gob_count, 0, 255)]; } } } if (s->version > 1) { for (s->num_v_slices = 2; s->num_v_slices < 9; s->num_v_slices++) for (s->num_h_slices = s->num_v_slices; s->num_h_slices < 2 * s->num_v_slices; s->num_h_slices++) if (avctx->slices == s->num_h_slices * s->num_v_slices && avctx->slices <= 64 || !avctx->slices) goto slices_ok; av_log(avctx, AV_LOG_ERROR, ""Unsupported number %d of slices requested, please specify a "" ""supported number with -slices (ex:4,6,9,12,16, ...)\n"", avctx->slices); return AVERROR(ENOSYS); slices_ok: write_extradata(s); } if ((ret = ffv1_init_slice_contexts(s)) < 0) return ret; if ((ret = init_slices_state(s)) < 0) return ret; #define STATS_OUT_SIZE 1024 * 1024 * 6 if (avctx->flags & CODEC_FLAG_PASS1) { avctx->stats_out = av_mallocz(STATS_OUT_SIZE); for (i = 0; i < s->quant_table_count; i++) for (j = 0; j < s->slice_count; j++) { FFV1Context *sf = s->slice_context[j]; av_assert0(!sf->rc_stat2[i]); sf->rc_stat2[i] = av_mallocz(s->context_count[i] * sizeof(*sf->rc_stat2[i])); if (!sf->rc_stat2[i]) return AVERROR(ENOMEM); } } return 0; }","No, it is non-vulnerable."5957,"int qemu_devtree_setprop(void *fdt, const char *node_path, const char *property, void *val_array, int size) { int offset; offset = fdt_path_offset(fdt, node_path); if (offset < 0) return offset; return fdt_setprop(fdt, offset, property, val_array, size); }","Yes, it is vulnerable."6058,"static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, const AVFrame *frame, int *got_packet_ptr) { LAMEContext *s = avctx->priv_data; MPADecodeHeader hdr; int len, ret, ch; int lame_result; uint32_t h; if (frame) { switch (avctx->sample_fmt) { case AV_SAMPLE_FMT_S16P: ENCODE_BUFFER(lame_encode_buffer, int16_t, frame->data); break; case AV_SAMPLE_FMT_S32P: ENCODE_BUFFER(lame_encode_buffer_int, int32_t, frame->data); break; case AV_SAMPLE_FMT_FLTP: if (frame->linesize[0] < 4 * FFALIGN(frame->nb_samples, 8)) { av_log(avctx, AV_LOG_ERROR, ""inadequate AVFrame plane padding\n""); return AVERROR(EINVAL); } for (ch = 0; ch < avctx->channels; ch++) { s->fdsp.vector_fmul_scalar(s->samples_flt[ch], (const float *)frame->data[ch], 32768.0f, FFALIGN(frame->nb_samples, 8)); } ENCODE_BUFFER(lame_encode_buffer_float, float, s->samples_flt); break; default: return AVERROR_BUG; } } else { lame_result = lame_encode_flush(s->gfp, s->buffer + s->buffer_index, s->buffer_size - s->buffer_index); } if (lame_result < 0) { if (lame_result == -1) { av_log(avctx, AV_LOG_ERROR, ""lame: output buffer too small (buffer index: %d, free bytes: %d)\n"", s->buffer_index, s->buffer_size - s->buffer_index); } return -1; } s->buffer_index += lame_result; ret = realloc_buffer(s); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""error reallocating output buffer\n""); return ret; } /* add current frame to the queue */ if (frame) { if ((ret = ff_af_queue_add(&s->afq, frame)) < 0) return ret; } /* Move 1 frame from the LAME buffer to the output packet, if available. We have to parse the first frame header in the output buffer to determine the frame size. */ if (s->buffer_index < 4) return 0; h = AV_RB32(s->buffer); if (ff_mpa_check_header(h) < 0) { av_log(avctx, AV_LOG_ERROR, ""Invalid mp3 header at start of buffer\n""); return AVERROR_BUG; } if (avpriv_mpegaudio_decode_header(&hdr, h)) { av_log(avctx, AV_LOG_ERROR, ""free format output not supported\n""); return -1; } len = hdr.frame_size; ff_dlog(avctx, ""in:%d packet-len:%d index:%d\n"", avctx->frame_size, len, s->buffer_index); if (len <= s->buffer_index) { if ((ret = ff_alloc_packet(avpkt, len))) { av_log(avctx, AV_LOG_ERROR, ""Error getting output packet\n""); return ret; } memcpy(avpkt->data, s->buffer, len); s->buffer_index -= len; memmove(s->buffer, s->buffer + len, s->buffer_index); /* Get the next frame pts/duration */ ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts, &avpkt->duration); avpkt->size = len; *got_packet_ptr = 1; } return 0; }","No, it is non-vulnerable."6159,"static int tta_decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; TTAContext *s = avctx->priv_data; int i; init_get_bits(&s->gb, buf, buf_size*8); { int32_t predictors[s->channels]; TTAFilter filters[s->channels]; TTARice rices[s->channels]; int cur_chan = 0, framelen = s->frame_length; int32_t *p; // FIXME: seeking s->total_frames--; if (!s->total_frames && s->last_frame_length) framelen = s->last_frame_length; // init per channel states for (i = 0; i < s->channels; i++) { predictors[i] = 0; ttafilter_init(&(filters[i]), ttafilter_configs[s->bps-1][0], ttafilter_configs[s->bps-1][1]); rice_init(&(rices[i]), 10, 10); } for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) { int32_t *predictor = &(predictors[cur_chan]); TTAFilter *filter = &(filters[cur_chan]); TTARice *rice = &(rices[cur_chan]); uint32_t unary, depth, k; int32_t value; unary = tta_get_unary(&s->gb); if (unary == 0) { depth = 0; k = rice->k0; } else { depth = 1; k = rice->k1; unary--; } if (k) value = (unary << k) + get_bits(&s->gb, k); else value = unary; // FIXME: copy paste from original switch (depth) { case 1: rice->sum1 += value - (rice->sum1 >> 4); if (rice->k1 > 0 && rice->sum1 < shift_16[rice->k1]) rice->k1--; else if(rice->sum1 > shift_16[rice->k1 + 1]) rice->k1++; value += shift_1[rice->k0]; default: rice->sum0 += value - (rice->sum0 >> 4); if (rice->k0 > 0 && rice->sum0 < shift_16[rice->k0]) rice->k0--; else if(rice->sum0 > shift_16[rice->k0 + 1]) rice->k0++; } // extract coded value #define UNFOLD(x) (((x)&1) ? (++(x)>>1) : (-(x)>>1)) *p = UNFOLD(value); // run hybrid filter ttafilter_process(filter, p, 0); // fixed order prediction #define PRED(x, k) (int32_t)((((uint64_t)x << k) - x) >> k) switch (s->bps) { case 1: *p += PRED(*predictor, 4); break; case 2: case 3: *p += PRED(*predictor, 5); break; case 4: *p += *predictor; break; } *predictor = *p; #if 0 // extract 32bit float from last two int samples if (s->is_float && ((p - data) & 1)) { uint32_t neg = *p & 0x80000000; uint32_t hi = *(p - 1); uint32_t lo = abs(*p) - 1; hi += (hi || lo) ? 0x3f80 : 0; // SWAP16: swap all the 16 bits *(p - 1) = (hi << 16) | SWAP16(lo) | neg; } #endif /*if ((get_bits_count(&s->gb)+7)/8 > buf_size) { av_log(NULL, AV_LOG_INFO, ""overread!!\n""); break; }*/ // flip channels if (cur_chan < (s->channels-1)) cur_chan++; else { // decorrelate in case of stereo integer if (!s->is_float && (s->channels > 1)) { int32_t *r = p - 1; for (*p += *r / 2; r > p - s->channels; r--) *r = *(r + 1) - *r; } cur_chan = 0; } } skip_bits(&s->gb, 32); // frame crc // convert to output buffer switch(s->bps) { case 2: { uint16_t *samples = data; for (p = s->decode_buffer; p < s->decode_buffer + (framelen * s->channels); p++) { // *samples++ = (unsigned char)*p; // *samples++ = (unsigned char)(*p >> 8); *samples++ = *p; } *data_size = (uint8_t *)samples - (uint8_t *)data; break; } default: av_log(s->avctx, AV_LOG_ERROR, ""Error, only 16bit samples supported!\n""); } } // return get_bits_count(&s->gb)+7)/8; return buf_size; }","Yes, it is vulnerable."6260,"yuv2rgba64_2_c_template(SwsContext *c, const int32_t *buf[2], const int32_t *ubuf[2], const int32_t *vbuf[2], const int32_t *abuf[2], uint16_t *dest, int dstW, int yalpha, int uvalpha, int y, enum AVPixelFormat target, int hasAlpha, int eightbytes) { const int32_t *buf0 = buf[0], *buf1 = buf[1], *ubuf0 = ubuf[0], *ubuf1 = ubuf[1], *vbuf0 = vbuf[0], *vbuf1 = vbuf[1], *abuf0 = hasAlpha ? abuf[0] : NULL, *abuf1 = hasAlpha ? abuf[1] : NULL; int yalpha1 = 4096 - yalpha; int uvalpha1 = 4096 - uvalpha; int i; int A1 = 0xffff<<14, A2 = 0xffff<<14; for (i = 0; i < ((dstW + 1) >> 1); i++) { int Y1 = (buf0[i * 2] * yalpha1 + buf1[i * 2] * yalpha) >> 14; int Y2 = (buf0[i * 2 + 1] * yalpha1 + buf1[i * 2 + 1] * yalpha) >> 14; int U = (ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha + (-128 << 23)) >> 14; int V = (vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha + (-128 << 23)) >> 14; int R, G, B; Y1 -= c->yuv2rgb_y_offset; Y2 -= c->yuv2rgb_y_offset; Y1 *= c->yuv2rgb_y_coeff; Y2 *= c->yuv2rgb_y_coeff; Y1 += 1 << 13; Y2 += 1 << 13; R = V * c->yuv2rgb_v2r_coeff; G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff; B = U * c->yuv2rgb_u2b_coeff; if (hasAlpha) { A1 = (abuf0[i * 2 ] * yalpha1 + abuf1[i * 2 ] * yalpha) >> 1; A2 = (abuf0[i * 2 + 1] * yalpha1 + abuf1[i * 2 + 1] * yalpha) >> 1; A1 += 1 << 13; A2 += 1 << 13; } output_pixel(&dest[0], av_clip_uintp2(R_B + Y1, 30) >> 14); output_pixel(&dest[1], av_clip_uintp2( G + Y1, 30) >> 14); output_pixel(&dest[2], av_clip_uintp2(B_R + Y1, 30) >> 14); if (eightbytes) { output_pixel(&dest[3], av_clip_uintp2(A1 , 30) >> 14); output_pixel(&dest[4], av_clip_uintp2(R_B + Y2, 30) >> 14); output_pixel(&dest[5], av_clip_uintp2( G + Y2, 30) >> 14); output_pixel(&dest[6], av_clip_uintp2(B_R + Y2, 30) >> 14); output_pixel(&dest[7], av_clip_uintp2(A2 , 30) >> 14); dest += 8; } else { output_pixel(&dest[3], av_clip_uintp2(R_B + Y2, 30) >> 14); output_pixel(&dest[4], av_clip_uintp2( G + Y2, 30) >> 14); output_pixel(&dest[5], av_clip_uintp2(B_R + Y2, 30) >> 14); dest += 6; } } }","No, it is non-vulnerable."6361,"static void backup_duplicate_context(MpegEncContext *bak, MpegEncContext *src){ #define COPY(a) bak->a= src->a COPY(allocated_edge_emu_buffer); COPY(edge_emu_buffer); COPY(me.scratchpad); COPY(me.temp); COPY(rd_scratchpad); COPY(b_scratchpad); COPY(obmc_scratchpad); COPY(me.map); COPY(me.score_map); COPY(blocks); COPY(block); COPY(start_mb_y); COPY(end_mb_y); COPY(me.map_generation); COPY(pb); COPY(dct_error_sum); COPY(dct_count[0]); COPY(dct_count[1]); COPY(ac_val_base); COPY(ac_val[0]); COPY(ac_val[1]); COPY(ac_val[2]); #undef COPY }","Yes, it is vulnerable."6462,static av_cold void free_frame_buffers(Indeo3DecodeContext *ctx) { int p; ctx->width= ctx->height= 0; for (p = 0; p < 3; p++) { av_freep(&ctx->planes[p].buffers[0]); av_freep(&ctx->planes[p].buffers[1]); ctx->planes[p].pixels[0] = ctx->planes[p].pixels[1] = 0; } },"No, it is non-vulnerable."6563,"static AVInputFormat *probe_input_format(AVProbeData *pd, int is_opened) { AVInputFormat *fmt1, *fmt; int score, score_max; fmt = NULL; score_max = 0; for(fmt1 = first_iformat; fmt1 != NULL; fmt1 = fmt1->next) { if (!is_opened && !(fmt1->flags & AVFMT_NOFILE)) continue; score = 0; if (fmt1->extensions) { if (match_ext(pd->filename, fmt1->extensions)) { score = 50; } } else if (fmt1->read_probe) { score = fmt1->read_probe(pd); } if (score > score_max) { score_max = score; fmt = fmt1; } } return fmt; }","No, it is non-vulnerable."6664,"static void pc_dimm_check_memdev_is_busy(Object *obj, const char *name, Object *val, Error **errp) { MemoryRegion *mr; mr = host_memory_backend_get_memory(MEMORY_BACKEND(val), errp); if (memory_region_is_mapped(mr)) { char *path = object_get_canonical_path_component(val); error_setg(errp, ""can't use already busy memdev: %s"", path); g_free(path); } else { qdev_prop_allow_set_link_before_realize(obj, name, val, errp); } }","Yes, it is vulnerable."6765,"int av_seek_frame(AVFormatContext *s, int stream_index, int64_t timestamp, int flags) { int ret; AVStream *st; ff_read_frame_flush(s); if(flags & AVSEEK_FLAG_BYTE) return av_seek_frame_byte(s, stream_index, timestamp, flags); if(stream_index < 0){ stream_index= av_find_default_stream_index(s); if(stream_index < 0) return -1; st= s->streams[stream_index]; /* timestamp for default must be expressed in AV_TIME_BASE units */ timestamp = av_rescale(timestamp, st->time_base.den, AV_TIME_BASE * (int64_t)st->time_base.num); } /* first, we try the format specific seek */ if (s->iformat->read_seek) ret = s->iformat->read_seek(s, stream_index, timestamp, flags); else ret = -1; if (ret >= 0) { return 0; } if(s->iformat->read_timestamp) return av_seek_frame_binary(s, stream_index, timestamp, flags); else return av_seek_frame_generic(s, stream_index, timestamp, flags); }","Yes, it is vulnerable."6866,"static int mpeg_mux_end(AVFormatContext *ctx) { StreamInfo *stream; int i; /* flush each packet */ for(i=0;i<ctx->nb_streams;i++) { stream = ctx->streams[i]->priv_data; if (stream->buffer_ptr > 0) { if (i == (ctx->nb_streams - 1)) flush_packet(ctx, i, 1); else flush_packet(ctx, i, 0); } } /* write the end header */ //put_be32(&ctx->pb, ISO_11172_END_CODE); //put_flush_packet(&ctx->pb); for(i=0;i<ctx->nb_streams;i++) av_freep(&ctx->streams[i]->priv_data); return 0; }","No, it is non-vulnerable."6967,"static void virtio_scsi_complete_req(VirtIOSCSIReq *req) { VirtIOSCSI *s = req->dev; VirtQueue *vq = req->vq; VirtIODevice *vdev = VIRTIO_DEVICE(s); qemu_iovec_from_buf(&req->resp_iov, 0, &req->resp, req->resp_size); virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size); if (s->dataplane_started && !s->dataplane_fenced) { virtio_scsi_dataplane_notify(vdev, req); } else { virtio_notify(vdev, vq); } if (req->sreq) { req->sreq->hba_private = NULL; scsi_req_unref(req->sreq); } virtio_scsi_free_req(req); }","Yes, it is vulnerable."7068,"static int inet_connect_addr(struct addrinfo *addr, bool block, bool *in_progress) { int sock, rc; if (in_progress) { *in_progress = false; } sock = qemu_socket(addr->ai_family, addr->ai_socktype, addr->ai_protocol); if (sock < 0) { fprintf(stderr, ""%s: socket(%s): %s\n"", __func__, inet_strfamily(addr->ai_family), strerror(errno)); return -1; } setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); if (!block) { socket_set_nonblock(sock); } /* connect to peer */ do { rc = 0; if (connect(sock, addr->ai_addr, addr->ai_addrlen) < 0) { rc = -socket_error(); } } while (rc == -EINTR); if (!block && QEMU_SOCKET_RC_INPROGRESS(rc)) { if (in_progress) { *in_progress = true; } } else if (rc < 0) { closesocket(sock); return -1; } return sock; }","Yes, it is vulnerable."7169,"static void gen_rfci(DisasContext *ctx) { #if defined(CONFIG_USER_ONLY) gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC); #else if (unlikely(ctx->pr)) { gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC); return; } /* Restore CPU state */ gen_helper_rfci(cpu_env); gen_sync_exception(ctx); #endif }","Yes, it is vulnerable."7270,"static int opt_new_stream(const char *opt, const char *arg) { AVFormatContext *oc; if (nb_output_files <= 0) { fprintf(stderr, ""At least one output file must be specified\n""); ffmpeg_exit(1); } oc = output_files[nb_output_files - 1]; if (!strcmp(opt, ""newvideo"" )) new_video_stream (oc); else if (!strcmp(opt, ""newaudio"" )) new_audio_stream (oc); else if (!strcmp(opt, ""newsubtitle"")) new_subtitle_stream(oc); else av_assert0(0); return 0; }","Yes, it is vulnerable."7371,"void ff_vp3_v_loop_filter_c(uint8_t *first_pixel, int stride, int *bounding_values) { unsigned char *end; int filter_value; const int nstride= -stride; for (end= first_pixel + 8; first_pixel < end; first_pixel++) { filter_value = (first_pixel[2 * nstride] - first_pixel[ stride]) +3*(first_pixel[0 ] - first_pixel[nstride]); filter_value = bounding_values[(filter_value + 4) >> 3]; first_pixel[nstride] = av_clip_uint8(first_pixel[nstride] + filter_value); first_pixel[0] = av_clip_uint8(first_pixel[0] - filter_value); } }","No, it is non-vulnerable."7472,"void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height, int linesize_align[4]){ int w_align= 1; int h_align= 1; switch(s->pix_fmt){ case PIX_FMT_YUV420P: case PIX_FMT_YUYV422: case PIX_FMT_UYVY422: case PIX_FMT_YUV422P: case PIX_FMT_YUV440P: case PIX_FMT_YUV444P: case PIX_FMT_GRAY8: case PIX_FMT_GRAY16BE: case PIX_FMT_GRAY16LE: case PIX_FMT_YUVJ420P: case PIX_FMT_YUVJ422P: case PIX_FMT_YUVJ440P: case PIX_FMT_YUVJ444P: case PIX_FMT_YUVA420P: case PIX_FMT_YUV420P9LE: case PIX_FMT_YUV420P9BE: case PIX_FMT_YUV420P10LE: case PIX_FMT_YUV420P10BE: case PIX_FMT_YUV422P10LE: case PIX_FMT_YUV422P10BE: w_align= 16; //FIXME check for non mpeg style codecs and use less alignment h_align= 16; if(s->codec_id == CODEC_ID_MPEG2VIDEO || s->codec_id == CODEC_ID_MJPEG || s->codec_id == CODEC_ID_AMV || s->codec_id == CODEC_ID_THP || s->codec_id == CODEC_ID_H264) h_align= 32; // interlaced is rounded up to 2 MBs break; case PIX_FMT_YUV411P: case PIX_FMT_UYYVYY411: w_align=32; h_align=8; break; case PIX_FMT_YUV410P: if(s->codec_id == CODEC_ID_SVQ1){ w_align=64; h_align=64; } case PIX_FMT_RGB555: if(s->codec_id == CODEC_ID_RPZA){ w_align=4; h_align=4; } case PIX_FMT_PAL8: case PIX_FMT_BGR8: case PIX_FMT_RGB8: if(s->codec_id == CODEC_ID_SMC){ w_align=4; h_align=4; } break; case PIX_FMT_BGR24: if((s->codec_id == CODEC_ID_MSZH) || (s->codec_id == CODEC_ID_ZLIB)){ w_align=4; h_align=4; } break; default: w_align= 1; h_align= 1; break; } *width = FFALIGN(*width , w_align); *height= FFALIGN(*height, h_align); if(s->codec_id == CODEC_ID_H264 || s->lowres) *height+=2; // some of the optimized chroma MC reads one line too much // which is also done in mpeg decoders with lowres > 0 linesize_align[0] = linesize_align[1] = linesize_align[2] = linesize_align[3] = STRIDE_ALIGN; //STRIDE_ALIGN is 8 for SSE* but this does not work for SVQ1 chroma planes //we could change STRIDE_ALIGN to 16 for x86/sse but it would increase the //picture size unneccessarily in some cases. The solution here is not //pretty and better ideas are welcome! #if HAVE_MMX if(s->codec_id == CODEC_ID_SVQ1 || s->codec_id == CODEC_ID_VP5 || s->codec_id == CODEC_ID_VP6 || s->codec_id == CODEC_ID_VP6F || s->codec_id == CODEC_ID_VP6A) { linesize_align[0] = linesize_align[1] = linesize_align[2] = 16; } #endif }","Yes, it is vulnerable."7573,"static int h264_slice_header_parse(H264Context *h, H264SliceContext *sl, const H2645NAL *nal) { const SPS *sps; const PPS *pps; int ret; unsigned int slice_type, tmp, i; int field_pic_flag, bottom_field_flag; int frame_num, droppable, picture_structure; int mb_aff_frame = 0; sl->first_mb_addr = get_ue_golomb(&sl->gb); if (sl->first_mb_addr == 0) { // FIXME better field boundary detection if (h->current_slice && h->cur_pic_ptr && FIELD_PICTURE(h)) { ff_h264_field_end(h, sl, 1); } h->current_slice = 0; if (!h->first_field) { if (h->cur_pic_ptr && !h->droppable) { ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX, h->picture_structure == PICT_BOTTOM_FIELD); } h->cur_pic_ptr = NULL; } } slice_type = get_ue_golomb_31(&sl->gb); if (slice_type > 9) { av_log(h->avctx, AV_LOG_ERROR, ""slice type %d too large at %d\n"", slice_type, sl->first_mb_addr); return AVERROR_INVALIDDATA; } if (slice_type > 4) { slice_type -= 5; sl->slice_type_fixed = 1; } else sl->slice_type_fixed = 0; slice_type = ff_h264_golomb_to_pict_type[slice_type]; sl->slice_type = slice_type; sl->slice_type_nos = slice_type & 3; if (nal->type == NAL_IDR_SLICE && sl->slice_type_nos != AV_PICTURE_TYPE_I) { av_log(h->avctx, AV_LOG_ERROR, ""A non-intra slice in an IDR NAL unit.\n""); return AVERROR_INVALIDDATA; } sl->pps_id = get_ue_golomb(&sl->gb); if (sl->pps_id >= MAX_PPS_COUNT) { av_log(h->avctx, AV_LOG_ERROR, ""pps_id %u out of range\n"", sl->pps_id); return AVERROR_INVALIDDATA; } if (!h->ps.pps_list[sl->pps_id]) { av_log(h->avctx, AV_LOG_ERROR, ""non-existing PPS %u referenced\n"", sl->pps_id); return AVERROR_INVALIDDATA; } if (h->current_slice > 0 && h->ps.pps != (const PPS*)h->ps.pps_list[sl->pps_id]->data) { av_log(h->avctx, AV_LOG_ERROR, ""PPS changed between slices\n""); return AVERROR_INVALIDDATA; } pps = (const PPS*)h->ps.pps_list[sl->pps_id]->data; if (!h->ps.sps_list[pps->sps_id]) { av_log(h->avctx, AV_LOG_ERROR, ""non-existing SPS %u referenced\n"", pps->sps_id); return AVERROR_INVALIDDATA; } sps = (const SPS*)h->ps.sps_list[pps->sps_id]->data; frame_num = get_bits(&sl->gb, sps->log2_max_frame_num); if (!h->setup_finished) h->poc.frame_num = frame_num; sl->mb_mbaff = 0; droppable = nal->ref_idc == 0; if (sps->frame_mbs_only_flag) { picture_structure = PICT_FRAME; } else { field_pic_flag = get_bits1(&sl->gb); if (field_pic_flag) { bottom_field_flag = get_bits1(&sl->gb); picture_structure = PICT_TOP_FIELD + bottom_field_flag; } else { picture_structure = PICT_FRAME; mb_aff_frame = sps->mb_aff; } } if (!h->setup_finished) { h->mb_aff_frame = mb_aff_frame; } sl->picture_structure = picture_structure; sl->mb_field_decoding_flag = picture_structure != PICT_FRAME; if (h->current_slice != 0) { if (h->picture_structure != picture_structure || h->droppable != droppable) { av_log(h->avctx, AV_LOG_ERROR, ""Changing field mode (%d -> %d) between slices is not allowed\n"", h->picture_structure, picture_structure); return AVERROR_INVALIDDATA; } else if (!h->cur_pic_ptr) { av_log(h->avctx, AV_LOG_ERROR, ""unset cur_pic_ptr on slice %d\n"", h->current_slice + 1); return AVERROR_INVALIDDATA; } } if (picture_structure == PICT_FRAME) { h->curr_pic_num = h->poc.frame_num; h->max_pic_num = 1 << sps->log2_max_frame_num; } else { h->curr_pic_num = 2 * h->poc.frame_num + 1; h->max_pic_num = 1 << (sps->log2_max_frame_num + 1); } if (nal->type == NAL_IDR_SLICE) get_ue_golomb(&sl->gb); /* idr_pic_id */ if (sps->poc_type == 0) { int poc_lsb = get_bits(&sl->gb, sps->log2_max_poc_lsb); if (!h->setup_finished) h->poc.poc_lsb = poc_lsb; if (pps->pic_order_present == 1 && picture_structure == PICT_FRAME) { int delta_poc_bottom = get_se_golomb(&sl->gb); if (!h->setup_finished) h->poc.delta_poc_bottom = delta_poc_bottom; } } if (sps->poc_type == 1 && !sps->delta_pic_order_always_zero_flag) { int delta_poc = get_se_golomb(&sl->gb); if (!h->setup_finished) h->poc.delta_poc[0] = delta_poc; if (pps->pic_order_present == 1 && picture_structure == PICT_FRAME) { delta_poc = get_se_golomb(&sl->gb); if (!h->setup_finished) h->poc.delta_poc[1] = delta_poc; } } if (pps->redundant_pic_cnt_present) sl->redundant_pic_count = get_ue_golomb(&sl->gb); if (sl->slice_type_nos == AV_PICTURE_TYPE_B) sl->direct_spatial_mv_pred = get_bits1(&sl->gb); ret = ff_h264_parse_ref_count(&sl->list_count, sl->ref_count, &sl->gb, pps, sl->slice_type_nos, picture_structure); if (ret < 0) return ret; if (sl->slice_type_nos != AV_PICTURE_TYPE_I) { ret = ff_h264_decode_ref_pic_list_reordering(h, sl); if (ret < 0) { sl->ref_count[1] = sl->ref_count[0] = 0; return ret; } } sl->pwt.use_weight = 0; for (i = 0; i < 2; i++) { sl->pwt.luma_weight_flag[i] = 0; sl->pwt.chroma_weight_flag[i] = 0; } if ((pps->weighted_pred && sl->slice_type_nos == AV_PICTURE_TYPE_P) || (pps->weighted_bipred_idc == 1 && sl->slice_type_nos == AV_PICTURE_TYPE_B)) ff_h264_pred_weight_table(&sl->gb, sps, sl->ref_count, sl->slice_type_nos, &sl->pwt); sl->explicit_ref_marking = 0; if (nal->ref_idc) { ret = ff_h264_decode_ref_pic_marking(h, sl, &sl->gb); if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE)) return AVERROR_INVALIDDATA; } if (sl->slice_type_nos != AV_PICTURE_TYPE_I && pps->cabac) { tmp = get_ue_golomb_31(&sl->gb); if (tmp > 2) { av_log(h->avctx, AV_LOG_ERROR, ""cabac_init_idc %u overflow\n"", tmp); return AVERROR_INVALIDDATA; } sl->cabac_init_idc = tmp; } sl->last_qscale_diff = 0; tmp = pps->init_qp + get_se_golomb(&sl->gb); if (tmp > 51 + 6 * (sps->bit_depth_luma - 8)) { av_log(h->avctx, AV_LOG_ERROR, ""QP %u out of range\n"", tmp); return AVERROR_INVALIDDATA; } sl->qscale = tmp; sl->chroma_qp[0] = get_chroma_qp(pps, 0, sl->qscale); sl->chroma_qp[1] = get_chroma_qp(pps, 1, sl->qscale); // FIXME qscale / qp ... stuff if (sl->slice_type == AV_PICTURE_TYPE_SP) get_bits1(&sl->gb); /* sp_for_switch_flag */ if (sl->slice_type == AV_PICTURE_TYPE_SP || sl->slice_type == AV_PICTURE_TYPE_SI) get_se_golomb(&sl->gb); /* slice_qs_delta */ sl->deblocking_filter = 1; sl->slice_alpha_c0_offset = 0; sl->slice_beta_offset = 0; if (pps->deblocking_filter_parameters_present) { tmp = get_ue_golomb_31(&sl->gb); if (tmp > 2) { av_log(h->avctx, AV_LOG_ERROR, ""deblocking_filter_idc %u out of range\n"", tmp); return AVERROR_INVALIDDATA; } sl->deblocking_filter = tmp; if (sl->deblocking_filter < 2) sl->deblocking_filter ^= 1; // 1<->0 if (sl->deblocking_filter) { sl->slice_alpha_c0_offset = get_se_golomb(&sl->gb) * 2; sl->slice_beta_offset = get_se_golomb(&sl->gb) * 2; if (sl->slice_alpha_c0_offset > 12 || sl->slice_alpha_c0_offset < -12 || sl->slice_beta_offset > 12 || sl->slice_beta_offset < -12) { av_log(h->avctx, AV_LOG_ERROR, ""deblocking filter parameters %d %d out of range\n"", sl->slice_alpha_c0_offset, sl->slice_beta_offset); return AVERROR_INVALIDDATA; } } } return 0; }","No, it is non-vulnerable."7674,"static inline void mct_decode(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile) { int i, csize = 1; void *src[3]; for (i = 1; i < 3; i++) if (tile->codsty[0].transform != tile->codsty[i].transform) { av_log(s->avctx, AV_LOG_ERROR, ""Transforms mismatch, MCT not supported\n""); return; } for (i = 0; i < 3; i++) if (tile->codsty[0].transform == FF_DWT97) src[i] = tile->comp[i].f_data; else src[i] = tile->comp[i].i_data; for (i = 0; i < 2; i++) csize *= tile->comp[0].coord[i][1] - tile->comp[0].coord[i][0]; s->dsp.mct_decode[tile->codsty[0].transform](src[0], src[1], src[2], csize); }","No, it is non-vulnerable."7775,static inline void RENAME(rgb2rgb_init)(void) { #if !COMPILE_TEMPLATE_SSE2 #if !COMPILE_TEMPLATE_AMD3DNOW rgb15to16 = RENAME(rgb15to16); rgb15tobgr24 = RENAME(rgb15tobgr24); rgb15to32 = RENAME(rgb15to32); rgb16tobgr24 = RENAME(rgb16tobgr24); rgb16to32 = RENAME(rgb16to32); rgb16to15 = RENAME(rgb16to15); rgb24tobgr16 = RENAME(rgb24tobgr16); rgb24tobgr15 = RENAME(rgb24tobgr15); rgb24tobgr32 = RENAME(rgb24tobgr32); rgb32to16 = RENAME(rgb32to16); rgb32to15 = RENAME(rgb32to15); rgb32tobgr24 = RENAME(rgb32tobgr24); rgb24to15 = RENAME(rgb24to15); rgb24to16 = RENAME(rgb24to16); rgb24tobgr24 = RENAME(rgb24tobgr24); shuffle_bytes_2103 = RENAME(shuffle_bytes_2103); rgb32tobgr16 = RENAME(rgb32tobgr16); rgb32tobgr15 = RENAME(rgb32tobgr15); yv12toyuy2 = RENAME(yv12toyuy2); yv12touyvy = RENAME(yv12touyvy); yuv422ptoyuy2 = RENAME(yuv422ptoyuy2); yuv422ptouyvy = RENAME(yuv422ptouyvy); yuy2toyv12 = RENAME(yuy2toyv12); vu9_to_vu12 = RENAME(vu9_to_vu12); yvu9_to_yuy2 = RENAME(yvu9_to_yuy2); uyvytoyuv422 = RENAME(uyvytoyuv422); yuyvtoyuv422 = RENAME(yuyvtoyuv422); #endif /* !COMPILE_TEMPLATE_AMD3DNOW */ #if COMPILE_TEMPLATE_MMXEXT || COMPILE_TEMPLATE_AMD3DNOW planar2x = RENAME(planar2x); #endif /* COMPILE_TEMPLATE_MMXEXT || COMPILE_TEMPLATE_AMD3DNOW */ rgb24toyv12 = RENAME(rgb24toyv12); yuyvtoyuv420 = RENAME(yuyvtoyuv420); uyvytoyuv420 = RENAME(uyvytoyuv420); #endif /* !COMPILE_TEMPLATE_SSE2 */ #if !COMPILE_TEMPLATE_AMD3DNOW interleaveBytes = RENAME(interleaveBytes); #endif /* !COMPILE_TEMPLATE_AMD3DNOW */ },"Yes, it is vulnerable."7876,"static int hls_write_header(AVFormatContext *s) { HLSContext *hls = s->priv_data; int ret, i; char *p; const char *pattern = ""%d.ts""; int basename_size = strlen(s->filename) + strlen(pattern); hls->number = 0; hls->recording_time = hls->time * 1000000; hls->start_pts = AV_NOPTS_VALUE; for (i = 0; i < s->nb_streams; i++) hls->has_video += s->streams[i]->codec->codec_type == AVMEDIA_TYPE_VIDEO; if (hls->has_video > 1) av_log(s, AV_LOG_WARNING, ""More than a single video stream present, "" ""expect issues decoding it.\n""); hls->oformat = av_guess_format(""mpegts"", NULL, NULL); if (!hls->oformat) { ret = AVERROR_MUXER_NOT_FOUND; goto fail; } hls->basename = av_malloc(basename_size); if (!hls->basename) { ret = AVERROR(ENOMEM); goto fail; } strcpy(hls->basename, s->filename); p = strrchr(hls->basename, '.'); if (p) *p = '\0'; av_strlcat(hls->basename, ""%d.ts"", basename_size); if ((ret = hls_mux_init(s)) < 0) goto fail; if ((ret = hls_start(s)) < 0) goto fail; if ((ret = avformat_write_header(hls->avf, NULL)) < 0) return ret; fail: if (ret) { av_free(hls->basename); if (hls->avf) avformat_free_context(hls->avf); } return ret; }","Yes, it is vulnerable."7977,"static inline void RENAME(bgr24ToY)(uint8_t *dst, uint8_t *src, long width) { #ifdef HAVE_MMX asm volatile( ""mov %2, %%""REG_a"" \n\t"" ""movq ""MANGLE(bgr2YCoeff)"", %%mm6 \n\t"" ""movq ""MANGLE(w1111)"", %%mm5 \n\t"" ""pxor %%mm7, %%mm7 \n\t"" ""lea (%%""REG_a"", %%""REG_a"", 2), %%""REG_d""\n\t"" ASMALIGN(4) ""1: \n\t"" PREFETCH"" 64(%0, %%""REG_d"") \n\t"" ""movd (%0, %%""REG_d""), %%mm0 \n\t"" ""movd 3(%0, %%""REG_d""), %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm0 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""movd 6(%0, %%""REG_d""), %%mm2 \n\t"" ""movd 9(%0, %%""REG_d""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm0 \n\t"" ""pmaddwd %%mm6, %%mm1 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" ""pmaddwd %%mm6, %%mm3 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm0 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm1, %%mm0 \n\t"" ""packssdw %%mm3, %%mm2 \n\t"" ""pmaddwd %%mm5, %%mm0 \n\t"" ""pmaddwd %%mm5, %%mm2 \n\t"" ""packssdw %%mm2, %%mm0 \n\t"" ""psraw $7, %%mm0 \n\t"" ""movd 12(%0, %%""REG_d""), %%mm4 \n\t"" ""movd 15(%0, %%""REG_d""), %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm4 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""movd 18(%0, %%""REG_d""), %%mm2 \n\t"" ""movd 21(%0, %%""REG_d""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm4 \n\t"" ""pmaddwd %%mm6, %%mm1 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" ""pmaddwd %%mm6, %%mm3 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm4 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm1, %%mm4 \n\t"" ""packssdw %%mm3, %%mm2 \n\t"" ""pmaddwd %%mm5, %%mm4 \n\t"" ""pmaddwd %%mm5, %%mm2 \n\t"" ""add $24, %%""REG_d"" \n\t"" ""packssdw %%mm2, %%mm4 \n\t"" ""psraw $7, %%mm4 \n\t"" ""packuswb %%mm4, %%mm0 \n\t"" ""paddusb ""MANGLE(bgr2YOffset)"", %%mm0 \n\t"" ""movq %%mm0, (%1, %%""REG_a"") \n\t"" ""add $8, %%""REG_a"" \n\t"" "" js 1b \n\t"" : : ""r"" (src+width*3), ""r"" (dst+width), ""g"" (-width) : ""%""REG_a, ""%""REG_d ); #else int i; for(i=0; i<width; i++) { int b= src[i*3+0]; int g= src[i*3+1]; int r= src[i*3+2]; dst[i]= ((RY*r + GY*g + BY*b + (33<<(RGB2YUV_SHIFT-1)) )>>RGB2YUV_SHIFT); } #endif }","Yes, it is vulnerable."8078,static void vvfat_close(BlockDriverState *bs) { BDRVVVFATState *s = bs->opaque; vvfat_close_current_file(s); array_free(&(s->fat)); array_free(&(s->directory)); array_free(&(s->mapping)); if(s->cluster_buffer) free(s->cluster_buffer); },"Yes, it is vulnerable."8179,"static int ivi_mc(ivi_mc_func mc, int16_t *buf, const int16_t *ref_buf, int offs, int mv_x, int mv_y, uint32_t pitch, int mc_type) { int ref_offs = offs + mv_y * pitch + mv_x; if (offs < 0 || ref_offs < 0 || !ref_buf) return AVERROR_INVALIDDATA; mc(buf + offs, ref_buf + ref_offs, pitch, mc_type); return 0; }","No, it is non-vulnerable."8280,"static void test_io_channel_setup_sync(SocketAddressLegacy *listen_addr, SocketAddressLegacy *connect_addr, QIOChannel **src, QIOChannel **dst) { QIOChannelSocket *lioc; lioc = qio_channel_socket_new(); qio_channel_socket_listen_sync(lioc, listen_addr, &error_abort); if (listen_addr->type == SOCKET_ADDRESS_LEGACY_KIND_INET) { SocketAddressLegacy *laddr = qio_channel_socket_get_local_address( lioc, &error_abort); g_free(connect_addr->u.inet.data->port); connect_addr->u.inet.data->port = g_strdup(laddr->u.inet.data->port); qapi_free_SocketAddressLegacy(laddr); } *src = QIO_CHANNEL(qio_channel_socket_new()); qio_channel_socket_connect_sync( QIO_CHANNEL_SOCKET(*src), connect_addr, &error_abort); qio_channel_set_delay(*src, false); qio_channel_wait(QIO_CHANNEL(lioc), G_IO_IN); *dst = QIO_CHANNEL(qio_channel_socket_accept(lioc, &error_abort)); g_assert(*dst); test_io_channel_set_socket_bufs(*src, *dst); object_unref(OBJECT(lioc)); }","No, it is non-vulnerable."8381,"static void monitor_readline(const char *prompt, int is_password, char *buf, int buf_size) { readline_start(prompt, is_password, monitor_readline_cb, NULL); readline_show_prompt(); monitor_readline_buf = buf; monitor_readline_buf_size = buf_size; monitor_readline_started = 1; while (monitor_readline_started) { main_loop_wait(10); } }","No, it is non-vulnerable."8482,"static int cllc_decode_frame(AVCodecContext *avctx, void *data, int *got_picture_ptr, AVPacket *avpkt) { CLLCContext *ctx = avctx->priv_data; AVFrame *pic = data; ThreadFrame frame = { .f = data }; uint8_t *src = avpkt->data; uint32_t info_tag, info_offset; int data_size; GetBitContext gb; int coding_type, ret; if (avpkt->size < 4 + 4) { av_log(avctx, AV_LOG_ERROR, ""Frame is too small %d.\n"", avpkt->size); } info_offset = 0; info_tag = AV_RL32(src); if (info_tag == MKTAG('I', 'N', 'F', 'O')) { info_offset = AV_RL32(src + 4); if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) { av_log(avctx, AV_LOG_ERROR, ""Invalid INFO header offset: 0x%08""PRIX32"" is too large.\n"", info_offset); } ff_canopus_parse_info_tag(avctx, src + 8, info_offset); info_offset += 8; src += info_offset; } data_size = (avpkt->size - info_offset) & ~1; /* Make sure our bswap16'd buffer is big enough */ av_fast_padded_malloc(&ctx->swapped_buf, &ctx->swapped_buf_size, data_size); if (!ctx->swapped_buf) { av_log(avctx, AV_LOG_ERROR, ""Could not allocate swapped buffer.\n""); return AVERROR(ENOMEM); } /* bswap16 the buffer since CLLC's bitreader works in 16-bit words */ ctx->bdsp.bswap16_buf((uint16_t *) ctx->swapped_buf, (uint16_t *) src, data_size / 2); if ((ret = init_get_bits8(&gb, ctx->swapped_buf, data_size)) < 0) return ret; /* * Read in coding type. The types are as follows: * * 0 - YUY2 * 1 - BGR24 (Triples) * 2 - BGR24 (Quads) * 3 - BGRA */ coding_type = (AV_RL32(src) >> 8) & 0xFF; av_log(avctx, AV_LOG_DEBUG, ""Frame coding type: %d\n"", coding_type); switch (coding_type) { case 0: avctx->pix_fmt = AV_PIX_FMT_YUV422P; avctx->bits_per_raw_sample = 8; if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) return ret; ret = decode_yuv_frame(ctx, &gb, pic); if (ret < 0) return ret; break; case 1: case 2: avctx->pix_fmt = AV_PIX_FMT_RGB24; avctx->bits_per_raw_sample = 8; if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) return ret; ret = decode_rgb24_frame(ctx, &gb, pic); if (ret < 0) return ret; break; case 3: avctx->pix_fmt = AV_PIX_FMT_ARGB; avctx->bits_per_raw_sample = 8; if ((ret = ff_thread_get_buffer(avctx, &frame, 0)) < 0) return ret; ret = decode_argb_frame(ctx, &gb, pic); if (ret < 0) return ret; break; default: av_log(avctx, AV_LOG_ERROR, ""Unknown coding type: %d.\n"", coding_type); } pic->key_frame = 1; pic->pict_type = AV_PICTURE_TYPE_I; *got_picture_ptr = 1; return avpkt->size; }","Yes, it is vulnerable."8583,"static av_always_inline void decode_dc_coeffs(GetBitContext *gb, int16_t *out, int blocks_per_slice) { int16_t prev_dc; int code, i, sign; OPEN_READER(re, gb); DECODE_CODEWORD(code, FIRST_DC_CB); prev_dc = TOSIGNED(code); out[0] = prev_dc; out += 64; // dc coeff for the next block code = 5; sign = 0; for (i = 1; i < blocks_per_slice; i++, out += 64) { DECODE_CODEWORD(code, dc_codebook[FFMIN(code, 6U)]); if(code) sign ^= -(code & 1); else sign = 0; prev_dc += (((code + 1) >> 1) ^ sign) - sign; out[0] = prev_dc; } CLOSE_READER(re, gb); }","Yes, it is vulnerable."8684,"static void avc_luma_midh_qrt_and_aver_dst_8w_msa(const uint8_t *src, int32_t src_stride, uint8_t *dst, int32_t dst_stride, int32_t height, uint8_t horiz_offset) { uint32_t multiple8_cnt; for (multiple8_cnt = 2; multiple8_cnt--;) { avc_luma_midh_qrt_and_aver_dst_4w_msa(src, src_stride, dst, dst_stride, height, horiz_offset); src += 4; dst += 4; } }","No, it is non-vulnerable."8785,"static int mp_pacl_removexattr(FsContext *ctx, const char *path, const char *name) { int ret; char *buffer; buffer = rpath(ctx, path); ret = lremovexattr(buffer, MAP_ACL_ACCESS); if (ret == -1 && errno == ENODATA) { /* * We don't get ENODATA error when trying to remove a * posix acl that is not present. So don't throw the error * even in case of mapped security model */ errno = 0; ret = 0; } g_free(buffer); return ret; }","Yes, it is vulnerable."8886,"static av_cold OMXContext *omx_init(void *logctx, const char *libname, const char *prefix) { static const char * const libnames[] = { ""libOMX_Core.so"", ""libOmxCore.so"", NULL }; const char* const* nameptr; int ret = AVERROR_ENCODER_NOT_FOUND; OMXContext *omx_context; omx_context = av_mallocz(sizeof(*omx_context)); if (!omx_context) return NULL; if (libname) { ret = omx_try_load(omx_context, logctx, libname, prefix); if (ret < 0) { av_free(omx_context); return NULL; } } else { for (nameptr = libnames; *nameptr; nameptr++) if (!(ret = omx_try_load(omx_context, logctx, *nameptr, prefix))) break; if (!*nameptr) { av_free(omx_context); return NULL; } } omx_context->ptr_Init(); return omx_context; }","Yes, it is vulnerable."8987,int av_get_channel_layout_nb_channels(int64_t channel_layout) { int count; uint64_t x = channel_layout; for (count = 0; x; count++) x &= x-1; // unset lowest set bit return count; },"No, it is non-vulnerable."9088,"static void openpic_load_IRQ_queue(QEMUFile* f, IRQQueue *q) { unsigned int i; for (i = 0; i < BF_WIDTH(MAX_IRQ); i++) qemu_get_be32s(f, &q->queue[i]); qemu_get_sbe32s(f, &q->next); qemu_get_sbe32s(f, &q->priority); }","No, it is non-vulnerable."9189,"static void cs_write (void *opaque, target_phys_addr_t addr, uint64_t val64, unsigned size) { CSState *s = opaque; uint32_t saddr, iaddr, val; saddr = addr; val = val64; switch (saddr) { case Index_Address: if (!(s->regs[Index_Address] & MCE) && (val & MCE) && (s->dregs[Interface_Configuration] & (3 << 3))) s->aci_counter = conf.aci_counter; s->regs[Index_Address] = val & ~(1 << 7); break; case Index_Data: if (!(s->dregs[MODE_And_ID] & MODE2)) iaddr = s->regs[Index_Address] & 0x0f; else iaddr = s->regs[Index_Address] & 0x1f; switch (iaddr) { case RESERVED: case RESERVED_2: case RESERVED_3: lwarn (""attempt to write %#x to reserved indirect register %d\n"", val, iaddr); break; case FS_And_Playback_Data_Format: if (s->regs[Index_Address] & MCE) { cs_reset_voices (s, val); } else { if (s->dregs[Alternate_Feature_Status] & PMCE) { val = (val & ~0x0f) | (s->dregs[iaddr] & 0x0f); cs_reset_voices (s, val); } else { lwarn (""[P]MCE(%#x, %#x) is not set, val=%#x\n"", s->regs[Index_Address], s->dregs[Alternate_Feature_Status], val); break; } } s->dregs[iaddr] = val; break; case Interface_Configuration: val &= ~(1 << 5); /* D5 is reserved */ s->dregs[iaddr] = val; if (val & PPIO) { lwarn (""PIO is not supported (%#x)\n"", val); break; } if (val & PEN) { if (!s->dma_running) { cs_reset_voices (s, s->dregs[FS_And_Playback_Data_Format]); } } else { if (s->dma_running) { DMA_release_DREQ (s->dma); AUD_set_active_out (s->voice, 0); s->dma_running = 0; } } break; case Error_Status_And_Initialization: lwarn (""attempt to write to read only register %d\n"", iaddr); break; case MODE_And_ID: dolog (""val=%#x\n"", val); if (val & MODE2) s->dregs[iaddr] |= MODE2; else s->dregs[iaddr] &= ~MODE2; break; case Alternate_Feature_Enable_I: if (val & TE) lerr (""timer is not yet supported\n""); s->dregs[iaddr] = val; break; case Alternate_Feature_Status: if ((s->dregs[iaddr] & PI) && !(val & PI)) { /* XXX: TI CI */ qemu_irq_lower (s->pic); s->regs[Status] &= ~INT; } s->dregs[iaddr] = val; break; case Version_Chip_ID: lwarn (""write to Version_Chip_ID register %#x\n"", val); s->dregs[iaddr] = val; break; default: s->dregs[iaddr] = val; break; } dolog (""written value %#x to indirect register %d\n"", val, iaddr); break; case Status: if (s->regs[Status] & INT) { qemu_irq_lower (s->pic); } s->regs[Status] &= ~INT; s->dregs[Alternate_Feature_Status] &= ~(PI | CI | TI); break; case PIO_Data: lwarn (""attempt to write value %#x to PIO register\n"", val); break; } }","No, it is non-vulnerable."9290,"static uint64_t omap_pin_cfg_read(void *opaque, target_phys_addr_t addr, unsigned size) { struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque; if (size != 4) { return omap_badwidth_read32(opaque, addr); } switch (addr) { case 0x00: /* FUNC_MUX_CTRL_0 */ case 0x04: /* FUNC_MUX_CTRL_1 */ case 0x08: /* FUNC_MUX_CTRL_2 */ return s->func_mux_ctrl[addr >> 2]; case 0x0c: /* COMP_MODE_CTRL_0 */ return s->comp_mode_ctrl[0]; case 0x10: /* FUNC_MUX_CTRL_3 */ case 0x14: /* FUNC_MUX_CTRL_4 */ case 0x18: /* FUNC_MUX_CTRL_5 */ case 0x1c: /* FUNC_MUX_CTRL_6 */ case 0x20: /* FUNC_MUX_CTRL_7 */ case 0x24: /* FUNC_MUX_CTRL_8 */ case 0x28: /* FUNC_MUX_CTRL_9 */ case 0x2c: /* FUNC_MUX_CTRL_A */ case 0x30: /* FUNC_MUX_CTRL_B */ case 0x34: /* FUNC_MUX_CTRL_C */ case 0x38: /* FUNC_MUX_CTRL_D */ return s->func_mux_ctrl[(addr >> 2) - 1]; case 0x40: /* PULL_DWN_CTRL_0 */ case 0x44: /* PULL_DWN_CTRL_1 */ case 0x48: /* PULL_DWN_CTRL_2 */ case 0x4c: /* PULL_DWN_CTRL_3 */ return s->pull_dwn_ctrl[(addr & 0xf) >> 2]; case 0x50: /* GATE_INH_CTRL_0 */ return s->gate_inh_ctrl[0]; case 0x60: /* VOLTAGE_CTRL_0 */ return s->voltage_ctrl[0]; case 0x70: /* TEST_DBG_CTRL_0 */ return s->test_dbg_ctrl[0]; case 0x80: /* MOD_CONF_CTRL_0 */ return s->mod_conf_ctrl[0]; } OMAP_BAD_REG(addr); return 0; }","No, it is non-vulnerable."9391,"static int decode0(GetByteContext *gb, RangeCoder *rc, unsigned cumFreq, unsigned freq, unsigned total_freq) { int t; if (total_freq == 0) return AVERROR_INVALIDDATA; t = rc->range * (uint64_t)cumFreq / total_freq; rc->code1 += t + 1; rc->range = rc->range * (uint64_t)(freq + cumFreq) / total_freq - (t + 1); while (rc->range < TOP && bytestream2_get_bytes_left(gb) > 0) { unsigned byte = bytestream2_get_byte(gb); rc->code = (rc->code << 8) | byte; rc->code1 <<= 8; rc->range <<= 8; } return 0; }","Yes, it is vulnerable."9492,"static int hevc_decode_frame(AVCodecContext *avctx, void *data, int *got_output, AVPacket *avpkt) { int ret; int new_extradata_size; uint8_t *new_extradata; HEVCContext *s = avctx->priv_data; if (!avpkt->size) { ret = ff_hevc_output_frame(s, data, 1); if (ret < 0) return ret; *got_output = ret; return 0; } new_extradata = av_packet_get_side_data(avpkt, AV_PKT_DATA_NEW_EXTRADATA, &new_extradata_size); if (new_extradata && new_extradata_size > 0) { ret = hevc_decode_extradata(s, new_extradata, new_extradata_size); if (ret < 0) return ret; } s->ref = NULL; ret = decode_nal_units(s, avpkt->data, avpkt->size); if (ret < 0) return ret; if (avctx->hwaccel) { if (s->ref && (ret = avctx->hwaccel->end_frame(avctx)) < 0) { av_log(avctx, AV_LOG_ERROR, ""hardware accelerator failed to decode picture\n""); ff_hevc_unref_frame(s, s->ref, ~0); return ret; } } else { /* verify the SEI checksum */ if (avctx->err_recognition & AV_EF_CRCCHECK && s->is_decoded && s->sei.picture_hash.is_md5) { ret = verify_md5(s, s->ref->frame); if (ret < 0 && avctx->err_recognition & AV_EF_EXPLODE) { ff_hevc_unref_frame(s, s->ref, ~0); return ret; } } } s->sei.picture_hash.is_md5 = 0; if (s->is_decoded) { av_log(avctx, AV_LOG_DEBUG, ""Decoded frame with POC %d.\n"", s->poc); s->is_decoded = 0; } if (s->output_frame->buf[0]) { av_frame_move_ref(data, s->output_frame); *got_output = 1; } return avpkt->size; }","Yes, it is vulnerable."9593,"static void RENAME(yuv2bgr24_1)(SwsContext *c, const int16_t *buf0, const int16_t *ubuf[2], const int16_t *bguf[2], const int16_t *abuf0, uint8_t *dest, int dstW, int uvalpha, int y) { const int16_t *ubuf0 = ubuf[0], *ubuf1 = ubuf[1]; const int16_t *buf1= buf0; //FIXME needed for RGB1/BGR1 if (uvalpha < 2048) { // note this is not correct (shifts chrominance by 0.5 pixels) but it is a bit faster __asm__ volatile( ""mov %%""REG_b"", ""ESP_OFFSET""(%5) \n\t"" ""mov %4, %%""REG_b"" \n\t"" ""push %%""REG_BP"" \n\t"" YSCALEYUV2RGB1(%%REGBP, %5) ""pxor %%mm7, %%mm7 \n\t"" WRITEBGR24(%%REGb, 8280(%5), %%REGBP) ""pop %%""REG_BP"" \n\t"" ""mov ""ESP_OFFSET""(%5), %%""REG_b"" \n\t"" :: ""c"" (buf0), ""d"" (buf1), ""S"" (ubuf0), ""D"" (ubuf1), ""m"" (dest), ""a"" (&c->redDither) ); } else { __asm__ volatile( ""mov %%""REG_b"", ""ESP_OFFSET""(%5) \n\t"" ""mov %4, %%""REG_b"" \n\t"" ""push %%""REG_BP"" \n\t"" YSCALEYUV2RGB1b(%%REGBP, %5) ""pxor %%mm7, %%mm7 \n\t"" WRITEBGR24(%%REGb, 8280(%5), %%REGBP) ""pop %%""REG_BP"" \n\t"" ""mov ""ESP_OFFSET""(%5), %%""REG_b"" \n\t"" :: ""c"" (buf0), ""d"" (buf1), ""S"" (ubuf0), ""D"" (ubuf1), ""m"" (dest), ""a"" (&c->redDither) ); } }","Yes, it is vulnerable."9694,"static always_inline void gen_rldimi (DisasContext *ctx, int mbn, int shn) { uint64_t mask; uint32_t sh, mb; sh = SH(ctx->opcode) | (shn << 5); mb = MB(ctx->opcode) | (mbn << 5); if (likely(sh == 0)) { if (likely(mb == 0)) { gen_op_load_gpr_T0(rS(ctx->opcode)); goto do_store; } else if (likely(mb == 63)) { gen_op_load_gpr_T0(rA(ctx->opcode)); goto do_store; } gen_op_load_gpr_T0(rS(ctx->opcode)); gen_op_load_gpr_T1(rA(ctx->opcode)); goto do_mask; } gen_op_load_gpr_T0(rS(ctx->opcode)); gen_op_load_gpr_T1(rA(ctx->opcode)); gen_op_rotli64_T0(sh); do_mask: mask = MASK(mb, 63 - sh); gen_andi_T0_64(ctx, mask); gen_andi_T1_64(ctx, ~mask); gen_op_or(); do_store: gen_op_store_T0_gpr(rA(ctx->opcode)); if (unlikely(Rc(ctx->opcode) != 0)) gen_set_Rc0(ctx); }","Yes, it is vulnerable."9795,"static int dx2_decode_slice_410(GetBitContext *gb, AVFrame *frame, int line, int left, uint8_t lru[3][8]) { int x, y, i, j; int width = frame->width; int ystride = frame->linesize[0]; int ustride = frame->linesize[1]; int vstride = frame->linesize[2]; uint8_t *Y = frame->data[0] + ystride * line; uint8_t *U = frame->data[1] + (ustride >> 2) * line; uint8_t *V = frame->data[2] + (vstride >> 2) * line; for (y = 0; y < left - 3 && get_bits_left(gb) > 16; y += 4) { for (x = 0; x < width; x += 4) { for (j = 0; j < 4; j++) for (i = 0; i < 4; i++) Y[x + i + j * ystride] = decode_sym(gb, lru[0]); U[x >> 2] = decode_sym(gb, lru[1]) ^ 0x80; V[x >> 2] = decode_sym(gb, lru[2]) ^ 0x80; } Y += ystride << 2; U += ustride; V += vstride; } return y; }","Yes, it is vulnerable."9896,"void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr) { LOG_INT(""kqemu_set_notdirty: addr=%08lx\n"", (unsigned long)ram_addr); /* we only track transitions to dirty state */ if (phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] != 0xff) return; if (nb_ram_pages_to_update >= KQEMU_MAX_RAM_PAGES_TO_UPDATE) nb_ram_pages_to_update = KQEMU_RAM_PAGES_UPDATE_ALL; else ram_pages_to_update[nb_ram_pages_to_update++] = ram_addr; }","No, it is non-vulnerable."9997,"static void put_no_rnd_pixels_y2_mmx( UINT8 *block, const UINT8 *pixels, int line_size, int h) { UINT8 *p; const UINT8 *pix; p = block; pix = pixels; MOVQ_ZERO(mm7); JUMPALIGN(); do { __asm __volatile( ""movq %1, %%mm0\n\t"" ""movq %2, %%mm1\n\t"" ""movq %%mm0, %%mm2\n\t"" ""movq %%mm1, %%mm3\n\t"" ""punpcklbw %%mm7, %%mm0\n\t"" ""punpcklbw %%mm7, %%mm1\n\t"" ""punpckhbw %%mm7, %%mm2\n\t"" ""punpckhbw %%mm7, %%mm3\n\t"" ""paddusw %%mm1, %%mm0\n\t"" ""paddusw %%mm3, %%mm2\n\t"" ""psrlw $1, %%mm0\n\t"" ""psrlw $1, %%mm2\n\t"" ""packuswb %%mm2, %%mm0\n\t"" ""movq %%mm0, %0\n\t"" :""=m""(*p) :""m""(*pix), ""m""(*(pix+line_size)) :""memory""); pix += line_size; p += line_size; } while(--h); }","No, it is non-vulnerable."10098,"static int iscsi_open(BlockDriverState *bs, const char *filename, int flags) { IscsiLun *iscsilun = bs->opaque; struct iscsi_context *iscsi = NULL; struct iscsi_url *iscsi_url = NULL; struct IscsiTask task; char *initiator_name = NULL; int ret; if ((BDRV_SECTOR_SIZE % 512) != 0) { error_report(""iSCSI: Invalid BDRV_SECTOR_SIZE. "" ""BDRV_SECTOR_SIZE(%lld) is not a multiple "" ""of 512"", BDRV_SECTOR_SIZE); return -EINVAL; } iscsi_url = iscsi_parse_full_url(iscsi, filename); if (iscsi_url == NULL) { error_report(""Failed to parse URL : %s %s"", filename, iscsi_get_error(iscsi)); ret = -EINVAL; goto out; } memset(iscsilun, 0, sizeof(IscsiLun)); initiator_name = parse_initiator_name(iscsi_url->target); iscsi = iscsi_create_context(initiator_name); if (iscsi == NULL) { error_report(""iSCSI: Failed to create iSCSI context.""); ret = -ENOMEM; goto out; } if (iscsi_set_targetname(iscsi, iscsi_url->target)) { error_report(""iSCSI: Failed to set target name.""); ret = -EINVAL; goto out; } if (iscsi_url->user != NULL) { ret = iscsi_set_initiator_username_pwd(iscsi, iscsi_url->user, iscsi_url->passwd); if (ret != 0) { error_report(""Failed to set initiator username and password""); ret = -EINVAL; goto out; } } /* check if we got CHAP username/password via the options */ if (parse_chap(iscsi, iscsi_url->target) != 0) { error_report(""iSCSI: Failed to set CHAP user/password""); ret = -EINVAL; goto out; } if (iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL) != 0) { error_report(""iSCSI: Failed to set session type to normal.""); ret = -EINVAL; goto out; } iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C); /* check if we got HEADER_DIGEST via the options */ parse_header_digest(iscsi, iscsi_url->target); task.iscsilun = iscsilun; task.status = 0; task.complete = 0; task.bs = bs; iscsilun->iscsi = iscsi; iscsilun->lun = iscsi_url->lun; if (iscsi_full_connect_async(iscsi, iscsi_url->portal, iscsi_url->lun, iscsi_connect_cb, &task) != 0) { error_report(""iSCSI: Failed to start async connect.""); ret = -EINVAL; goto out; } while (!task.complete) { iscsi_set_events(iscsilun); qemu_aio_wait(); } if (task.status != 0) { error_report(""iSCSI: Failed to connect to LUN : %s"", iscsi_get_error(iscsi)); ret = -EINVAL; goto out; } /* Medium changer or tape. We dont have any emulation for this so this must * be sg ioctl compatible. We force it to be sg, otherwise qemu will try * to read from the device to guess the image format. */ if (iscsilun->type == TYPE_MEDIUM_CHANGER || iscsilun->type == TYPE_TAPE) { bs->sg = 1; } ret = 0; out: if (initiator_name != NULL) { g_free(initiator_name); } if (iscsi_url != NULL) { iscsi_destroy_url(iscsi_url); } if (ret) { if (iscsi != NULL) { iscsi_destroy_context(iscsi); } memset(iscsilun, 0, sizeof(IscsiLun)); } return ret; }","No, it is non-vulnerable."10199,"static int encode_frame(AVCodecContext * avctx, AVPacket *pkt, const AVFrame *pict, int *got_packet) { TiffEncoderContext *s = avctx->priv_data; AVFrame *const p = &s->picture; int i; uint8_t *ptr; uint8_t *offset; uint32_t strips; uint32_t *strip_sizes = NULL; uint32_t *strip_offsets = NULL; int bytes_per_row; uint32_t res[2] = { 72, 1 }; // image resolution (72/1) uint16_t bpp_tab[] = { 8, 8, 8, 8 }; int ret; int is_yuv = 0; uint8_t *yuv_line = NULL; int shift_h, shift_v; const AVPixFmtDescriptor* pfd; s->avctx = avctx; *p = *pict; p->pict_type = AV_PICTURE_TYPE_I; p->key_frame = 1; avctx->coded_frame= &s->picture; s->width = avctx->width; s->height = avctx->height; s->subsampling[0] = 1; s->subsampling[1] = 1; switch (avctx->pix_fmt) { case PIX_FMT_RGB48LE: case PIX_FMT_GRAY16LE: case PIX_FMT_RGB24: case PIX_FMT_GRAY8: case PIX_FMT_PAL8: pfd = &av_pix_fmt_descriptors[avctx->pix_fmt]; s->bpp = av_get_bits_per_pixel(pfd); if (pfd->flags & PIX_FMT_PAL) { s->photometric_interpretation = 3; } else if (pfd->flags & PIX_FMT_RGB) { s->photometric_interpretation = 2; } else { s->photometric_interpretation = 1; } s->bpp_tab_size = pfd->nb_components; for (i = 0; i < s->bpp_tab_size; i++) { bpp_tab[i] = s->bpp / s->bpp_tab_size; } break; case PIX_FMT_MONOBLACK: s->bpp = 1; s->photometric_interpretation = 1; s->bpp_tab_size = 0; break; case PIX_FMT_MONOWHITE: s->bpp = 1; s->photometric_interpretation = 0; s->bpp_tab_size = 0; break; case PIX_FMT_YUV420P: case PIX_FMT_YUV422P: case PIX_FMT_YUV444P: case PIX_FMT_YUV410P: case PIX_FMT_YUV411P: s->photometric_interpretation = 6; avcodec_get_chroma_sub_sample(avctx->pix_fmt, &shift_h, &shift_v); s->bpp = 8 + (16 >> (shift_h + shift_v)); s->subsampling[0] = 1 << shift_h; s->subsampling[1] = 1 << shift_v; s->bpp_tab_size = 3; is_yuv = 1; break; default: av_log(s->avctx, AV_LOG_ERROR, ""This colors format is not supported\n""); return -1; } if (s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE || s->compr == TIFF_LZW) //best choose for DEFLATE s->rps = s->height; else s->rps = FFMAX(8192 / (((s->width * s->bpp) >> 3) + 1), 1); // suggest size of strip s->rps = ((s->rps - 1) / s->subsampling[1] + 1) * s->subsampling[1]; // round rps up strips = (s->height - 1) / s->rps + 1; if (!pkt->data && (ret = av_new_packet(pkt, avctx->width * avctx->height * s->bpp * 2 + avctx->height * 4 + FF_MIN_BUFFER_SIZE)) < 0) { av_log(avctx, AV_LOG_ERROR, ""Error getting output packet.\n""); return ret; } ptr = pkt->data; s->buf_start = pkt->data; s->buf = &ptr; s->buf_size = pkt->size; if (check_size(s, 8)) goto fail; // write header bytestream_put_le16(&ptr, 0x4949); bytestream_put_le16(&ptr, 42); offset = ptr; bytestream_put_le32(&ptr, 0); strip_sizes = av_mallocz(sizeof(*strip_sizes) * strips); strip_offsets = av_mallocz(sizeof(*strip_offsets) * strips); bytes_per_row = (((s->width - 1)/s->subsampling[0] + 1) * s->bpp * s->subsampling[0] * s->subsampling[1] + 7) >> 3; if (is_yuv){ yuv_line = av_malloc(bytes_per_row); if (yuv_line == NULL){ av_log(s->avctx, AV_LOG_ERROR, ""Not enough memory\n""); goto fail; } } #if CONFIG_ZLIB if (s->compr == TIFF_DEFLATE || s->compr == TIFF_ADOBE_DEFLATE) { uint8_t *zbuf; int zlen, zn; int j; zlen = bytes_per_row * s->rps; zbuf = av_malloc(zlen); strip_offsets[0] = ptr - pkt->data; zn = 0; for (j = 0; j < s->rps; j++) { if (is_yuv){ pack_yuv(s, yuv_line, j); memcpy(zbuf + zn, yuv_line, bytes_per_row); j += s->subsampling[1] - 1; } else memcpy(zbuf + j * bytes_per_row, p->data[0] + j * p->linesize[0], bytes_per_row); zn += bytes_per_row; } ret = encode_strip(s, zbuf, ptr, zn, s->compr); av_free(zbuf); if (ret < 0) { av_log(s->avctx, AV_LOG_ERROR, ""Encode strip failed\n""); goto fail; } ptr += ret; strip_sizes[0] = ptr - pkt->data - strip_offsets[0]; } else #endif { if(s->compr == TIFF_LZW) s->lzws = av_malloc(ff_lzw_encode_state_size); for (i = 0; i < s->height; i++) { if (strip_sizes[i / s->rps] == 0) { if(s->compr == TIFF_LZW){ ff_lzw_encode_init(s->lzws, ptr, s->buf_size - (*s->buf - s->buf_start), 12, FF_LZW_TIFF, put_bits); } strip_offsets[i / s->rps] = ptr - pkt->data; } if (is_yuv){ pack_yuv(s, yuv_line, i); ret = encode_strip(s, yuv_line, ptr, bytes_per_row, s->compr); i += s->subsampling[1] - 1; } else ret = encode_strip(s, p->data[0] + i * p->linesize[0], ptr, bytes_per_row, s->compr); if (ret < 0) { av_log(s->avctx, AV_LOG_ERROR, ""Encode strip failed\n""); goto fail; } strip_sizes[i / s->rps] += ret; ptr += ret; if(s->compr == TIFF_LZW && (i==s->height-1 || i%s->rps == s->rps-1)){ ret = ff_lzw_encode_flush(s->lzws, flush_put_bits); strip_sizes[(i / s->rps )] += ret ; ptr += ret; } } if(s->compr == TIFF_LZW) av_free(s->lzws); } s->num_entries = 0; add_entry1(s,TIFF_SUBFILE, TIFF_LONG, 0); add_entry1(s,TIFF_WIDTH, TIFF_LONG, s->width); add_entry1(s,TIFF_HEIGHT, TIFF_LONG, s->height); if (s->bpp_tab_size) add_entry(s, TIFF_BPP, TIFF_SHORT, s->bpp_tab_size, bpp_tab); add_entry1(s,TIFF_COMPR, TIFF_SHORT, s->compr); add_entry1(s,TIFF_INVERT, TIFF_SHORT, s->photometric_interpretation); add_entry(s, TIFF_STRIP_OFFS, TIFF_LONG, strips, strip_offsets); if (s->bpp_tab_size) add_entry1(s,TIFF_SAMPLES_PER_PIXEL, TIFF_SHORT, s->bpp_tab_size); add_entry1(s,TIFF_ROWSPERSTRIP, TIFF_LONG, s->rps); add_entry(s, TIFF_STRIP_SIZE, TIFF_LONG, strips, strip_sizes); add_entry(s, TIFF_XRES, TIFF_RATIONAL, 1, res); add_entry(s, TIFF_YRES, TIFF_RATIONAL, 1, res); add_entry1(s,TIFF_RES_UNIT, TIFF_SHORT, 2); if(!(avctx->flags & CODEC_FLAG_BITEXACT)) add_entry(s, TIFF_SOFTWARE_NAME, TIFF_STRING, strlen(LIBAVCODEC_IDENT) + 1, LIBAVCODEC_IDENT); if (avctx->pix_fmt == PIX_FMT_PAL8) { uint16_t pal[256 * 3]; for (i = 0; i < 256; i++) { uint32_t rgb = *(uint32_t *) (p->data[1] + i * 4); pal[i] = ((rgb >> 16) & 0xff) * 257; pal[i + 256] = ((rgb >> 8 ) & 0xff) * 257; pal[i + 512] = ( rgb & 0xff) * 257; } add_entry(s, TIFF_PAL, TIFF_SHORT, 256 * 3, pal); } if (is_yuv){ /** according to CCIR Recommendation 601.1 */ uint32_t refbw[12] = {15, 1, 235, 1, 128, 1, 240, 1, 128, 1, 240, 1}; add_entry(s, TIFF_YCBCR_SUBSAMPLING, TIFF_SHORT, 2, s->subsampling); add_entry(s, TIFF_REFERENCE_BW, TIFF_RATIONAL, 6, refbw); } bytestream_put_le32(&offset, ptr - pkt->data); // write offset to dir if (check_size(s, 6 + s->num_entries * 12)) { ret = AVERROR(EINVAL); goto fail; } bytestream_put_le16(&ptr, s->num_entries); // write tag count bytestream_put_buffer(&ptr, s->entries, s->num_entries * 12); bytestream_put_le32(&ptr, 0); pkt->size = ptr - pkt->data; pkt->flags |= AV_PKT_FLAG_KEY; *got_packet = 1; fail: av_free(strip_sizes); av_free(strip_offsets); av_free(yuv_line); return ret; }","No, it is non-vulnerable."102100,"static int mxf_parse_structural_metadata(MXFContext *mxf) { MXFPackage *material_package = NULL; MXFPackage *temp_package = NULL; int i, j, k; av_dlog(mxf->fc, ""metadata sets count %d\n"", mxf->metadata_sets_count); /* TODO: handle multiple material packages (OP3x) */ for (i = 0; i < mxf->packages_count; i++) { material_package = mxf_resolve_strong_ref(mxf, &mxf->packages_refs[i], MaterialPackage); if (material_package) break; } if (!material_package) { av_log(mxf->fc, AV_LOG_ERROR, ""no material package found\n""); return AVERROR_INVALIDDATA; } for (i = 0; i < material_package->tracks_count; i++) { MXFPackage *source_package = NULL; MXFTrack *material_track = NULL; MXFTrack *source_track = NULL; MXFTrack *temp_track = NULL; MXFDescriptor *descriptor = NULL; MXFStructuralComponent *component = NULL; UID *essence_container_ul = NULL; const MXFCodecUL *codec_ul = NULL; const MXFCodecUL *container_ul = NULL; AVStream *st; if (!(material_track = mxf_resolve_strong_ref(mxf, &material_package->tracks_refs[i], Track))) { av_log(mxf->fc, AV_LOG_ERROR, ""could not resolve material track strong ref\n""); continue; } if (!(material_track->sequence = mxf_resolve_strong_ref(mxf, &material_track->sequence_ref, Sequence))) { av_log(mxf->fc, AV_LOG_ERROR, ""could not resolve material track sequence strong ref\n""); continue; } /* TODO: handle multiple source clips */ for (j = 0; j < material_track->sequence->structural_components_count; j++) { /* TODO: handle timecode component */ component = mxf_resolve_strong_ref(mxf, &material_track->sequence->structural_components_refs[j], SourceClip); if (!component) continue; for (k = 0; k < mxf->packages_count; k++) { temp_package = mxf_resolve_strong_ref(mxf, &mxf->packages_refs[k], SourcePackage); if (!temp_package) continue; if (!memcmp(temp_package->package_uid, component->source_package_uid, 16)) { source_package = temp_package; break; } } if (!source_package) { av_log(mxf->fc, AV_LOG_ERROR, ""material track %d: no corresponding source package found\n"", material_track->track_id); break; } for (k = 0; k < source_package->tracks_count; k++) { if (!(temp_track = mxf_resolve_strong_ref(mxf, &source_package->tracks_refs[k], Track))) { av_log(mxf->fc, AV_LOG_ERROR, ""could not resolve source track strong ref\n""); return AVERROR_INVALIDDATA; } if (temp_track->track_id == component->source_track_id) { source_track = temp_track; break; } } if (!source_track) { av_log(mxf->fc, AV_LOG_ERROR, ""material track %d: no corresponding source track found\n"", material_track->track_id); break; } } if (!source_track) continue; st = avformat_new_stream(mxf->fc, NULL); if (!st) { av_log(mxf->fc, AV_LOG_ERROR, ""could not allocate stream\n""); return AVERROR(ENOMEM); } st->id = source_track->track_id; st->priv_data = source_track; st->duration = component->duration; if (st->duration == -1) st->duration = AV_NOPTS_VALUE; st->start_time = component->start_position; avpriv_set_pts_info(st, 64, material_track->edit_rate.num, material_track->edit_rate.den); if (!(source_track->sequence = mxf_resolve_strong_ref(mxf, &source_track->sequence_ref, Sequence))) { av_log(mxf->fc, AV_LOG_ERROR, ""could not resolve source track sequence strong ref\n""); return AVERROR_INVALIDDATA; } PRINT_KEY(mxf->fc, ""data definition ul"", source_track->sequence->data_definition_ul); codec_ul = mxf_get_codec_ul(ff_mxf_data_definition_uls, &source_track->sequence->data_definition_ul); st->codec->codec_type = codec_ul->id; source_package->descriptor = mxf_resolve_strong_ref(mxf, &source_package->descriptor_ref, AnyType); if (source_package->descriptor) { if (source_package->descriptor->type == MultipleDescriptor) { for (j = 0; j < source_package->descriptor->sub_descriptors_count; j++) { MXFDescriptor *sub_descriptor = mxf_resolve_strong_ref(mxf, &source_package->descriptor->sub_descriptors_refs[j], Descriptor); if (!sub_descriptor) { av_log(mxf->fc, AV_LOG_ERROR, ""could not resolve sub descriptor strong ref\n""); continue; } if (sub_descriptor->linked_track_id == source_track->track_id) { descriptor = sub_descriptor; break; } } } else if (source_package->descriptor->type == Descriptor) descriptor = source_package->descriptor; } if (!descriptor) { av_log(mxf->fc, AV_LOG_INFO, ""source track %d: stream %d, no descriptor found\n"", source_track->track_id, st->index); continue; } PRINT_KEY(mxf->fc, ""essence codec ul"", descriptor->essence_codec_ul); PRINT_KEY(mxf->fc, ""essence container ul"", descriptor->essence_container_ul); essence_container_ul = &descriptor->essence_container_ul; /* HACK: replacing the original key with mxf_encrypted_essence_container * is not allowed according to s429-6, try to find correct information anyway */ if (IS_KLV_KEY(essence_container_ul, mxf_encrypted_essence_container)) { av_log(mxf->fc, AV_LOG_INFO, ""broken encrypted mxf file\n""); for (k = 0; k < mxf->metadata_sets_count; k++) { MXFMetadataSet *metadata = mxf->metadata_sets[k]; if (metadata->type == CryptoContext) { essence_container_ul = &((MXFCryptoContext *)metadata)->source_container_ul; break; } } } /* TODO: drop PictureEssenceCoding and SoundEssenceCompression, only check EssenceContainer */ codec_ul = mxf_get_codec_ul(ff_mxf_codec_uls, &descriptor->essence_codec_ul); st->codec->codec_id = codec_ul->id; if (descriptor->extradata) { st->codec->extradata = descriptor->extradata; st->codec->extradata_size = descriptor->extradata_size; } if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { container_ul = mxf_get_codec_ul(mxf_essence_container_uls, essence_container_ul); if (st->codec->codec_id == CODEC_ID_NONE) st->codec->codec_id = container_ul->id; st->codec->width = descriptor->width; st->codec->height = descriptor->height; if (st->codec->codec_id == CODEC_ID_RAWVIDEO) st->codec->pix_fmt = descriptor->pix_fmt; st->need_parsing = AVSTREAM_PARSE_HEADERS; } else if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) { container_ul = mxf_get_codec_ul(mxf_essence_container_uls, essence_container_ul); if (st->codec->codec_id == CODEC_ID_NONE) st->codec->codec_id = container_ul->id; st->codec->channels = descriptor->channels; st->codec->bits_per_coded_sample = descriptor->bits_per_sample; st->codec->sample_rate = descriptor->sample_rate.num / descriptor->sample_rate.den; /* TODO: implement CODEC_ID_RAWAUDIO */ if (st->codec->codec_id == CODEC_ID_PCM_S16LE) { if (descriptor->bits_per_sample > 16 && descriptor->bits_per_sample <= 24) st->codec->codec_id = CODEC_ID_PCM_S24LE; else if (descriptor->bits_per_sample == 32) st->codec->codec_id = CODEC_ID_PCM_S32LE; } else if (st->codec->codec_id == CODEC_ID_PCM_S16BE) { if (descriptor->bits_per_sample > 16 && descriptor->bits_per_sample <= 24) st->codec->codec_id = CODEC_ID_PCM_S24BE; else if (descriptor->bits_per_sample == 32) st->codec->codec_id = CODEC_ID_PCM_S32BE; } else if (st->codec->codec_id == CODEC_ID_MP2) { st->need_parsing = AVSTREAM_PARSE_FULL; } } if (st->codec->codec_type != AVMEDIA_TYPE_DATA && (*essence_container_ul)[15] > 0x01) { av_log(mxf->fc, AV_LOG_WARNING, ""only frame wrapped mappings are correctly supported\n""); st->need_parsing = AVSTREAM_PARSE_FULL; } } return 0; }","Yes, it is vulnerable."103101,"static inline int sym_quant(int c, int e, int levels) { int v = ((((levels * c) >> (24 - e)) + 1) >> 1) + (levels >> 1); av_assert2(v >= 0 && v < levels); return v; }","Yes, it is vulnerable."104102,"static inline int seek_to_sector(BlockDriverState *bs, int64_t sector_num) { BDRVParallelsState *s = bs->opaque; uint32_t index, offset, position; index = sector_num / s->tracks; offset = sector_num % s->tracks; // not allocated if ((index > s->catalog_size) || (s->catalog_bitmap[index] == 0)) return -1; position = (s->catalog_bitmap[index] + offset) * 512; // fprintf(stderr, ""sector: %llx index=%x offset=%x pointer=%x position=%x\n"", // sector_num, index, offset, s->catalog_bitmap[index], position); if (lseek(s->fd, position, SEEK_SET) != position) return -1; return 0; }","Yes, it is vulnerable."105103,"static void imx_epit_reload_compare_timer(IMXEPITState *s) { if ((s->cr & (CR_EN | CR_OCIEN)) == (CR_EN | CR_OCIEN)) { /* if the compare feature is on and timers are running */ uint32_t tmp = imx_epit_update_count(s); uint64_t next; if (tmp > s->cmp) { /* It'll fire in this round of the timer */ next = tmp - s->cmp; } else { /* catch it next time around */ next = tmp - s->cmp + ((s->cr & CR_RLD) ? TIMER_MAX : s->lr); } ptimer_set_count(s->timer_cmp, next); } }","No, it is non-vulnerable."106104,"static int handle_intercept(CPUS390XState *env) { struct kvm_run *run = env->kvm_run; int icpt_code = run->s390_sieic.icptcode; int r = 0; dprintf(""intercept: 0x%x (at 0x%lx)\n"", icpt_code, (long)env->kvm_run->psw_addr); switch (icpt_code) { case ICPT_INSTRUCTION: r = handle_instruction(env, run); case ICPT_WAITPSW: case ICPT_CPU_STOP: if (s390_del_running_cpu(env) == 0) { case ICPT_SOFT_INTERCEPT: fprintf(stderr, ""KVM unimplemented icpt SOFT\n""); exit(1); case ICPT_IO: fprintf(stderr, ""KVM unimplemented icpt IO\n""); exit(1); default: fprintf(stderr, ""Unknown intercept code: %d\n"", icpt_code); exit(1); return r;","Yes, it is vulnerable."107105,"void av_cold ff_ivi_free_buffers(IVIPlaneDesc *planes) { int p, b, t; for (p = 0; p < 3; p++) { for (b = 0; b < planes[p].num_bands; b++) { av_freep(&planes[p].bands[b].bufs[0]); av_freep(&planes[p].bands[b].bufs[1]); av_freep(&planes[p].bands[b].bufs[2]); for (t = 0; t < planes[p].bands[b].num_tiles; t++) av_freep(&planes[p].bands[b].tiles[t].mbs); av_freep(&planes[p].bands[b].tiles); } av_freep(&planes[p].bands); } }","Yes, it is vulnerable."108106,"static void RENAME(extract_odd2avg)(const uint8_t *src0, const uint8_t *src1, uint8_t *dst0, uint8_t *dst1, x86_reg count) { dst0 += count; dst1 += count; src0 += 4*count; src1 += 4*count; count= - count; #ifdef PAVGB if(count <= -8) { count += 7; __asm__ volatile( ""pcmpeqw %%mm7, %%mm7 \n\t"" ""psrlw $8, %%mm7 \n\t"" ""1: \n\t"" ""movq -28(%1, %0, 4), %%mm0 \n\t"" ""movq -20(%1, %0, 4), %%mm1 \n\t"" ""movq -12(%1, %0, 4), %%mm2 \n\t"" ""movq -4(%1, %0, 4), %%mm3 \n\t"" PAVGB"" -28(%2, %0, 4), %%mm0 \n\t"" PAVGB"" -20(%2, %0, 4), %%mm1 \n\t"" PAVGB"" -12(%2, %0, 4), %%mm2 \n\t"" PAVGB"" - 4(%2, %0, 4), %%mm3 \n\t"" ""psrlw $8, %%mm0 \n\t"" ""psrlw $8, %%mm1 \n\t"" ""psrlw $8, %%mm2 \n\t"" ""psrlw $8, %%mm3 \n\t"" ""packuswb %%mm1, %%mm0 \n\t"" ""packuswb %%mm3, %%mm2 \n\t"" ""movq %%mm0, %%mm1 \n\t"" ""movq %%mm2, %%mm3 \n\t"" ""psrlw $8, %%mm0 \n\t"" ""psrlw $8, %%mm2 \n\t"" ""pand %%mm7, %%mm1 \n\t"" ""pand %%mm7, %%mm3 \n\t"" ""packuswb %%mm2, %%mm0 \n\t"" ""packuswb %%mm3, %%mm1 \n\t"" MOVNTQ"" %%mm0,- 7(%4, %0) \n\t"" MOVNTQ"" %%mm1,- 7(%3, %0) \n\t"" ""add $8, %0 \n\t"" "" js 1b \n\t"" : ""+r""(count) : ""r""(src0), ""r""(src1), ""r""(dst0), ""r""(dst1) ); count -= 7; } #endif src0++; src1++; while(count<0) { dst0[count]= (src0[4*count+0]+src1[4*count+0])>>1; dst1[count]= (src0[4*count+2]+src1[4*count+2])>>1; count++; } }","No, it is non-vulnerable."109107,"static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc, GIOCondition condition, gpointer user_data) { QIOTask *task = user_data; QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK( qio_task_get_source(task)); Error *err = NULL; ssize_t ret; ret = qio_channel_write(wioc->master, (char *)wioc->encoutput.buffer, wioc->encoutput.offset, &err); if (ret < 0) { trace_qio_channel_websock_handshake_fail(ioc); qio_task_set_error(task, err); qio_task_complete(task); return FALSE; } buffer_advance(&wioc->encoutput, ret); if (wioc->encoutput.offset == 0) { trace_qio_channel_websock_handshake_complete(ioc); qio_task_complete(task); return FALSE; } trace_qio_channel_websock_handshake_pending(ioc, G_IO_OUT); return TRUE; }","Yes, it is vulnerable."110108,"static int pix_norm1_altivec(uint8_t *pix, int line_size) { int i, s = 0; const vector unsigned int zero = (const vector unsigned int) vec_splat_u32(0); vector unsigned int sv = (vector unsigned int) vec_splat_u32(0); vector signed int sum; for (i = 0; i < 16; i++) { /* Read the potentially unaligned pixels. */ //vector unsigned char pixl = vec_ld(0, pix); //vector unsigned char pixr = vec_ld(15, pix); //vector unsigned char pixv = vec_perm(pixl, pixr, perm); vector unsigned char pixv = vec_vsx_ld(0, pix); /* Square the values, and add them to our sum. */ sv = vec_msum(pixv, pixv, sv); pix += line_size; } /* Sum up the four partial sums, and put the result into s. */ sum = vec_sums((vector signed int) sv, (vector signed int) zero); sum = vec_splat(sum, 3); vec_vsx_st(sum, 0, &s); return s; }","Yes, it is vulnerable."111109,"static void test_visitor_in_native_list_uint8(TestInputVisitorData *data, const void *unused) { test_native_list_integer_helper(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_U8); }","No, it is non-vulnerable."112110,"static void scsi_disk_class_initfn(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); SCSIDeviceClass *sc = SCSI_DEVICE_CLASS(klass); sc->init = scsi_disk_initfn; sc->destroy = scsi_destroy; sc->alloc_req = scsi_new_request; sc->unit_attention_reported = scsi_disk_unit_attention_reported; dc->fw_name = ""disk""; dc->desc = ""virtual SCSI disk or CD-ROM (legacy)""; dc->reset = scsi_disk_reset; dc->props = scsi_disk_properties; dc->vmsd = &vmstate_scsi_disk_state; }","No, it is non-vulnerable."113111,"static void test_tco2_status_bits(void) { TestData d; uint16_t ticks = 8; uint16_t val; int ret; d.args = ""-watchdog-action none""; test_init(&d); stop_tco(&d); clear_tco_status(&d); reset_on_second_timeout(true); set_tco_timeout(&d, ticks); load_tco(&d); start_tco(&d); clock_step(ticks * TCO_TICK_NSEC * 2); val = qpci_io_readw(d.dev, d.tco_io_base + TCO2_STS); ret = val & (TCO_SECOND_TO_STS | TCO_BOOT_STS) ? 1 : 0; g_assert(ret == 1); qpci_io_writew(d.dev, d.tco_io_base + TCO2_STS, val); g_assert_cmpint(qpci_io_readw(d.dev, d.tco_io_base + TCO2_STS), ==, 0); qtest_end(); }","No, it is non-vulnerable."114112,"sdhci_write(SDHCIState *s, unsigned int offset, uint32_t value, unsigned size) { unsigned shift = 8 * (offset & 0x3); uint32_t mask = ~(((1ULL << (size * 8)) - 1) << shift); value <<= shift; switch (offset & ~0x3) { case SDHC_SYSAD: s->sdmasysad = (s->sdmasysad & mask) | value; MASKED_WRITE(s->sdmasysad, mask, value); /* Writing to last byte of sdmasysad might trigger transfer */ if (!(mask & 0xFF000000) && TRANSFERRING_DATA(s->prnsts) && s->blkcnt && s->blksize && SDHC_DMA_TYPE(s->hostctl) == SDHC_CTRL_SDMA) { SDHCI_GET_CLASS(s)->do_sdma_multi(s); } break; case SDHC_BLKSIZE: if (!TRANSFERRING_DATA(s->prnsts)) { MASKED_WRITE(s->blksize, mask, value); MASKED_WRITE(s->blkcnt, mask >> 16, value >> 16); } break; case SDHC_ARGUMENT: MASKED_WRITE(s->argument, mask, value); break; case SDHC_TRNMOD: /* DMA can be enabled only if it is supported as indicated by * capabilities register */ if (!(s->capareg & SDHC_CAN_DO_DMA)) { value &= ~SDHC_TRNS_DMA; } MASKED_WRITE(s->trnmod, mask, value); MASKED_WRITE(s->cmdreg, mask >> 16, value >> 16); /* Writing to the upper byte of CMDREG triggers SD command generation */ if ((mask & 0xFF000000) || !SDHCI_GET_CLASS(s)->can_issue_command(s)) { break; } SDHCI_GET_CLASS(s)->send_command(s); break; case SDHC_BDATA: if (sdhci_buff_access_is_sequential(s, offset - SDHC_BDATA)) { SDHCI_GET_CLASS(s)->bdata_write(s, value >> shift, size); } break; case SDHC_HOSTCTL: if (!(mask & 0xFF0000)) { sdhci_blkgap_write(s, value >> 16); } MASKED_WRITE(s->hostctl, mask, value); MASKED_WRITE(s->pwrcon, mask >> 8, value >> 8); MASKED_WRITE(s->wakcon, mask >> 24, value >> 24); if (!(s->prnsts & SDHC_CARD_PRESENT) || ((s->pwrcon >> 1) & 0x7) < 5 || !(s->capareg & (1 << (31 - ((s->pwrcon >> 1) & 0x7))))) { s->pwrcon &= ~SDHC_POWER_ON; } break; case SDHC_CLKCON: if (!(mask & 0xFF000000)) { sdhci_reset_write(s, value >> 24); } MASKED_WRITE(s->clkcon, mask, value); MASKED_WRITE(s->timeoutcon, mask >> 16, value >> 16); if (s->clkcon & SDHC_CLOCK_INT_EN) { s->clkcon |= SDHC_CLOCK_INT_STABLE; } else { s->clkcon &= ~SDHC_CLOCK_INT_STABLE; } break; case SDHC_NORINTSTS: if (s->norintstsen & SDHC_NISEN_CARDINT) { value &= ~SDHC_NIS_CARDINT; } s->norintsts &= mask | ~value; s->errintsts &= (mask >> 16) | ~(value >> 16); if (s->errintsts) { s->norintsts |= SDHC_NIS_ERR; } else { s->norintsts &= ~SDHC_NIS_ERR; } sdhci_update_irq(s); break; case SDHC_NORINTSTSEN: MASKED_WRITE(s->norintstsen, mask, value); MASKED_WRITE(s->errintstsen, mask >> 16, value >> 16); s->norintsts &= s->norintstsen; s->errintsts &= s->errintstsen; if (s->errintsts) { s->norintsts |= SDHC_NIS_ERR; } else { s->norintsts &= ~SDHC_NIS_ERR; } sdhci_update_irq(s); break; case SDHC_NORINTSIGEN: MASKED_WRITE(s->norintsigen, mask, value); MASKED_WRITE(s->errintsigen, mask >> 16, value >> 16); sdhci_update_irq(s); break; case SDHC_ADMAERR: MASKED_WRITE(s->admaerr, mask, value); break; case SDHC_ADMASYSADDR: s->admasysaddr = (s->admasysaddr & (0xFFFFFFFF00000000ULL | (uint64_t)mask)) | (uint64_t)value; break; case SDHC_ADMASYSADDR + 4: s->admasysaddr = (s->admasysaddr & (0x00000000FFFFFFFFULL | ((uint64_t)mask << 32))) | ((uint64_t)value << 32); break; case SDHC_FEAER: s->acmd12errsts |= value; s->errintsts |= (value >> 16) & s->errintstsen; if (s->acmd12errsts) { s->errintsts |= SDHC_EIS_CMD12ERR; } if (s->errintsts) { s->norintsts |= SDHC_NIS_ERR; } sdhci_update_irq(s); break; default: ERRPRINT(""bad %ub write offset: addr[0x%04x] <- %u(0x%x)\n"", size, offset, value >> shift, value >> shift); break; } DPRINT_L2(""write %ub: addr[0x%04x] <- %u(0x%x)\n"", size, offset, value >> shift, value >> shift); }","No, it is non-vulnerable."115113,"build_ssdt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu, AcpiPmInfo *pm, AcpiMiscInfo *misc, PcPciInfo *pci, PcGuestInfo *guest_info) { int acpi_cpus = MIN(0xff, guest_info->apic_id_limit); int ssdt_start = table_data->len; uint8_t *ssdt_ptr; int i; /* Copy header and patch values in the S3_ / S4_ / S5_ packages */ ssdt_ptr = acpi_data_push(table_data, sizeof(ssdp_misc_aml)); memcpy(ssdt_ptr, ssdp_misc_aml, sizeof(ssdp_misc_aml)); if (pm->s3_disabled) { ssdt_ptr[acpi_s3_name[0]] = 'X'; } if (pm->s4_disabled) { ssdt_ptr[acpi_s4_name[0]] = 'X'; } else { ssdt_ptr[acpi_s4_pkg[0] + 1] = ssdt_ptr[acpi_s4_pkg[0] + 3] = pm->s4_val; } patch_pci_windows(pci, ssdt_ptr, sizeof(ssdp_misc_aml)); ACPI_BUILD_SET_LE(ssdt_ptr, sizeof(ssdp_misc_aml), ssdt_isa_pest[0], 16, misc->pvpanic_port); { GArray *sb_scope = build_alloc_array(); uint8_t op = 0x10; /* ScopeOp */ build_append_nameseg(sb_scope, ""_SB_""); /* build Processor object for each processor */ for (i = 0; i < acpi_cpus; i++) { uint8_t *proc = acpi_data_push(sb_scope, ACPI_PROC_SIZEOF); memcpy(proc, ACPI_PROC_AML, ACPI_PROC_SIZEOF); proc[ACPI_PROC_OFFSET_CPUHEX] = acpi_get_hex(i >> 4); proc[ACPI_PROC_OFFSET_CPUHEX+1] = acpi_get_hex(i); proc[ACPI_PROC_OFFSET_CPUID1] = i; proc[ACPI_PROC_OFFSET_CPUID2] = i; } /* build this code: * Method(NTFY, 2) {If (LEqual(Arg0, 0x00)) {Notify(CP00, Arg1)} ...} */ /* Arg0 = Processor ID = APIC ID */ build_append_notify_method(sb_scope, ""NTFY"", ""CP%0.02X"", acpi_cpus); /* build ""Name(CPON, Package() { One, One, ..., Zero, Zero, ... })"" */ build_append_byte(sb_scope, 0x08); /* NameOp */ build_append_nameseg(sb_scope, ""CPON""); { GArray *package = build_alloc_array(); uint8_t op = 0x12; /* PackageOp */ build_append_byte(package, acpi_cpus); /* NumElements */ for (i = 0; i < acpi_cpus; i++) { uint8_t b = test_bit(i, cpu->found_cpus) ? 0x01 : 0x00; build_append_byte(package, b); } build_package(package, op, 2); build_append_array(sb_scope, package); build_free_array(package); } { AcpiBuildPciBusHotplugState hotplug_state; Object *pci_host; PCIBus *bus = NULL; bool ambiguous; pci_host = object_resolve_path_type("""", TYPE_PCI_HOST_BRIDGE, &ambiguous); if (!ambiguous && pci_host) { bus = PCI_HOST_BRIDGE(pci_host)->bus; } build_pci_bus_state_init(&hotplug_state, NULL); if (bus) { /* Scan all PCI buses. Generate tables to support hotplug. */ pci_for_each_bus_depth_first(bus, build_pci_bus_begin, build_pci_bus_end, &hotplug_state); } build_append_array(sb_scope, hotplug_state.device_table); build_pci_bus_state_cleanup(&hotplug_state); } build_package(sb_scope, op, 3); build_append_array(table_data, sb_scope); build_free_array(sb_scope); } build_header(linker, table_data, (void *)(table_data->data + ssdt_start), ACPI_SSDT_SIGNATURE, table_data->len - ssdt_start, 1); }","No, it is non-vulnerable."116114,"int bdrv_child_check_perm(BdrvChild *c, uint64_t perm, uint64_t shared, Error **errp) { return bdrv_check_update_perm(c->bs, perm, shared, c, errp); }","No, it is non-vulnerable."117115,"static int mxf_write_header(AVFormatContext *s) { MXFContext *mxf = s->priv_data; int i, ret; uint8_t present[FF_ARRAY_ELEMS(mxf_essence_container_uls)] = {0}; const MXFSamplesPerFrame *spf = NULL; AVDictionaryEntry *t; int64_t timestamp = 0; if (!s->nb_streams) return -1; if (s->oformat == &ff_mxf_opatom_muxer && s->nb_streams !=1){ av_log(s, AV_LOG_ERROR, ""there must be exactly one stream for mxf opatom\n""); return -1; } for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MXFStreamContext *sc = av_mallocz(sizeof(*sc)); if (!sc) return AVERROR(ENOMEM); st->priv_data = sc; if (((i == 0) ^ (st->codec->codec_type == AVMEDIA_TYPE_VIDEO)) && s->oformat != &ff_mxf_opatom_muxer) { av_log(s, AV_LOG_ERROR, ""there must be exactly one video stream and it must be the first one\n""); return -1; } if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { const AVPixFmtDescriptor *pix_desc = av_pix_fmt_desc_get(st->codec->pix_fmt); // TODO: should be avg_frame_rate AVRational rate, tbc = st->time_base; // Default component depth to 8 sc->component_depth = 8; sc->h_chroma_sub_sample = 2; sc->color_siting = 0xFF; if (pix_desc) { sc->component_depth = pix_desc->comp[0].depth_minus1 + 1; sc->h_chroma_sub_sample = 1 << pix_desc->log2_chroma_w; } switch (ff_choose_chroma_location(s, st)) { case AVCHROMA_LOC_TOPLEFT: sc->color_siting = 0; break; case AVCHROMA_LOC_LEFT: sc->color_siting = 6; break; case AVCHROMA_LOC_TOP: sc->color_siting = 1; break; case AVCHROMA_LOC_CENTER: sc->color_siting = 3; break; } mxf->timecode_base = (tbc.den + tbc.num/2) / tbc.num; spf = ff_mxf_get_samples_per_frame(s, tbc); if (!spf) { av_log(s, AV_LOG_ERROR, ""Unsupported video frame rate %d/%d\n"", tbc.den, tbc.num); return AVERROR(EINVAL); } mxf->time_base = spf->time_base; rate = av_inv_q(mxf->time_base); avpriv_set_pts_info(st, 64, mxf->time_base.num, mxf->time_base.den); if((ret = mxf_init_timecode(s, st, rate)) < 0) return ret; sc->video_bit_rate = st->codec->bit_rate ? st->codec->bit_rate : st->codec->rc_max_rate; if (s->oformat == &ff_mxf_d10_muxer) { if (sc->video_bit_rate == 50000000) { if (mxf->time_base.den == 25) sc->index = 3; else sc->index = 5; } else if (sc->video_bit_rate == 40000000) { if (mxf->time_base.den == 25) sc->index = 7; else sc->index = 9; } else if (sc->video_bit_rate == 30000000) { if (mxf->time_base.den == 25) sc->index = 11; else sc->index = 13; } else { av_log(s, AV_LOG_ERROR, ""error MXF D-10 only support 30/40/50 mbit/s\n""); return -1; } mxf->edit_unit_byte_count = KAG_SIZE; // system element mxf->edit_unit_byte_count += 16 + 4 + (uint64_t)sc->video_bit_rate * mxf->time_base.num / (8*mxf->time_base.den); mxf->edit_unit_byte_count += klv_fill_size(mxf->edit_unit_byte_count); mxf->edit_unit_byte_count += 16 + 4 + 4 + spf->samples_per_frame[0]*8*4; mxf->edit_unit_byte_count += klv_fill_size(mxf->edit_unit_byte_count); sc->signal_standard = 1; } } else if (st->codec->codec_type == AVMEDIA_TYPE_AUDIO) { if (st->codec->sample_rate != 48000) { av_log(s, AV_LOG_ERROR, ""only 48khz is implemented\n""); return -1; } avpriv_set_pts_info(st, 64, 1, st->codec->sample_rate); if (s->oformat == &ff_mxf_d10_muxer) { if (st->index != 1) { av_log(s, AV_LOG_ERROR, ""MXF D-10 only support one audio track\n""); return -1; } if (st->codec->codec_id != AV_CODEC_ID_PCM_S16LE && st->codec->codec_id != AV_CODEC_ID_PCM_S24LE) { av_log(s, AV_LOG_ERROR, ""MXF D-10 only support 16 or 24 bits le audio\n""); } sc->index = ((MXFStreamContext*)s->streams[0]->priv_data)->index + 1; } else if (s->oformat == &ff_mxf_opatom_muxer) { AVRational tbc = av_inv_q(mxf->audio_edit_rate); if (st->codec->codec_id != AV_CODEC_ID_PCM_S16LE && st->codec->codec_id != AV_CODEC_ID_PCM_S24LE) { av_log(s, AV_LOG_ERROR, ""Only pcm_s16le and pcm_s24le audio codecs are implemented\n""); return AVERROR_PATCHWELCOME; } if (st->codec->channels != 1) { av_log(s, AV_LOG_ERROR, ""MXF OPAtom only supports single channel audio\n""); return AVERROR(EINVAL); } spf = ff_mxf_get_samples_per_frame(s, tbc); if (!spf){ av_log(s, AV_LOG_ERROR, ""Unsupported timecode frame rate %d/%d\n"", tbc.den, tbc.num); return AVERROR(EINVAL); } mxf->time_base = st->time_base; if((ret = mxf_init_timecode(s, st, av_inv_q(spf->time_base))) < 0) return ret; mxf->timecode_base = (tbc.den + tbc.num/2) / tbc.num; mxf->edit_unit_byte_count = (av_get_bits_per_sample(st->codec->codec_id) * st->codec->channels) >> 3; sc->index = 2; } else { mxf->slice_count = 1; } } if (!sc->index) { sc->index = mxf_get_essence_container_ul_index(st->codec->codec_id); if (sc->index == -1) { av_log(s, AV_LOG_ERROR, ""track %d: could not find essence container ul, "" ""codec not currently supported in container\n"", i); return -1; } } sc->codec_ul = &mxf_essence_container_uls[sc->index].codec_ul; memcpy(sc->track_essence_element_key, mxf_essence_container_uls[sc->index].element_ul, 15); sc->track_essence_element_key[15] = present[sc->index]; PRINT_KEY(s, ""track essence element key"", sc->track_essence_element_key); if (!present[sc->index]) mxf->essence_container_count++; present[sc->index]++; } if (s->oformat == &ff_mxf_d10_muxer || s->oformat == &ff_mxf_opatom_muxer) { mxf->essence_container_count = 1; } if (!(s->flags & AVFMT_FLAG_BITEXACT)) mxf_gen_umid(s); for (i = 0; i < s->nb_streams; i++) { MXFStreamContext *sc = s->streams[i]->priv_data; // update element count sc->track_essence_element_key[13] = present[sc->index]; if (!memcmp(sc->track_essence_element_key, mxf_essence_container_uls[15].element_ul, 13)) // DV sc->order = (0x15 << 24) | AV_RB32(sc->track_essence_element_key+13); else sc->order = AV_RB32(sc->track_essence_element_key+12); } if (t = av_dict_get(s->metadata, ""creation_time"", NULL, 0)) timestamp = ff_iso8601_to_unix_time(t->value); if (timestamp) mxf->timestamp = mxf_parse_timestamp(timestamp); mxf->duration = -1; mxf->timecode_track = av_mallocz(sizeof(*mxf->timecode_track)); if (!mxf->timecode_track) return AVERROR(ENOMEM); mxf->timecode_track->priv_data = av_mallocz(sizeof(MXFStreamContext)); if (!mxf->timecode_track->priv_data) return AVERROR(ENOMEM); mxf->timecode_track->index = -1; if (!spf) spf = ff_mxf_get_samples_per_frame(s, (AVRational){ 1, 25 }); if (ff_audio_interleave_init(s, spf->samples_per_frame, mxf->time_base) < 0) return -1; return 0; }","No, it is non-vulnerable."118116,"static void ide_flush_cb(void *opaque, int ret) { IDEState *s = opaque; s->pio_aiocb = NULL; if (ret == -ECANCELED) { return; } if (ret < 0) { /* XXX: What sector number to set here? */ if (ide_handle_rw_error(s, -ret, IDE_RETRY_FLUSH)) { return; } } if (s->bs) { block_acct_done(bdrv_get_stats(s->bs), &s->acct); } s->status = READY_STAT | SEEK_STAT; ide_cmd_done(s); ide_set_irq(s->bus); }","No, it is non-vulnerable."119117,"static int ehci_init_transfer(EHCIPacket *p) { uint32_t cpage, offset, bytes, plen; dma_addr_t page; USBBus *bus = &p->queue->ehci->bus; BusState *qbus = BUS(bus); cpage = get_field(p->qtd.token, QTD_TOKEN_CPAGE); bytes = get_field(p->qtd.token, QTD_TOKEN_TBYTES); offset = p->qtd.bufptr[0] & ~QTD_BUFPTR_MASK; qemu_sglist_init(&p->sgl, qbus->parent, 5, p->queue->ehci->as); while (bytes > 0) { if (cpage > 4) { fprintf(stderr, ""cpage out of range (%d)\n"", cpage); return -1; } page = p->qtd.bufptr[cpage] & QTD_BUFPTR_MASK; page += offset; plen = bytes; if (plen > 4096 - offset) { plen = 4096 - offset; offset = 0; cpage++; } qemu_sglist_add(&p->sgl, page, plen); bytes -= plen; } return 0; }","No, it is non-vulnerable."120118,"int av_opencl_register_kernel_code(const char *kernel_code) { int i, ret = 0; LOCK_OPENCL; if (gpu_env.kernel_code_count >= MAX_KERNEL_CODE_NUM) { av_log(&openclutils, AV_LOG_ERROR, ""Could not register kernel code, maximum number of registered kernel code %d already reached\n"", MAX_KERNEL_CODE_NUM); ret = AVERROR(EINVAL); goto end; } for (i = 0; i < gpu_env.kernel_code_count; i++) { if (gpu_env.kernel_code[i].kernel_string == kernel_code) { av_log(&openclutils, AV_LOG_WARNING, ""Same kernel code has been registered\n""); goto end; } } gpu_env.kernel_code[gpu_env.kernel_code_count].kernel_string = kernel_code; gpu_env.kernel_code[gpu_env.kernel_code_count].is_compiled = 0; gpu_env.kernel_code_count++; end: UNLOCK_OPENCL; return ret; }","No, it is non-vulnerable."121119,"static void compute_stats(HTTPContext *c) { HTTPContext *c1; FFStream *stream; char *p; time_t ti; int i, len; ByteIOContext pb1, *pb = &pb1; if (url_open_dyn_buf(pb) < 0) { /* XXX: return an error ? */ c->buffer_ptr = c->buffer; c->buffer_end = c->buffer; return; } url_fprintf(pb, ""HTTP/1.0 200 OK\r\n""); url_fprintf(pb, ""Content-type: %s\r\n"", ""text/html""); url_fprintf(pb, ""Pragma: no-cache\r\n""); url_fprintf(pb, ""\r\n""); url_fprintf(pb, ""<HEAD><TITLE>FFServer Status</TITLE>\n""); if (c->stream->feed_filename) url_fprintf(pb, ""<link rel=\""shortcut icon\"" href=\""%s\"">\n"", c->stream->feed_filename); url_fprintf(pb, ""</HEAD>\n<BODY>""); url_fprintf(pb, ""<H1>FFServer Status</H1>\n""); /* format status */ url_fprintf(pb, ""<H2>Available Streams</H2>\n""); url_fprintf(pb, ""<TABLE cellspacing=0 cellpadding=4>\n""); url_fprintf(pb, ""<TR><Th valign=top>Path<th align=left>Served<br>Conns<Th><br>bytes<Th valign=top>Format<Th>Bit rate<br>kbits/s<Th align=left>Video<br>kbits/s<th><br>Codec<Th align=left>Audio<br>kbits/s<th><br>Codec<Th align=left valign=top>Feed\n""); stream = first_stream; while (stream != NULL) { char sfilename[1024]; char *eosf; if (stream->feed != stream) { av_strlcpy(sfilename, stream->filename, sizeof(sfilename) - 10); eosf = sfilename + strlen(sfilename); if (eosf - sfilename >= 4) { if (strcmp(eosf - 4, "".asf"") == 0) strcpy(eosf - 4, "".asx""); else if (strcmp(eosf - 3, "".rm"") == 0) strcpy(eosf - 3, "".ram""); else if (!strcmp(stream->fmt->name, ""rtp"")) { /* generate a sample RTSP director if unicast. Generate an SDP redirector if multicast */ eosf = strrchr(sfilename, '.'); if (!eosf) eosf = sfilename + strlen(sfilename); if (stream->is_multicast) strcpy(eosf, "".sdp""); else strcpy(eosf, "".rtsp""); } } url_fprintf(pb, ""<TR><TD><A HREF=\""/%s\"">%s</A> "", sfilename, stream->filename); url_fprintf(pb, ""<td align=right> %d <td align=right> "", stream->conns_served); fmt_bytecount(pb, stream->bytes_served); switch(stream->stream_type) { case STREAM_TYPE_LIVE: { int audio_bit_rate = 0; int video_bit_rate = 0; const char *audio_codec_name = """"; const char *video_codec_name = """"; const char *audio_codec_name_extra = """"; const char *video_codec_name_extra = """"; for(i=0;i<stream->nb_streams;i++) { AVStream *st = stream->streams[i]; AVCodec *codec = avcodec_find_encoder(st->codec->codec_id); switch(st->codec->codec_type) { case CODEC_TYPE_AUDIO: audio_bit_rate += st->codec->bit_rate; if (codec) { if (*audio_codec_name) audio_codec_name_extra = ""...""; audio_codec_name = codec->name; } break; case CODEC_TYPE_VIDEO: video_bit_rate += st->codec->bit_rate; if (codec) { if (*video_codec_name) video_codec_name_extra = ""...""; video_codec_name = codec->name; } break; case CODEC_TYPE_DATA: video_bit_rate += st->codec->bit_rate; break; default: abort(); } } url_fprintf(pb, ""<TD align=center> %s <TD align=right> %d <TD align=right> %d <TD> %s %s <TD align=right> %d <TD> %s %s"", stream->fmt->name, stream->bandwidth, video_bit_rate / 1000, video_codec_name, video_codec_name_extra, audio_bit_rate / 1000, audio_codec_name, audio_codec_name_extra); if (stream->feed) url_fprintf(pb, ""<TD>%s"", stream->feed->filename); else url_fprintf(pb, ""<TD>%s"", stream->feed_filename); url_fprintf(pb, ""\n""); } break; default: url_fprintf(pb, ""<TD align=center> - <TD align=right> - <TD align=right> - <td><td align=right> - <TD>\n""); break; } } stream = stream->next; } url_fprintf(pb, ""</TABLE>\n""); stream = first_stream; while (stream != NULL) { if (stream->feed == stream) { url_fprintf(pb, ""<h2>Feed %s</h2>"", stream->filename); if (stream->pid) { url_fprintf(pb, ""Running as pid %d.\n"", stream->pid); #if defined(linux) && !defined(CONFIG_NOCUTILS) { FILE *pid_stat; char ps_cmd[64]; /* This is somewhat linux specific I guess */ snprintf(ps_cmd, sizeof(ps_cmd), ""ps -o \""%%cpu,cputime\"" --no-headers %d"", stream->pid); pid_stat = popen(ps_cmd, ""r""); if (pid_stat) { char cpuperc[10]; char cpuused[64]; if (fscanf(pid_stat, ""%10s %64s"", cpuperc, cpuused) == 2) { url_fprintf(pb, ""Currently using %s%% of the cpu. Total time used %s.\n"", cpuperc, cpuused); } fclose(pid_stat); } } #endif url_fprintf(pb, ""<p>""); } url_fprintf(pb, ""<table cellspacing=0 cellpadding=4><tr><th>Stream<th>type<th>kbits/s<th align=left>codec<th align=left>Parameters\n""); for (i = 0; i < stream->nb_streams; i++) { AVStream *st = stream->streams[i]; AVCodec *codec = avcodec_find_encoder(st->codec->codec_id); const char *type = ""unknown""; char parameters[64]; parameters[0] = 0; switch(st->codec->codec_type) { case CODEC_TYPE_AUDIO: type = ""audio""; snprintf(parameters, sizeof(parameters), ""%d channel(s), %d Hz"", st->codec->channels, st->codec->sample_rate); break; case CODEC_TYPE_VIDEO: type = ""video""; snprintf(parameters, sizeof(parameters), ""%dx%d, q=%d-%d, fps=%d"", st->codec->width, st->codec->height, st->codec->qmin, st->codec->qmax, st->codec->time_base.den / st->codec->time_base.num); break; default: abort(); } url_fprintf(pb, ""<tr><td align=right>%d<td>%s<td align=right>%d<td>%s<td>%s\n"", i, type, st->codec->bit_rate/1000, codec ? codec->name : """", parameters); } url_fprintf(pb, ""</table>\n""); } stream = stream->next; } #if 0 { float avg; AVCodecContext *enc; char buf[1024]; /* feed status */ stream = first_feed; while (stream != NULL) { url_fprintf(pb, ""<H1>Feed '%s'</H1>\n"", stream->filename); url_fprintf(pb, ""<TABLE>\n""); url_fprintf(pb, ""<TR><TD>Parameters<TD>Frame count<TD>Size<TD>Avg bitrate (kbits/s)\n""); for(i=0;i<stream->nb_streams;i++) { AVStream *st = stream->streams[i]; FeedData *fdata = st->priv_data; enc = st->codec; avcodec_string(buf, sizeof(buf), enc); avg = fdata->avg_frame_size * (float)enc->rate * 8.0; if (enc->codec->type == CODEC_TYPE_AUDIO && enc->frame_size > 0) avg /= enc->frame_size; url_fprintf(pb, ""<TR><TD>%s <TD> %d <TD> %""PRId64"" <TD> %0.1f\n"", buf, enc->frame_number, fdata->data_count, avg / 1000.0); } url_fprintf(pb, ""</TABLE>\n""); stream = stream->next_feed; } } #endif /* connection status */ url_fprintf(pb, ""<H2>Connection Status</H2>\n""); url_fprintf(pb, ""Number of connections: %d / %d<BR>\n"", nb_connections, nb_max_connections); url_fprintf(pb, ""Bandwidth in use: %dk / %dk<BR>\n"", current_bandwidth, max_bandwidth); url_fprintf(pb, ""<TABLE>\n""); url_fprintf(pb, ""<TR><th>#<th>File<th>IP<th>Proto<th>State<th>Target bits/sec<th>Actual bits/sec<th>Bytes transferred\n""); c1 = first_http_ctx; i = 0; while (c1 != NULL) { int bitrate; int j; bitrate = 0; if (c1->stream) { for (j = 0; j < c1->stream->nb_streams; j++) { if (!c1->stream->feed) bitrate += c1->stream->streams[j]->codec->bit_rate; else if (c1->feed_streams[j] >= 0) bitrate += c1->stream->feed->streams[c1->feed_streams[j]]->codec->bit_rate; } } i++; p = inet_ntoa(c1->from_addr.sin_addr); url_fprintf(pb, ""<TR><TD><B>%d</B><TD>%s%s<TD>%s<TD>%s<TD>%s<td align=right>"", i, c1->stream ? c1->stream->filename : """", c1->state == HTTPSTATE_RECEIVE_DATA ? ""(input)"" : """", p, c1->protocol, http_state[c1->state]); fmt_bytecount(pb, bitrate); url_fprintf(pb, ""<td align=right>""); fmt_bytecount(pb, compute_datarate(&c1->datarate, c1->data_count) * 8); url_fprintf(pb, ""<td align=right>""); fmt_bytecount(pb, c1->data_count); url_fprintf(pb, ""\n""); c1 = c1->next; } url_fprintf(pb, ""</TABLE>\n""); /* date */ ti = time(NULL); p = ctime(&ti); url_fprintf(pb, ""<HR size=1 noshade>Generated at %s"", p); url_fprintf(pb, ""</BODY>\n</HTML>\n""); len = url_close_dyn_buf(pb, &c->pb_buffer); c->buffer_ptr = c->pb_buffer; c->buffer_end = c->pb_buffer + len; }","Yes, it is vulnerable."122120,"void gen_intermediate_code(CPUState *cs, TranslationBlock *tb) { CPUM68KState *env = cs->env_ptr; DisasContext dc1, *dc = &dc1; target_ulong pc_start; int pc_offset; int num_insns; int max_insns; /* generate intermediate code */ pc_start = tb->pc; dc->tb = tb; dc->env = env; dc->is_jmp = DISAS_NEXT; dc->pc = pc_start; dc->cc_op = CC_OP_DYNAMIC; dc->cc_op_synced = 1; dc->singlestep_enabled = cs->singlestep_enabled; dc->user = (env->sr & SR_S) == 0; dc->done_mac = 0; dc->writeback_mask = 0; num_insns = 0; max_insns = tb->cflags & CF_COUNT_MASK; if (max_insns == 0) { max_insns = CF_COUNT_MASK; } if (max_insns > TCG_MAX_INSNS) { max_insns = TCG_MAX_INSNS; } gen_tb_start(tb); do { pc_offset = dc->pc - pc_start; gen_throws_exception = NULL; tcg_gen_insn_start(dc->pc, dc->cc_op); num_insns++; if (unlikely(cpu_breakpoint_test(cs, dc->pc, BP_ANY))) { gen_exception(dc, dc->pc, EXCP_DEBUG); dc->is_jmp = DISAS_JUMP; /* The address covered by the breakpoint must be included in [tb->pc, tb->pc + tb->size) in order to for it to be properly cleared -- thus we increment the PC here so that the logic setting tb->size below does the right thing. */ dc->pc += 2; break; } if (num_insns == max_insns && (tb->cflags & CF_LAST_IO)) { gen_io_start(); } dc->insn_pc = dc->pc; disas_m68k_insn(env, dc); } while (!dc->is_jmp && !tcg_op_buf_full() && !cs->singlestep_enabled && !singlestep && (pc_offset) < (TARGET_PAGE_SIZE - 32) && num_insns < max_insns); if (tb->cflags & CF_LAST_IO) gen_io_end(); if (unlikely(cs->singlestep_enabled)) { /* Make sure the pc is updated, and raise a debug exception. */ if (!dc->is_jmp) { update_cc_op(dc); tcg_gen_movi_i32(QREG_PC, dc->pc); } gen_helper_raise_exception(cpu_env, tcg_const_i32(EXCP_DEBUG)); } else { switch(dc->is_jmp) { case DISAS_NEXT: update_cc_op(dc); gen_jmp_tb(dc, 0, dc->pc); break; default: case DISAS_JUMP: case DISAS_UPDATE: update_cc_op(dc); /* indicate that the hash table must be used to find the next TB */ tcg_gen_exit_tb(0); break; case DISAS_TB_JUMP: /* nothing more to generate */ break; } } gen_tb_end(tb, num_insns); #ifdef DEBUG_DISAS if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM) && qemu_log_in_addr_range(pc_start)) { qemu_log_lock(); qemu_log(""----------------\n""); qemu_log(""IN: %s\n"", lookup_symbol(pc_start)); log_target_disas(cs, pc_start, dc->pc - pc_start, 0); qemu_log(""\n""); qemu_log_unlock(); } #endif tb->size = dc->pc - pc_start; tb->icount = num_insns; }","Yes, it is vulnerable."123121,"BdrvChild *bdrv_open_child(const char *filename, QDict *options, const char *bdref_key, BlockDriverState* parent, const BdrvChildRole *child_role, bool allow_none, Error **errp) { BdrvChild *c = NULL; BlockDriverState *bs; QDict *image_options; int ret; char *bdref_key_dot; const char *reference; assert(child_role != NULL); bdref_key_dot = g_strdup_printf(""%s."", bdref_key); qdict_extract_subqdict(options, &image_options, bdref_key_dot); g_free(bdref_key_dot); reference = qdict_get_try_str(options, bdref_key); if (!filename && !reference && !qdict_size(image_options)) { if (!allow_none) { error_setg(errp, ""A block device must be specified for \""%s\"""", bdref_key); } QDECREF(image_options); goto done; } bs = NULL; ret = bdrv_open_inherit(&bs, filename, reference, image_options, 0, parent, child_role, errp); if (ret < 0) { goto done; } c = bdrv_attach_child(parent, bs, child_role); done: qdict_del(options, bdref_key); return c; }","No, it is non-vulnerable."124122,"av_cold void ff_videodsp_init_x86(VideoDSPContext *ctx, int bpc) { #if HAVE_YASM int cpu_flags = av_get_cpu_flags(); #if ARCH_X86_32 if (EXTERNAL_MMX(cpu_flags) && bpc <= 8) { ctx->emulated_edge_mc = emulated_edge_mc_mmx; } if (EXTERNAL_AMD3DNOW(cpu_flags)) { ctx->prefetch = ff_prefetch_3dnow; } #endif /* ARCH_X86_32 */ if (EXTERNAL_MMXEXT(cpu_flags)) { ctx->prefetch = ff_prefetch_mmxext; #if ARCH_X86_32 if (bpc <= 8) ctx->emulated_edge_mc = emulated_edge_mc_mmxext; #endif /* ARCH_X86_32 */ } #if ARCH_X86_32 if (EXTERNAL_SSE(cpu_flags) && bpc <= 8) { ctx->emulated_edge_mc = emulated_edge_mc_sse; } #endif /* ARCH_X86_32 */ if (EXTERNAL_SSE2(cpu_flags) && bpc <= 8) { ctx->emulated_edge_mc = emulated_edge_mc_sse2; } #endif /* HAVE_YASM */ }","No, it is non-vulnerable."125123,"static void vapic_write(void *opaque, hwaddr addr, uint64_t data, unsigned int size) { CPUState *cs = current_cpu; X86CPU *cpu = X86_CPU(cs); CPUX86State *env = &cpu->env; hwaddr rom_paddr; VAPICROMState *s = opaque; cpu_synchronize_state(cs); /* * The VAPIC supports two PIO-based hypercalls, both via port 0x7E. * o 16-bit write access: * Reports the option ROM initialization to the hypervisor. Written * value is the offset of the state structure in the ROM. * o 8-bit write access: * Reactivates the VAPIC after a guest hibernation, i.e. after the * option ROM content has been re-initialized by a guest power cycle. * o 32-bit write access: * Poll for pending IRQs, considering the current VAPIC state. */ switch (size) { case 2: if (s->state == VAPIC_INACTIVE) { rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK; s->rom_state_paddr = rom_paddr + data; s->state = VAPIC_STANDBY; } if (vapic_prepare(s) < 0) { s->state = VAPIC_INACTIVE; s->rom_state_paddr = 0; break; } break; case 1: if (kvm_enabled()) { /* * Disable triggering instruction in ROM by writing a NOP. * * We cannot do this in TCG mode as the reported IP is not * accurate. */ pause_all_vcpus(); patch_byte(cpu, env->eip - 2, 0x66); patch_byte(cpu, env->eip - 1, 0x90); resume_all_vcpus(); } if (s->state == VAPIC_ACTIVE) { break; } if (update_rom_mapping(s, env, env->eip) < 0) { break; } if (find_real_tpr_addr(s, env) < 0) { break; } vapic_enable(s, cpu); break; default: case 4: if (!kvm_irqchip_in_kernel()) { apic_poll_irq(cpu->apic_state); } break; } }","Yes, it is vulnerable."126124,static bool riccb_needed(void *opaque) { #ifdef CONFIG_KVM if (kvm_enabled()) { return kvm_s390_get_ri(); } #endif return 0; },"No, it is non-vulnerable."127125,"static av_always_inline void decode_cabac_luma_residual(const H264Context *h, H264SliceContext *sl, const uint8_t *scan, const uint8_t *scan8x8, int pixel_shift, int mb_type, int cbp, int p) { static const uint8_t ctx_cat[4][3] = {{0,6,10},{1,7,11},{2,8,12},{5,9,13}}; const uint32_t *qmul; int i8x8, i4x4; int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1]; if( IS_INTRA16x16( mb_type ) ) { AV_ZERO128(sl->mb_luma_dc[p]+0); AV_ZERO128(sl->mb_luma_dc[p]+8); AV_ZERO128(sl->mb_luma_dc[p]+16); AV_ZERO128(sl->mb_luma_dc[p]+24); decode_cabac_residual_dc(h, sl, sl->mb_luma_dc[p], ctx_cat[0][p], LUMA_DC_BLOCK_INDEX+p, scan, 16); if( cbp&15 ) { qmul = h->dequant4_coeff[p][qscale]; for( i4x4 = 0; i4x4 < 16; i4x4++ ) { const int index = 16*p + i4x4; decode_cabac_residual_nondc(h, sl, sl->mb + (16*index << pixel_shift), ctx_cat[1][p], index, scan + 1, qmul, 15); } } else { fill_rectangle(&sl->non_zero_count_cache[scan8[16*p]], 4, 4, 8, 0, 1); } } else { int cqm = (IS_INTRA( mb_type ) ? 0:3) + p; for( i8x8 = 0; i8x8 < 4; i8x8++ ) { if( cbp & (1<<i8x8) ) { if( IS_8x8DCT(mb_type) ) { const int index = 16*p + 4*i8x8; decode_cabac_residual_nondc(h, sl, sl->mb + (16*index << pixel_shift), ctx_cat[3][p], index, scan8x8, h->dequant8_coeff[cqm][qscale], 64); } else { qmul = h->dequant4_coeff[cqm][qscale]; for( i4x4 = 0; i4x4 < 4; i4x4++ ) { const int index = 16*p + 4*i8x8 + i4x4; //START_TIMER decode_cabac_residual_nondc(h, sl, sl->mb + (16*index << pixel_shift), ctx_cat[2][p], index, scan, qmul, 16); //STOP_TIMER(""decode_residual"") } } } else { fill_rectangle(&sl->non_zero_count_cache[scan8[4*i8x8+16*p]], 2, 2, 8, 0, 1); } } } }","No, it is non-vulnerable."128126,"static int virtio_ccw_load_config(DeviceState *d, QEMUFile *f) { VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d); CcwDevice *ccw_dev = CCW_DEVICE(d); CCWDeviceClass *ck = CCW_DEVICE_GET_CLASS(ccw_dev); SubchDev *s = ccw_dev->sch; VirtIODevice *vdev = virtio_ccw_get_vdev(s); int len; s->driver_data = dev; subch_device_load(s, f); /* Re-fill subch_id after loading the subchannel states.*/ if (ck->refill_ids) { ck->refill_ids(ccw_dev); } len = qemu_get_be32(f); if (len != 0) { dev->indicators = get_indicator(qemu_get_be64(f), len); } else { qemu_get_be64(f); dev->indicators = NULL; } len = qemu_get_be32(f); if (len != 0) { dev->indicators2 = get_indicator(qemu_get_be64(f), len); } else { qemu_get_be64(f); dev->indicators2 = NULL; } len = qemu_get_be32(f); if (len != 0) { dev->summary_indicator = get_indicator(qemu_get_be64(f), len); } else { qemu_get_be64(f); dev->summary_indicator = NULL; } qemu_get_be16s(f, &vdev->config_vector); dev->routes.adapter.ind_offset = qemu_get_be64(f); dev->thinint_isc = qemu_get_byte(f); dev->revision = qemu_get_be32(f); if (s->thinint_active) { return css_register_io_adapter(CSS_IO_ADAPTER_VIRTIO, dev->thinint_isc, true, false, &dev->routes.adapter.adapter_id); } return 0; }","No, it is non-vulnerable."129127,"PCIBus *pci_pmac_u3_init(qemu_irq *pic, MemoryRegion *address_space_mem, MemoryRegion *address_space_io) { DeviceState *dev; SysBusDevice *s; PCIHostState *h; UNINState *d; /* Uninorth AGP bus */ dev = qdev_create(NULL, TYPE_U3_AGP_HOST_BRIDGE); qdev_init_nofail(dev); s = SYS_BUS_DEVICE(dev); h = PCI_HOST_BRIDGE(dev); d = U3_AGP_HOST_BRIDGE(dev); memory_region_init(&d->pci_mmio, OBJECT(d), ""pci-mmio"", 0x100000000ULL); memory_region_init_alias(&d->pci_hole, OBJECT(d), ""pci-hole"", &d->pci_mmio, 0x80000000ULL, 0x70000000ULL); memory_region_add_subregion(address_space_mem, 0x80000000ULL, &d->pci_hole); h->bus = pci_register_bus(dev, ""pci"", pci_unin_set_irq, pci_unin_map_irq, pic, &d->pci_mmio, address_space_io, PCI_DEVFN(11, 0), 4, TYPE_PCI_BUS); sysbus_mmio_map(s, 0, 0xf0800000); sysbus_mmio_map(s, 1, 0xf0c00000); pci_create_simple(h->bus, 11 << 3, ""u3-agp""); return h->bus; }","No, it is non-vulnerable."130128,"static void filter_samples(AVFilterLink *inlink, AVFilterBufferRef *samplesref) { AVFilterContext *ctx = inlink->dst; int i; for (i = 0; i < ctx->nb_outputs; i++) ff_filter_samples(inlink->dst->outputs[i], avfilter_ref_buffer(samplesref, ~AV_PERM_WRITE)); }","Yes, it is vulnerable."131129,"void coroutine_fn qemu_co_mutex_lock(CoMutex *mutex) { Coroutine *self = qemu_coroutine_self(); trace_qemu_co_mutex_lock_entry(mutex, self); while (mutex->locked) { qemu_co_queue_wait(&mutex->queue); } mutex->locked = true; trace_qemu_co_mutex_lock_return(mutex, self); }","Yes, it is vulnerable."132130,"void hmp_info_block(Monitor *mon, const QDict *qdict) { BlockInfoList *block_list, *info; ImageInfo *image_info; const char *device = qdict_get_try_str(qdict, ""device""); bool verbose = qdict_get_try_bool(qdict, ""verbose"", 0); block_list = qmp_query_block(NULL); for (info = block_list; info; info = info->next) { if (device && strcmp(device, info->value->device)) { continue; } if (info != block_list) { monitor_printf(mon, ""\n""); } monitor_printf(mon, ""%s"", info->value->device); if (info->value->has_inserted) { monitor_printf(mon, "": %s (%s%s%s)\n"", info->value->inserted->file, info->value->inserted->drv, info->value->inserted->ro ? "", read-only"" : """", info->value->inserted->encrypted ? "", encrypted"" : """"); } else { monitor_printf(mon, "": [not inserted]\n""); } if (info->value->has_io_status && info->value->io_status != BLOCK_DEVICE_IO_STATUS_OK) { monitor_printf(mon, "" I/O status: %s\n"", BlockDeviceIoStatus_lookup[info->value->io_status]); } if (info->value->removable) { monitor_printf(mon, "" Removable device: %slocked, tray %s\n"", info->value->locked ? """" : ""not "", info->value->tray_open ? ""open"" : ""closed""); } if (!info->value->has_inserted) { continue; } if (info->value->inserted->has_backing_file) { monitor_printf(mon, "" Backing file: %s "" ""(chain depth: %"" PRId64 "")\n"", info->value->inserted->backing_file, info->value->inserted->backing_file_depth); } if (info->value->inserted->bps || info->value->inserted->bps_rd || info->value->inserted->bps_wr || info->value->inserted->iops || info->value->inserted->iops_rd || info->value->inserted->iops_wr) { monitor_printf(mon, "" I/O throttling: bps=%"" PRId64 "" bps_rd=%"" PRId64 "" bps_wr=%"" PRId64 "" iops=%"" PRId64 "" iops_rd=%"" PRId64 "" iops_wr=%"" PRId64 ""\n"", info->value->inserted->bps, info->value->inserted->bps_rd, info->value->inserted->bps_wr, info->value->inserted->iops, info->value->inserted->iops_rd, info->value->inserted->iops_wr); } if (verbose) { monitor_printf(mon, ""\nImages:\n""); image_info = info->value->inserted->image; while (1) { bdrv_image_info_dump((fprintf_function)monitor_printf, mon, image_info); if (image_info->has_backing_image) { image_info = image_info->backing_image; } else { break; } } } } qapi_free_BlockInfoList(block_list); }","Yes, it is vulnerable."133131,"static inline int decode_residual_inter(AVSContext *h) { int block; /* get coded block pattern */ int cbp= get_ue_golomb(&h->s.gb); if(cbp > 63){ av_log(h->s.avctx, AV_LOG_ERROR, ""illegal inter cbp\n""); return -1; } h->cbp = cbp_tab[cbp][1]; /* get quantizer */ if(h->cbp && !h->qp_fixed) h->qp = (h->qp + get_se_golomb(&h->s.gb)) & 63; for(block=0;block<4;block++) if(h->cbp & (1<<block)) decode_residual_block(h,&h->s.gb,ff_cavs_inter_dec,0,h->qp, h->cy + h->luma_scan[block], h->l_stride); decode_residual_chroma(h); return 0; }","Yes, it is vulnerable."134132,"static void fw_cfg_write(FWCfgState *s, uint8_t value) { int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL); FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK]; FW_CFG_DPRINTF(""write %d\n"", value); if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) { e->data[s->cur_offset++] = value; if (s->cur_offset == e->len) { e->callback(e->callback_opaque, e->data); s->cur_offset = 0; } } }","Yes, it is vulnerable."135133,"int qemu_peek_buffer(QEMUFile *f, uint8_t *buf, int size, size_t offset) { int pending; int index; assert(!qemu_file_is_writable(f)); index = f->buf_index + offset; pending = f->buf_size - index; if (pending < size) { qemu_fill_buffer(f); index = f->buf_index + offset; pending = f->buf_size - index; } if (pending <= 0) { return 0; } if (size > pending) { size = pending; } memcpy(buf, f->buf + index, size); return size; }","Yes, it is vulnerable."136134,"static int ahci_dma_rw_buf(IDEDMA *dma, int is_write) { AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma); IDEState *s = &ad->port.ifs[0]; uint8_t *p = s->io_buffer + s->io_buffer_index; int l = s->io_buffer_size - s->io_buffer_index; if (ahci_populate_sglist(ad, &s->sg)) { return 0; } if (is_write) { dma_buf_read(p, l, &s->sg); } else { dma_buf_write(p, l, &s->sg); } /* update number of transferred bytes */ ad->cur_cmd->status = cpu_to_le32(le32_to_cpu(ad->cur_cmd->status) + l); s->io_buffer_index += l; DPRINTF(ad->port_no, ""len=%#x\n"", l); return 1; }","Yes, it is vulnerable."137135,"void cpu_save(QEMUFile *f, void *opaque) { CPUState *env = (CPUState *)opaque; unsigned int i, j; cpu_synchronize_state(env); for (i = 0; i < 32; i++) qemu_put_betls(f, &env->gpr[i]); #if !defined(TARGET_PPC64) for (i = 0; i < 32; i++) qemu_put_betls(f, &env->gprh[i]); #endif qemu_put_betls(f, &env->lr); qemu_put_betls(f, &env->ctr); for (i = 0; i < 8; i++) qemu_put_be32s(f, &env->crf[i]); qemu_put_betls(f, &env->xer); qemu_put_betls(f, &env->reserve_addr); qemu_put_betls(f, &env->msr); for (i = 0; i < 4; i++) qemu_put_betls(f, &env->tgpr[i]); for (i = 0; i < 32; i++) { union { float64 d; uint64_t l; } u; u.d = env->fpr[i]; qemu_put_be64(f, u.l); } qemu_put_be32s(f, &env->fpscr); qemu_put_sbe32s(f, &env->access_type); #if !defined(CONFIG_USER_ONLY) #if defined(TARGET_PPC64) qemu_put_betls(f, &env->asr); qemu_put_sbe32s(f, &env->slb_nr); #endif qemu_put_betls(f, &env->sdr1); for (i = 0; i < 32; i++) qemu_put_betls(f, &env->sr[i]); for (i = 0; i < 2; i++) for (j = 0; j < 8; j++) qemu_put_betls(f, &env->DBAT[i][j]); for (i = 0; i < 2; i++) for (j = 0; j < 8; j++) qemu_put_betls(f, &env->IBAT[i][j]); qemu_put_sbe32s(f, &env->nb_tlb); qemu_put_sbe32s(f, &env->tlb_per_way); qemu_put_sbe32s(f, &env->nb_ways); qemu_put_sbe32s(f, &env->last_way); qemu_put_sbe32s(f, &env->id_tlbs); qemu_put_sbe32s(f, &env->nb_pids); if (env->tlb) { // XXX assumes 6xx for (i = 0; i < env->nb_tlb; i++) { qemu_put_betls(f, &env->tlb[i].tlb6.pte0); qemu_put_betls(f, &env->tlb[i].tlb6.pte1); qemu_put_betls(f, &env->tlb[i].tlb6.EPN); } } for (i = 0; i < 4; i++) qemu_put_betls(f, &env->pb[i]); #endif for (i = 0; i < 1024; i++) qemu_put_betls(f, &env->spr[i]); qemu_put_be32s(f, &env->vscr); qemu_put_be64s(f, &env->spe_acc); qemu_put_be32s(f, &env->spe_fscr); qemu_put_betls(f, &env->msr_mask); qemu_put_be32s(f, &env->flags); qemu_put_sbe32s(f, &env->error_code); qemu_put_be32s(f, &env->pending_interrupts); #if !defined(CONFIG_USER_ONLY) qemu_put_be32s(f, &env->irq_input_state); for (i = 0; i < POWERPC_EXCP_NB; i++) qemu_put_betls(f, &env->excp_vectors[i]); qemu_put_betls(f, &env->excp_prefix); qemu_put_betls(f, &env->hreset_excp_prefix); qemu_put_betls(f, &env->ivor_mask); qemu_put_betls(f, &env->ivpr_mask); qemu_put_betls(f, &env->hreset_vector); #endif qemu_put_betls(f, &env->nip); qemu_put_betls(f, &env->hflags); qemu_put_betls(f, &env->hflags_nmsr); qemu_put_sbe32s(f, &env->mmu_idx); qemu_put_sbe32s(f, &env->power_mode); }","Yes, it is vulnerable."138136,"static DeviceState *sun4c_intctl_init(target_phys_addr_t addr, qemu_irq *parent_irq) { DeviceState *dev; SysBusDevice *s; unsigned int i; dev = qdev_create(NULL, ""sun4c_intctl""); qdev_init(dev); s = sysbus_from_qdev(dev); for (i = 0; i < MAX_PILS; i++) { sysbus_connect_irq(s, i, parent_irq[i]); } sysbus_mmio_map(s, 0, addr); return dev; }","Yes, it is vulnerable."139137,"static int gif_image_write_header(AVFormatContext *s, int width, int height, int loop_count, uint32_t *palette) { AVIOContext *pb = s->pb; AVRational sar = s->streams[0]->codec->sample_aspect_ratio; int i, aspect = 0; if (sar.num > 0 && sar.den > 0) { aspect = sar.num * 64 / sar.den - 15; if (aspect < 0 || aspect > 255) aspect = 0; } avio_write(pb, ""GIF"", 3); avio_write(pb, ""89a"", 3); avio_wl16(pb, width); avio_wl16(pb, height); if (palette) { avio_w8(pb, 0xf7); /* flags: global clut, 256 entries */ avio_w8(pb, 0x1f); /* background color index */ avio_w8(pb, aspect); for (i = 0; i < 256; i++) { const uint32_t v = palette[i] & 0xffffff; avio_wb24(pb, v); } } else { avio_w8(pb, 0); /* flags */ avio_w8(pb, 0); /* background color index */ avio_w8(pb, aspect); } if (loop_count >= 0 ) { /* ""NETSCAPE EXTENSION"" for looped animation GIF */ avio_w8(pb, 0x21); /* GIF Extension code */ avio_w8(pb, 0xff); /* Application Extension Label */ avio_w8(pb, 0x0b); /* Length of Application Block */ avio_write(pb, ""NETSCAPE2.0"", sizeof(""NETSCAPE2.0"") - 1); avio_w8(pb, 0x03); /* Length of Data Sub-Block */ avio_w8(pb, 0x01); avio_wl16(pb, (uint16_t)loop_count); avio_w8(pb, 0x00); /* Data Sub-block Terminator */ } return 0; }","Yes, it is vulnerable."140138,"static int ipvideo_decode_block_opcode_0xA(IpvideoContext *s) { int x, y; unsigned char P[4]; int flags = 0; /* 4-color encoding for each 4x4 quadrant, or 4-color encoding on * either top and bottom or left and right halves */ CHECK_STREAM_PTR(24); if (s->stream_ptr[0] <= s->stream_ptr[1]) { /* 4-color encoding for each quadrant; need 32 bytes */ CHECK_STREAM_PTR(32); for (y = 0; y < 16; y++) { // new values for each 4x4 block if (!(y & 3)) { memcpy(P, s->stream_ptr, 4); s->stream_ptr += 4; flags = bytestream_get_le32(&s->stream_ptr); } for (x = 0; x < 4; x++, flags >>= 2) *s->pixel_ptr++ = P[flags & 0x03]; s->pixel_ptr += s->stride - 4; // switch to right half if (y == 7) s->pixel_ptr -= 8 * s->stride - 4; } } else { // vertical split? int vert = s->stream_ptr[12] <= s->stream_ptr[13]; uint64_t flags = 0; /* 4-color encoding for either left and right or top and bottom * halves */ for (y = 0; y < 16; y++) { // load values for each half if (!(y & 7)) { memcpy(P, s->stream_ptr, 4); s->stream_ptr += 4; flags = bytestream_get_le64(&s->stream_ptr); } for (x = 0; x < 4; x++, flags >>= 2) *s->pixel_ptr++ = P[flags & 0x03]; if (vert) { s->pixel_ptr += s->stride - 4; // switch to right half if (y == 7) s->pixel_ptr -= 8 * s->stride - 4; } else if (y & 1) s->pixel_ptr += s->line_inc; } } /* report success */ return 0; }","No, it is non-vulnerable."141139,"static inline void dv_decode_video_segment(DVVideoContext *s, const uint8_t *buf_ptr1, const uint16_t *mb_pos_ptr) { int quant, dc, dct_mode, class1, j; int mb_index, mb_x, mb_y, v, last_index; int y_stride, i; DCTELEM *block, *block1; int c_offset; uint8_t *y_ptr; const uint8_t *buf_ptr; PutBitContext pb, vs_pb; GetBitContext gb; BlockInfo mb_data[5 * DV_MAX_BPM], *mb, *mb1; DECLARE_ALIGNED_16(DCTELEM, sblock[5*DV_MAX_BPM][64]); DECLARE_ALIGNED_8(uint8_t, mb_bit_buffer[80 + 4]); /* allow some slack */ DECLARE_ALIGNED_8(uint8_t, vs_bit_buffer[5 * 80 + 4]); /* allow some slack */ const int log2_blocksize= 3-s->avctx->lowres; int is_field_mode[5]; assert((((int)mb_bit_buffer)&7)==0); assert((((int)vs_bit_buffer)&7)==0); memset(sblock, 0, sizeof(sblock)); /* pass 1 : read DC and AC coefficients in blocks */ buf_ptr = buf_ptr1; block1 = &sblock[0][0]; mb1 = mb_data; init_put_bits(&vs_pb, vs_bit_buffer, 5 * 80); for(mb_index = 0; mb_index < 5; mb_index++, mb1 += s->sys->bpm, block1 += s->sys->bpm * 64) { /* skip header */ quant = buf_ptr[3] & 0x0f; buf_ptr += 4; init_put_bits(&pb, mb_bit_buffer, 80); mb = mb1; block = block1; is_field_mode[mb_index] = 0; for(j = 0;j < s->sys->bpm; j++) { last_index = s->sys->block_sizes[j]; init_get_bits(&gb, buf_ptr, last_index); /* get the dc */ dc = get_sbits(&gb, 9); dct_mode = get_bits1(&gb); class1 = get_bits(&gb, 2); if (DV_PROFILE_IS_HD(s->sys)) { mb->idct_put = s->idct_put[0]; mb->scan_table = s->dv_zigzag[0]; mb->factor_table = s->dv100_idct_factor[((s->sys->height == 720)<<1)|(j >= 4)][class1][quant]; is_field_mode[mb_index] |= !j && dct_mode; } else { mb->idct_put = s->idct_put[dct_mode && log2_blocksize==3]; mb->scan_table = s->dv_zigzag[dct_mode]; mb->factor_table = s->dv_idct_factor[class1 == 3][dct_mode] [quant + dv_quant_offset[class1]]; } dc = dc << 2; /* convert to unsigned because 128 is not added in the standard IDCT */ dc += 1024; block[0] = dc; buf_ptr += last_index >> 3; mb->pos = 0; mb->partial_bit_count = 0; #ifdef VLC_DEBUG printf(""MB block: %d, %d "", mb_index, j); #endif dv_decode_ac(&gb, mb, block); /* write the remaining bits in a new buffer only if the block is finished */ if (mb->pos >= 64) bit_copy(&pb, &gb); block += 64; mb++; } /* pass 2 : we can do it just after */ #ifdef VLC_DEBUG printf(""***pass 2 size=%d MB#=%d\n"", put_bits_count(&pb), mb_index); #endif block = block1; mb = mb1; init_get_bits(&gb, mb_bit_buffer, put_bits_count(&pb)); flush_put_bits(&pb); for(j = 0;j < s->sys->bpm; j++, block += 64, mb++) { if (mb->pos < 64 && get_bits_left(&gb) > 0) { dv_decode_ac(&gb, mb, block); /* if still not finished, no need to parse other blocks */ if (mb->pos < 64) break; } } /* all blocks are finished, so the extra bytes can be used at the video segment level */ if (j >= s->sys->bpm) bit_copy(&vs_pb, &gb); } /* we need a pass other the whole video segment */ #ifdef VLC_DEBUG printf(""***pass 3 size=%d\n"", put_bits_count(&vs_pb)); #endif block = &sblock[0][0]; mb = mb_data; init_get_bits(&gb, vs_bit_buffer, put_bits_count(&vs_pb)); flush_put_bits(&vs_pb); for(mb_index = 0; mb_index < 5; mb_index++) { for(j = 0;j < s->sys->bpm; j++) { if (mb->pos < 64) { #ifdef VLC_DEBUG printf(""start %d:%d\n"", mb_index, j); #endif dv_decode_ac(&gb, mb, block); } if (mb->pos >= 64 && mb->pos < 127) av_log(NULL, AV_LOG_ERROR, ""AC EOB marker is absent pos=%d\n"", mb->pos); block += 64; mb++; } } /* compute idct and place blocks */ block = &sblock[0][0]; mb = mb_data; for(mb_index = 0; mb_index < 5; mb_index++) { v = *mb_pos_ptr++; mb_x = v & 0xff; mb_y = v >> 8; /* We work with 720p frames split in half. The odd half-frame (chan==2,3) is displaced :-( */ if (s->sys->height == 720 && !(s->buf[1]&0x0C)) { mb_y -= (mb_y>17)?18:-72; /* shifting the Y coordinate down by 72/2 macroblocks */ } /* idct_put'ting luminance */ if ((s->sys->pix_fmt == PIX_FMT_YUV420P) || (s->sys->pix_fmt == PIX_FMT_YUV411P && mb_x >= (704 / 8)) || (s->sys->height >= 720 && mb_y != 134)) { y_stride = (s->picture.linesize[0]<<((!is_field_mode[mb_index])*log2_blocksize)) - (2<<log2_blocksize); } else { y_stride = 0; } y_ptr = s->picture.data[0] + ((mb_y * s->picture.linesize[0] + mb_x)<<log2_blocksize); for(j = 0; j < 2; j++, y_ptr += y_stride) { for (i=0; i<2; i++, block += 64, mb++, y_ptr += (1<<log2_blocksize)) if (s->sys->pix_fmt == PIX_FMT_YUV422P && s->sys->width == 720 && i) y_ptr -= (1<<log2_blocksize); else mb->idct_put(y_ptr, s->picture.linesize[0]<<is_field_mode[mb_index], block); } /* idct_put'ting chrominance */ c_offset = (((mb_y>>(s->sys->pix_fmt == PIX_FMT_YUV420P)) * s->picture.linesize[1] + (mb_x>>((s->sys->pix_fmt == PIX_FMT_YUV411P)?2:1)))<<log2_blocksize); for(j=2; j; j--) { uint8_t *c_ptr = s->picture.data[j] + c_offset; if (s->sys->pix_fmt == PIX_FMT_YUV411P && mb_x >= (704 / 8)) { uint64_t aligned_pixels[64/8]; uint8_t *pixels = (uint8_t*)aligned_pixels; uint8_t *c_ptr1, *ptr1; int x, y; mb->idct_put(pixels, 8, block); for(y = 0; y < (1<<log2_blocksize); y++, c_ptr += s->picture.linesize[j], pixels += 8) { ptr1= pixels + (1<<(log2_blocksize-1)); c_ptr1 = c_ptr + (s->picture.linesize[j]<<log2_blocksize); for(x=0; x < (1<<(log2_blocksize-1)); x++) { c_ptr[x]= pixels[x]; c_ptr1[x]= ptr1[x]; } } block += 64; mb++; } else { y_stride = (mb_y == 134) ? (1<<log2_blocksize) : s->picture.linesize[j]<<((!is_field_mode[mb_index])*log2_blocksize); for (i=0; i<(1<<(s->sys->bpm==8)); i++, block += 64, mb++, c_ptr += y_stride) mb->idct_put(c_ptr, s->picture.linesize[j]<<is_field_mode[mb_index], block); } } } }","No, it is non-vulnerable."142140,static bool adding_first_cpu(void) { CPUState *cpu; size_t count = 0; CPU_FOREACH(cpu) { count++; if (count > 1) { return false; } } return true; },"Yes, it is vulnerable."143141,"static void imc_get_coeffs(AVCodecContext *avctx, IMCContext *q, IMCChannel *chctx) { int i, j, cw_len, cw; for (i = 0; i < BANDS; i++) { if (!chctx->sumLenArr[i]) continue; if (chctx->bandFlagsBuf[i] || chctx->bandWidthT[i]) { for (j = band_tab[i]; j < band_tab[i + 1]; j++) { cw_len = chctx->CWlengthT[j]; cw = 0; if (cw_len && (!chctx->bandFlagsBuf[i] || !chctx->skipFlags[j])) { if (get_bits_count(&q->gb) + cw_len > 512) { av_log(avctx, AV_LOG_WARNING, ""Potential problem on band %i, coefficient %i"" "": cw_len=%i\n"", i, j, cw_len); } cw = get_bits(&q->gb, cw_len); } chctx->codewords[j] = cw; } } } }","Yes, it is vulnerable."144142,"static int aio_write_f(int argc, char **argv) { int nr_iov, c; int pattern = 0xcd; struct aio_ctx *ctx = calloc(1, sizeof(struct aio_ctx)); BlockDriverAIOCB *acb; while ((c = getopt(argc, argv, ""CqP:"")) != EOF) { switch (c) { case 'C': ctx->Cflag = 1; break; case 'q': ctx->qflag = 1; break; case 'P': pattern = parse_pattern(optarg); if (pattern < 0) { return 0; } break; default: return command_usage(&aio_write_cmd); } } if (optind > argc - 2) { return command_usage(&aio_write_cmd); } ctx->offset = cvtnum(argv[optind]); if (ctx->offset < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } optind++; if (ctx->offset & 0x1ff) { printf(""offset %"" PRId64 "" is not sector aligned\n"", ctx->offset); return 0; } nr_iov = argc - optind; ctx->buf = create_iovec(&ctx->qiov, &argv[optind], nr_iov, pattern); gettimeofday(&ctx->t1, NULL); acb = bdrv_aio_writev(bs, ctx->offset >> 9, &ctx->qiov, ctx->qiov.size >> 9, aio_write_done, ctx); if (!acb) { free(ctx->buf); return -EIO; } return 0; }","Yes, it is vulnerable."145143,"static coroutine_fn int quorum_co_flush(BlockDriverState *bs) { BDRVQuorumState *s = bs->opaque; QuorumVoteVersion *winner = NULL; QuorumVotes error_votes; QuorumVoteValue result_value; int i; int result = 0; QLIST_INIT(&error_votes.vote_list); error_votes.compare = quorum_64bits_compare; for (i = 0; i < s->num_children; i++) { result = bdrv_co_flush(s->children[i]->bs); result_value.l = result; quorum_count_vote(&error_votes, &result_value, i); } winner = quorum_get_vote_winner(&error_votes); result = winner->value.l; quorum_free_vote_list(&error_votes); return result; }","Yes, it is vulnerable."146144,"static void tcg_out_qemu_st(TCGContext *s, TCGReg data, TCGReg addr, TCGMemOpIdx oi) { TCGMemOp memop = get_memop(oi); #ifdef CONFIG_SOFTMMU unsigned memi = get_mmuidx(oi); TCGReg addrz, param; tcg_insn_unit *func; tcg_insn_unit *label_ptr; addrz = tcg_out_tlb_load(s, addr, memi, memop & MO_SIZE, offsetof(CPUTLBEntry, addr_write)); /* The fast path is exactly one insn. Thus we can perform the entire TLB Hit in the (annulled) delay slot of the branch over TLB Miss. */ /* beq,a,pt %[xi]cc, label0 */ label_ptr = s->code_ptr; tcg_out_bpcc0(s, COND_E, BPCC_A | BPCC_PT | (TARGET_LONG_BITS == 64 ? BPCC_XCC : BPCC_ICC), 0); /* delay slot */ tcg_out_ldst_rr(s, data, addrz, TCG_REG_O1, qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]); /* TLB Miss. */ param = TCG_REG_O1; if (!SPARC64 && TARGET_LONG_BITS == 64) { /* Skip the high-part; we'll perform the extract in the trampoline. */ param++; } tcg_out_mov(s, TCG_TYPE_REG, param++, addr); if (!SPARC64 && (memop & MO_SIZE) == MO_64) { /* Skip the high-part; we'll perform the extract in the trampoline. */ param++; } tcg_out_mov(s, TCG_TYPE_REG, param++, data); func = qemu_st_trampoline[memop & (MO_BSWAP | MO_SIZE)]; assert(func != NULL); tcg_out_call_nodelay(s, func); /* delay slot */ tcg_out_movi(s, TCG_TYPE_I32, param, oi); *label_ptr |= INSN_OFF19(tcg_ptr_byte_diff(s->code_ptr, label_ptr)); #else if (SPARC64 && TARGET_LONG_BITS == 32) { tcg_out_arithi(s, TCG_REG_T1, addr, 0, SHIFT_SRL); addr = TCG_REG_T1; } tcg_out_ldst_rr(s, data, addr, (guest_base ? TCG_GUEST_BASE_REG : TCG_REG_G0), qemu_st_opc[memop & (MO_BSWAP | MO_SIZE)]); #endif /* CONFIG_SOFTMMU */ }","No, it is non-vulnerable."147145,"void r4k_helper_tlbr(CPUMIPSState *env) { r4k_tlb_t *tlb; uint8_t ASID; int idx; ASID = env->CP0_EntryHi & 0xFF; idx = (env->CP0_Index & ~0x80000000) % env->tlb->nb_tlb; tlb = &env->tlb->mmu.r4k.tlb[idx]; /* If this will change the current ASID, flush qemu's TLB. */ if (ASID != tlb->ASID) cpu_mips_tlb_flush (env, 1); r4k_mips_tlb_flush_extra(env, env->tlb->nb_tlb); env->CP0_EntryHi = tlb->VPN | tlb->ASID; env->CP0_PageMask = tlb->PageMask; env->CP0_EntryLo0 = tlb->G | (tlb->V0 << 1) | (tlb->D0 << 2) | ((target_ulong)tlb->RI0 << CP0EnLo_RI) | ((target_ulong)tlb->XI0 << CP0EnLo_XI) | (tlb->C0 << 3) | (tlb->PFN[0] >> 6); env->CP0_EntryLo1 = tlb->G | (tlb->V1 << 1) | (tlb->D1 << 2) | ((target_ulong)tlb->RI1 << CP0EnLo_RI) | ((target_ulong)tlb->XI1 << CP0EnLo_XI) | (tlb->C1 << 3) | (tlb->PFN[1] >> 6); }","No, it is non-vulnerable."148146,"static int unpack_dct_coeffs(Vp3DecodeContext *s, GetBitContext *gb) { int i; int dc_y_table; int dc_c_table; int ac_y_table; int ac_c_table; int residual_eob_run = 0; /* fetch the DC table indexes */ dc_y_table = get_bits(gb, 4); dc_c_table = get_bits(gb, 4); /* unpack the Y plane DC coefficients */ residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_y_table], 0, 1, residual_eob_run); /* reverse prediction of the Y-plane DC coefficients */ reverse_dc_prediction(s, 0, s->fragment_width, s->fragment_height); /* unpack the C plane DC coefficients */ residual_eob_run = unpack_vlcs(s, gb, &s->dc_vlc[dc_c_table], 0, 0, residual_eob_run); /* reverse prediction of the C-plane DC coefficients */ if (!(s->avctx->flags & CODEC_FLAG_GRAY)) { reverse_dc_prediction(s, s->fragment_start[1], s->fragment_width / 2, s->fragment_height / 2); reverse_dc_prediction(s, s->fragment_start[2], s->fragment_width / 2, s->fragment_height / 2); } /* fetch the AC table indexes */ ac_y_table = get_bits(gb, 4); ac_c_table = get_bits(gb, 4); /* unpack the group 1 AC coefficients (coeffs 1-5) */ for (i = 1; i <= 5; i++) { residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_1[ac_y_table], i, 1, residual_eob_run); residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_1[ac_c_table], i, 0, residual_eob_run); } /* unpack the group 2 AC coefficients (coeffs 6-14) */ for (i = 6; i <= 14; i++) { residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_2[ac_y_table], i, 1, residual_eob_run); residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_2[ac_c_table], i, 0, residual_eob_run); } /* unpack the group 3 AC coefficients (coeffs 15-27) */ for (i = 15; i <= 27; i++) { residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_3[ac_y_table], i, 1, residual_eob_run); residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_3[ac_c_table], i, 0, residual_eob_run); } /* unpack the group 4 AC coefficients (coeffs 28-63) */ for (i = 28; i <= 63; i++) { residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_4[ac_y_table], i, 1, residual_eob_run); residual_eob_run = unpack_vlcs(s, gb, &s->ac_vlc_4[ac_c_table], i, 0, residual_eob_run); } return 0; }","No, it is non-vulnerable."149147,int kvmppc_fixup_cpu(PowerPCCPU *cpu) { CPUState *cs = CPU(cpu); int smt; /* Adjust cpu index for SMT */ smt = kvmppc_smt_threads(); cs->cpu_index = (cs->cpu_index / smp_threads) * smt + (cs->cpu_index % smp_threads); return 0; },"No, it is non-vulnerable."150148,"static void *spapr_create_fdt_skel(const char *cpu_model, hwaddr initrd_base, hwaddr initrd_size, hwaddr kernel_size, const char *boot_device, const char *kernel_cmdline, uint32_t epow_irq) { void *fdt; CPUPPCState *env; uint32_t start_prop = cpu_to_be32(initrd_base); uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size); char hypertas_prop[] = ""hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt"" ""\0hcall-tce\0hcall-vio\0hcall-splpar\0hcall-bulk""; char qemu_hypertas_prop[] = ""hcall-memop1""; uint32_t refpoints[] = {cpu_to_be32(0x4), cpu_to_be32(0x4)}; uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)}; char *modelname; int i, smt = kvmppc_smt_threads(); unsigned char vec5[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x80}; fdt = g_malloc0(FDT_MAX_SIZE); _FDT((fdt_create(fdt, FDT_MAX_SIZE))); if (kernel_size) { _FDT((fdt_add_reservemap_entry(fdt, KERNEL_LOAD_ADDR, kernel_size))); } if (initrd_size) { _FDT((fdt_add_reservemap_entry(fdt, initrd_base, initrd_size))); } _FDT((fdt_finish_reservemap(fdt))); /* Root node */ _FDT((fdt_begin_node(fdt, """"))); _FDT((fdt_property_string(fdt, ""device_type"", ""chrp""))); _FDT((fdt_property_string(fdt, ""model"", ""IBM pSeries (emulated by qemu)""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x2))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x2))); /* /chosen */ _FDT((fdt_begin_node(fdt, ""chosen""))); /* Set Form1_affinity */ _FDT((fdt_property(fdt, ""ibm,architecture-vec-5"", vec5, sizeof(vec5)))); _FDT((fdt_property_string(fdt, ""bootargs"", kernel_cmdline))); _FDT((fdt_property(fdt, ""linux,initrd-start"", &start_prop, sizeof(start_prop)))); _FDT((fdt_property(fdt, ""linux,initrd-end"", &end_prop, sizeof(end_prop)))); if (kernel_size) { uint64_t kprop[2] = { cpu_to_be64(KERNEL_LOAD_ADDR), cpu_to_be64(kernel_size) }; _FDT((fdt_property(fdt, ""qemu,boot-kernel"", &kprop, sizeof(kprop)))); } _FDT((fdt_property_string(fdt, ""qemu,boot-device"", boot_device))); _FDT((fdt_property_cell(fdt, ""qemu,graphic-width"", graphic_width))); _FDT((fdt_property_cell(fdt, ""qemu,graphic-height"", graphic_height))); _FDT((fdt_property_cell(fdt, ""qemu,graphic-depth"", graphic_depth))); _FDT((fdt_end_node(fdt))); /* cpus */ _FDT((fdt_begin_node(fdt, ""cpus""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x1))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x0))); modelname = g_strdup(cpu_model); for (i = 0; i < strlen(modelname); i++) { modelname[i] = toupper(modelname[i]); } /* This is needed during FDT finalization */ spapr->cpu_model = g_strdup(modelname); for (env = first_cpu; env != NULL; env = env->next_cpu) { CPUState *cpu = CPU(ppc_env_get_cpu(env)); int index = cpu->cpu_index; uint32_t servers_prop[smp_threads]; uint32_t gservers_prop[smp_threads * 2]; char *nodename; uint32_t segs[] = {cpu_to_be32(28), cpu_to_be32(40), 0xffffffff, 0xffffffff}; uint32_t tbfreq = kvm_enabled() ? kvmppc_get_tbfreq() : TIMEBASE_FREQ; uint32_t cpufreq = kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000; uint32_t page_sizes_prop[64]; size_t page_sizes_prop_size; if ((index % smt) != 0) { continue; } if (asprintf(&nodename, ""%s@%x"", modelname, index) < 0) { fprintf(stderr, ""Allocation failure\n""); exit(1); } _FDT((fdt_begin_node(fdt, nodename))); free(nodename); _FDT((fdt_property_cell(fdt, ""reg"", index))); _FDT((fdt_property_string(fdt, ""device_type"", ""cpu""))); _FDT((fdt_property_cell(fdt, ""cpu-version"", env->spr[SPR_PVR]))); _FDT((fdt_property_cell(fdt, ""dcache-block-size"", env->dcache_line_size))); _FDT((fdt_property_cell(fdt, ""icache-block-size"", env->icache_line_size))); _FDT((fdt_property_cell(fdt, ""timebase-frequency"", tbfreq))); _FDT((fdt_property_cell(fdt, ""clock-frequency"", cpufreq))); _FDT((fdt_property_cell(fdt, ""ibm,slb-size"", env->slb_nr))); _FDT((fdt_property_string(fdt, ""status"", ""okay""))); _FDT((fdt_property(fdt, ""64-bit"", NULL, 0))); /* Build interrupt servers and gservers properties */ for (i = 0; i < smp_threads; i++) { servers_prop[i] = cpu_to_be32(index + i); /* Hack, direct the group queues back to cpu 0 */ gservers_prop[i*2] = cpu_to_be32(index + i); gservers_prop[i*2 + 1] = 0; } _FDT((fdt_property(fdt, ""ibm,ppc-interrupt-server#s"", servers_prop, sizeof(servers_prop)))); _FDT((fdt_property(fdt, ""ibm,ppc-interrupt-gserver#s"", gservers_prop, sizeof(gservers_prop)))); if (env->mmu_model & POWERPC_MMU_1TSEG) { _FDT((fdt_property(fdt, ""ibm,processor-segment-sizes"", segs, sizeof(segs)))); } /* Advertise VMX/VSX (vector extensions) if available * 0 / no property == no vector extensions * 1 == VMX / Altivec available * 2 == VSX available */ if (env->insns_flags & PPC_ALTIVEC) { uint32_t vmx = (env->insns_flags2 & PPC2_VSX) ? 2 : 1; _FDT((fdt_property_cell(fdt, ""ibm,vmx"", vmx))); } /* Advertise DFP (Decimal Floating Point) if available * 0 / no property == no DFP * 1 == DFP available */ if (env->insns_flags2 & PPC2_DFP) { _FDT((fdt_property_cell(fdt, ""ibm,dfp"", 1))); } page_sizes_prop_size = create_page_sizes_prop(env, page_sizes_prop, sizeof(page_sizes_prop)); if (page_sizes_prop_size) { _FDT((fdt_property(fdt, ""ibm,segment-page-sizes"", page_sizes_prop, page_sizes_prop_size))); } _FDT((fdt_end_node(fdt))); } g_free(modelname); _FDT((fdt_end_node(fdt))); /* RTAS */ _FDT((fdt_begin_node(fdt, ""rtas""))); _FDT((fdt_property(fdt, ""ibm,hypertas-functions"", hypertas_prop, sizeof(hypertas_prop)))); _FDT((fdt_property(fdt, ""qemu,hypertas-functions"", qemu_hypertas_prop, sizeof(qemu_hypertas_prop)))); _FDT((fdt_property(fdt, ""ibm,associativity-reference-points"", refpoints, sizeof(refpoints)))); _FDT((fdt_property_cell(fdt, ""rtas-error-log-max"", RTAS_ERROR_LOG_MAX))); _FDT((fdt_end_node(fdt))); /* interrupt controller */ _FDT((fdt_begin_node(fdt, ""interrupt-controller""))); _FDT((fdt_property_string(fdt, ""device_type"", ""PowerPC-External-Interrupt-Presentation""))); _FDT((fdt_property_string(fdt, ""compatible"", ""IBM,ppc-xicp""))); _FDT((fdt_property(fdt, ""interrupt-controller"", NULL, 0))); _FDT((fdt_property(fdt, ""ibm,interrupt-server-ranges"", interrupt_server_ranges_prop, sizeof(interrupt_server_ranges_prop)))); _FDT((fdt_property_cell(fdt, ""#interrupt-cells"", 2))); _FDT((fdt_property_cell(fdt, ""linux,phandle"", PHANDLE_XICP))); _FDT((fdt_property_cell(fdt, ""phandle"", PHANDLE_XICP))); _FDT((fdt_end_node(fdt))); /* vdevice */ _FDT((fdt_begin_node(fdt, ""vdevice""))); _FDT((fdt_property_string(fdt, ""device_type"", ""vdevice""))); _FDT((fdt_property_string(fdt, ""compatible"", ""IBM,vdevice""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x1))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x0))); _FDT((fdt_property_cell(fdt, ""#interrupt-cells"", 0x2))); _FDT((fdt_property(fdt, ""interrupt-controller"", NULL, 0))); _FDT((fdt_end_node(fdt))); /* event-sources */ spapr_events_fdt_skel(fdt, epow_irq); _FDT((fdt_end_node(fdt))); /* close root node */ _FDT((fdt_finish(fdt))); return fdt; }","Yes, it is vulnerable."151149,"static int create_header64(DumpState *s) { int ret = 0; DiskDumpHeader64 *dh = NULL; KdumpSubHeader64 *kh = NULL; size_t size; int endian = s->dump_info.d_endian; uint32_t block_size; uint32_t sub_hdr_size; uint32_t bitmap_blocks; uint32_t status = 0; uint64_t offset_note; /* write common header, the version of kdump-compressed format is 6th */ size = sizeof(DiskDumpHeader64); dh = g_malloc0(size); strncpy(dh->signature, KDUMP_SIGNATURE, strlen(KDUMP_SIGNATURE)); dh->header_version = cpu_convert_to_target32(6, endian); block_size = s->page_size; dh->block_size = cpu_convert_to_target32(block_size, endian); sub_hdr_size = sizeof(struct KdumpSubHeader64) + s->note_size; sub_hdr_size = DIV_ROUND_UP(sub_hdr_size, block_size); dh->sub_hdr_size = cpu_convert_to_target32(sub_hdr_size, endian); /* dh->max_mapnr may be truncated, full 64bit is in kh.max_mapnr_64 */ dh->max_mapnr = cpu_convert_to_target32(MIN(s->max_mapnr, UINT_MAX), endian); dh->nr_cpus = cpu_convert_to_target32(s->nr_cpus, endian); bitmap_blocks = DIV_ROUND_UP(s->len_dump_bitmap, block_size) * 2; dh->bitmap_blocks = cpu_convert_to_target32(bitmap_blocks, endian); strncpy(dh->utsname.machine, ELF_MACHINE_UNAME, sizeof(dh->utsname.machine)); if (s->flag_compress & DUMP_DH_COMPRESSED_ZLIB) { status |= DUMP_DH_COMPRESSED_ZLIB; } #ifdef CONFIG_LZO if (s->flag_compress & DUMP_DH_COMPRESSED_LZO) { status |= DUMP_DH_COMPRESSED_LZO; } #endif #ifdef CONFIG_SNAPPY if (s->flag_compress & DUMP_DH_COMPRESSED_SNAPPY) { status |= DUMP_DH_COMPRESSED_SNAPPY; } #endif dh->status = cpu_convert_to_target32(status, endian); if (write_buffer(s->fd, 0, dh, size) < 0) { dump_error(s, ""dump: failed to write disk dump header.\n""); ret = -1; goto out; } /* write sub header */ size = sizeof(KdumpSubHeader64); kh = g_malloc0(size); /* 64bit max_mapnr_64 */ kh->max_mapnr_64 = cpu_convert_to_target64(s->max_mapnr, endian); kh->phys_base = cpu_convert_to_target64(PHYS_BASE, endian); kh->dump_level = cpu_convert_to_target32(DUMP_LEVEL, endian); offset_note = DISKDUMP_HEADER_BLOCKS * block_size + size; kh->offset_note = cpu_convert_to_target64(offset_note, endian); kh->note_size = cpu_convert_to_target64(s->note_size, endian); if (write_buffer(s->fd, DISKDUMP_HEADER_BLOCKS * block_size, kh, size) < 0) { dump_error(s, ""dump: failed to write kdump sub header.\n""); ret = -1; goto out; } /* write note */ s->note_buf = g_malloc0(s->note_size); s->note_buf_offset = 0; /* use s->note_buf to store notes temporarily */ if (write_elf64_notes(buf_write_note, s) < 0) { ret = -1; goto out; } if (write_buffer(s->fd, offset_note, s->note_buf, s->note_size) < 0) { dump_error(s, ""dump: failed to write notes""); ret = -1; goto out; } /* get offset of dump_bitmap */ s->offset_dump_bitmap = (DISKDUMP_HEADER_BLOCKS + sub_hdr_size) * block_size; /* get offset of page */ s->offset_page = (DISKDUMP_HEADER_BLOCKS + sub_hdr_size + bitmap_blocks) * block_size; out: g_free(dh); g_free(kh); g_free(s->note_buf); return ret; }","No, it is non-vulnerable."152150,"unsigned int SingleCPDO(const unsigned int opcode) { FPA11 *fpa11 = GET_FPA11(); float32 rFm, rFn = 0; unsigned int Fd, Fm, Fn, nRc = 1; Fm = getFm(opcode); if (CONSTANT_FM(opcode)) { rFm = getSingleConstant(Fm); } else { switch (fpa11->fType[Fm]) { case typeSingle: rFm = fpa11->fpreg[Fm].fSingle; break; default: return 0; } } if (!MONADIC_INSTRUCTION(opcode)) { Fn = getFn(opcode); switch (fpa11->fType[Fn]) { case typeSingle: rFn = fpa11->fpreg[Fn].fSingle; break; default: return 0; } } Fd = getFd(opcode); switch (opcode & MASK_ARITHMETIC_OPCODE) { /* dyadic opcodes */ case ADF_CODE: fpa11->fpreg[Fd].fSingle = float32_add(rFn,rFm, &fpa11->fp_status); break; case MUF_CODE: case FML_CODE: fpa11->fpreg[Fd].fSingle = float32_mul(rFn,rFm, &fpa11->fp_status); break; case SUF_CODE: fpa11->fpreg[Fd].fSingle = float32_sub(rFn,rFm, &fpa11->fp_status); break; case RSF_CODE: fpa11->fpreg[Fd].fSingle = float32_sub(rFm,rFn, &fpa11->fp_status); break; case DVF_CODE: case FDV_CODE: fpa11->fpreg[Fd].fSingle = float32_div(rFn,rFm, &fpa11->fp_status); break; case RDF_CODE: case FRD_CODE: fpa11->fpreg[Fd].fSingle = float32_div(rFm,rFn, &fpa11->fp_status); break; #if 0 case POW_CODE: fpa11->fpreg[Fd].fSingle = float32_pow(rFn,rFm); break; case RPW_CODE: fpa11->fpreg[Fd].fSingle = float32_pow(rFm,rFn); break; #endif case RMF_CODE: fpa11->fpreg[Fd].fSingle = float32_rem(rFn,rFm, &fpa11->fp_status); break; #if 0 case POL_CODE: fpa11->fpreg[Fd].fSingle = float32_pol(rFn,rFm); break; #endif /* monadic opcodes */ case MVF_CODE: fpa11->fpreg[Fd].fSingle = rFm; break; case MNF_CODE: rFm ^= 0x80000000; fpa11->fpreg[Fd].fSingle = rFm; break; case ABS_CODE: rFm &= 0x7fffffff; fpa11->fpreg[Fd].fSingle = rFm; break; case RND_CODE: case URD_CODE: fpa11->fpreg[Fd].fSingle = float32_round_to_int(rFm, &fpa11->fp_status); break; case SQT_CODE: fpa11->fpreg[Fd].fSingle = float32_sqrt(rFm, &fpa11->fp_status); break; #if 0 case LOG_CODE: fpa11->fpreg[Fd].fSingle = float32_log(rFm); break; case LGN_CODE: fpa11->fpreg[Fd].fSingle = float32_ln(rFm); break; case EXP_CODE: fpa11->fpreg[Fd].fSingle = float32_exp(rFm); break; case SIN_CODE: fpa11->fpreg[Fd].fSingle = float32_sin(rFm); break; case COS_CODE: fpa11->fpreg[Fd].fSingle = float32_cos(rFm); break; case TAN_CODE: fpa11->fpreg[Fd].fSingle = float32_tan(rFm); break; case ASN_CODE: fpa11->fpreg[Fd].fSingle = float32_arcsin(rFm); break; case ACS_CODE: fpa11->fpreg[Fd].fSingle = float32_arccos(rFm); break; case ATN_CODE: fpa11->fpreg[Fd].fSingle = float32_arctan(rFm); break; #endif case NRM_CODE: break; default: { nRc = 0; } } if (0 != nRc) fpa11->fType[Fd] = typeSingle; return nRc; }","No, it is non-vulnerable."153151,"static void mirror_start_job(BlockDriverState *bs, BlockDriverState *target, const char *replaces, int64_t speed, uint32_t granularity, int64_t buf_size, BlockdevOnError on_source_error, BlockdevOnError on_target_error, BlockCompletionFunc *cb, void *opaque, Error **errp, const BlockJobDriver *driver, bool is_none_mode, BlockDriverState *base) { MirrorBlockJob *s; if (granularity == 0) { /* Choose the default granularity based on the target file's cluster * size, clamped between 4k and 64k. */ BlockDriverInfo bdi; if (bdrv_get_info(target, &bdi) >= 0 && bdi.cluster_size != 0) { granularity = MAX(4096, bdi.cluster_size); granularity = MIN(65536, granularity); } else { granularity = 65536; } } assert ((granularity & (granularity - 1)) == 0); if ((on_source_error == BLOCKDEV_ON_ERROR_STOP || on_source_error == BLOCKDEV_ON_ERROR_ENOSPC) && !bdrv_iostatus_is_enabled(bs)) { error_set(errp, QERR_INVALID_PARAMETER, ""on-source-error""); return; } s = block_job_create(driver, bs, speed, cb, opaque, errp); if (!s) { return; } s->replaces = g_strdup(replaces); s->on_source_error = on_source_error; s->on_target_error = on_target_error; s->target = target; s->is_none_mode = is_none_mode; s->base = base; s->granularity = granularity; s->buf_size = MAX(buf_size, granularity); s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, NULL, errp); if (!s->dirty_bitmap) { return; } bdrv_set_enable_write_cache(s->target, true); bdrv_set_on_error(s->target, on_target_error, on_target_error); bdrv_iostatus_enable(s->target); s->common.co = qemu_coroutine_create(mirror_run); trace_mirror_start(bs, s, s->common.co, opaque); qemu_coroutine_enter(s->common.co, s); }","No, it is non-vulnerable."154152,"static int ac3_decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; AC3DecodeContext *s = avctx->priv_data; int16_t *out_samples = (int16_t *)data; int blk, ch, err; const uint8_t *channel_map; const float *output[AC3_MAX_CHANNELS]; /* initialize the GetBitContext with the start of valid AC-3 Frame */ if (s->input_buffer) { /* copy input buffer to decoder context to avoid reading past the end of the buffer, which can be caused by a damaged input stream. */ memcpy(s->input_buffer, buf, FFMIN(buf_size, AC3_FRAME_BUFFER_SIZE)); init_get_bits(&s->gbc, s->input_buffer, buf_size * 8); } else { init_get_bits(&s->gbc, buf, buf_size * 8); } /* parse the syncinfo */ *data_size = 0; err = parse_frame_header(s); if (err) { switch(err) { case AAC_AC3_PARSE_ERROR_SYNC: av_log(avctx, AV_LOG_ERROR, ""frame sync error\n""); return -1; case AAC_AC3_PARSE_ERROR_BSID: av_log(avctx, AV_LOG_ERROR, ""invalid bitstream id\n""); break; case AAC_AC3_PARSE_ERROR_SAMPLE_RATE: av_log(avctx, AV_LOG_ERROR, ""invalid sample rate\n""); break; case AAC_AC3_PARSE_ERROR_FRAME_SIZE: av_log(avctx, AV_LOG_ERROR, ""invalid frame size\n""); break; case AAC_AC3_PARSE_ERROR_FRAME_TYPE: /* skip frame if CRC is ok. otherwise use error concealment. */ /* TODO: add support for substreams and dependent frames */ if(s->frame_type == EAC3_FRAME_TYPE_DEPENDENT || s->substreamid) { av_log(avctx, AV_LOG_ERROR, ""unsupported frame type : skipping frame\n""); return s->frame_size; } else { av_log(avctx, AV_LOG_ERROR, ""invalid frame type\n""); } break; default: av_log(avctx, AV_LOG_ERROR, ""invalid header\n""); break; } } else { /* check that reported frame size fits in input buffer */ if (s->frame_size > buf_size) { av_log(avctx, AV_LOG_ERROR, ""incomplete frame\n""); err = AAC_AC3_PARSE_ERROR_FRAME_SIZE; } else if (avctx->error_recognition >= FF_ER_CAREFUL) { /* check for crc mismatch */ if (av_crc(av_crc_get_table(AV_CRC_16_ANSI), 0, &buf[2], s->frame_size-2)) { av_log(avctx, AV_LOG_ERROR, ""frame CRC mismatch\n""); err = AAC_AC3_PARSE_ERROR_CRC; } } } /* if frame is ok, set audio parameters */ if (!err) { avctx->sample_rate = s->sample_rate; avctx->bit_rate = s->bit_rate; /* channel config */ s->out_channels = s->channels; s->output_mode = s->channel_mode; if(s->lfe_on) s->output_mode |= AC3_OUTPUT_LFEON; if (avctx->request_channels > 0 && avctx->request_channels <= 2 && avctx->request_channels < s->channels) { s->out_channels = avctx->request_channels; s->output_mode = avctx->request_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO; s->channel_layout = ff_ac3_channel_layout_tab[s->output_mode]; } avctx->channels = s->out_channels; avctx->channel_layout = s->channel_layout; /* set downmixing coefficients if needed */ if(s->channels != s->out_channels && !((s->output_mode & AC3_OUTPUT_LFEON) && s->fbw_channels == s->out_channels)) { set_downmix_coeffs(s); } } else if (!s->out_channels) { s->out_channels = avctx->channels; if(s->out_channels < s->channels) s->output_mode = s->out_channels == 1 ? AC3_CHMODE_MONO : AC3_CHMODE_STEREO; } /* decode the audio blocks */ channel_map = ff_ac3_dec_channel_map[s->output_mode & ~AC3_OUTPUT_LFEON][s->lfe_on]; for (ch = 0; ch < s->out_channels; ch++) output[ch] = s->output[channel_map[ch]]; for (blk = 0; blk < s->num_blocks; blk++) { if (!err && decode_audio_block(s, blk)) { av_log(avctx, AV_LOG_ERROR, ""error decoding the audio block\n""); err = 1; } s->fmt_conv.float_to_int16_interleave(out_samples, output, 256, s->out_channels); out_samples += 256 * s->out_channels; } *data_size = s->num_blocks * 256 * avctx->channels * sizeof (int16_t); return FFMIN(buf_size, s->frame_size); }","Yes, it is vulnerable."155153,"static void v9fs_flush(void *opaque) { int16_t tag; size_t offset = 7; V9fsPDU *cancel_pdu; V9fsPDU *pdu = opaque; V9fsState *s = pdu->s; pdu_unmarshal(pdu, offset, ""w"", &tag); QLIST_FOREACH(cancel_pdu, &s->active_list, next) { if (cancel_pdu->tag == tag) { break; } } if (cancel_pdu) { cancel_pdu->cancelled = 1; /* * Wait for pdu to complete. */ qemu_co_queue_wait(&cancel_pdu->complete); cancel_pdu->cancelled = 0; free_pdu(pdu->s, cancel_pdu); } complete_pdu(s, pdu, 7); return; }","Yes, it is vulnerable."156154,"void qemu_savevm_send_postcopy_advise(QEMUFile *f) { uint64_t tmp[2]; tmp[0] = cpu_to_be64(getpagesize()); tmp[1] = cpu_to_be64(1ul << qemu_target_page_bits()); trace_qemu_savevm_send_postcopy_advise(); qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp); }","Yes, it is vulnerable."157155,"static void add_qemu_cpu_model_features(S390FeatBitmap fbm) { static const int feats[] = { S390_FEAT_DAT_ENH, S390_FEAT_IDTE_SEGMENT, S390_FEAT_STFLE, S390_FEAT_SENSE_RUNNING_STATUS, S390_FEAT_EXTENDED_IMMEDIATE, S390_FEAT_EXTENDED_TRANSLATION_2, S390_FEAT_MSA, S390_FEAT_EXTENDED_TRANSLATION_3, S390_FEAT_LONG_DISPLACEMENT, S390_FEAT_LONG_DISPLACEMENT_FAST, S390_FEAT_ETF2_ENH, S390_FEAT_STORE_CLOCK_FAST, S390_FEAT_MOVE_WITH_OPTIONAL_SPEC, S390_FEAT_ETF3_ENH, S390_FEAT_COMPARE_AND_SWAP_AND_STORE, S390_FEAT_COMPARE_AND_SWAP_AND_STORE_2, S390_FEAT_GENERAL_INSTRUCTIONS_EXT, S390_FEAT_EXECUTE_EXT, S390_FEAT_FLOATING_POINT_SUPPPORT_ENH, S390_FEAT_STFLE_45, S390_FEAT_STFLE_49, S390_FEAT_LOCAL_TLB_CLEARING, S390_FEAT_INTERLOCKED_ACCESS_2, S390_FEAT_STFLE_53, S390_FEAT_MSA_EXT_5, S390_FEAT_MSA_EXT_3, S390_FEAT_MSA_EXT_4, }; int i; for (i = 0; i < ARRAY_SIZE(feats); i++) { set_bit(feats[i], fbm); } }","Yes, it is vulnerable."158156,"static target_long monitor_get_decr (const struct MonitorDef *md, int val) { CPUState *env = mon_get_cpu(); if (!env) return 0; return cpu_ppc_load_decr(env); }","Yes, it is vulnerable."159157,START_TEST(qobject_to_qlist_test) { QList *qlist; qlist = qlist_new(); fail_unless(qobject_to_qlist(QOBJECT(qlist)) == qlist); // destroy doesn't exist yet g_free(qlist); },"No, it is non-vulnerable."160158,"CharDriverState *qemu_chr_find(const char *name) { CharDriverState *chr; TAILQ_FOREACH(chr, &chardevs, next) { if (strcmp(chr->label, name) != 0) continue; return chr; } return NULL; }","No, it is non-vulnerable."161159,"static int a64multi_encode_frame(AVCodecContext *avctx, AVPacket *pkt, const AVFrame *pict, int *got_packet) { A64Context *c = avctx->priv_data; AVFrame *const p = avctx->coded_frame; int frame; int x, y; int b_height; int b_width; int req_size, ret; uint8_t *buf; int *charmap = c->mc_charmap; uint8_t *colram = c->mc_colram; uint8_t *charset = c->mc_charset; int *meta = c->mc_meta_charset; int *best_cb = c->mc_best_cb; int charset_size = 0x800 * (INTERLACED + 1); int colram_size = 0x100 * c->mc_use_5col; int screen_size; if(CROP_SCREENS) { b_height = FFMIN(avctx->height,C64YRES) >> 3; b_width = FFMIN(avctx->width ,C64XRES) >> 3; screen_size = b_width * b_height; } else { b_height = C64YRES >> 3; b_width = C64XRES >> 3; screen_size = 0x400; } /* no data, means end encoding asap */ if (!pict) { /* all done, end encoding */ if (!c->mc_lifetime) return 0; /* no more frames in queue, prepare to flush remaining frames */ if (!c->mc_frame_counter) { c->mc_lifetime = 0; } /* still frames in queue so limit lifetime to remaining frames */ else c->mc_lifetime = c->mc_frame_counter; /* still new data available */ } else { /* fill up mc_meta_charset with data until lifetime exceeds */ if (c->mc_frame_counter < c->mc_lifetime) { *p = *pict; p->pict_type = AV_PICTURE_TYPE_I; p->key_frame = 1; to_meta_with_crop(avctx, p, meta + 32000 * c->mc_frame_counter); c->mc_frame_counter++; if (c->next_pts == AV_NOPTS_VALUE) c->next_pts = pict->pts; /* lifetime is not reached so wait for next frame first */ return 0; } } /* lifetime reached so now convert X frames at once */ if (c->mc_frame_counter == c->mc_lifetime) { req_size = 0; /* any frames to encode? */ if (c->mc_lifetime) { req_size = charset_size + c->mc_lifetime*(screen_size + colram_size); if ((ret = ff_alloc_packet(pkt, req_size)) < 0) { av_log(avctx, AV_LOG_ERROR, ""Error getting output packet of size %d.\n"", req_size); return ret; } buf = pkt->data; /* calc optimal new charset + charmaps */ ret = ff_init_elbg(meta, 32, 1000 * c->mc_lifetime, best_cb, CHARSET_CHARS, 50, charmap, &c->randctx); if (ret < 0) return ret; ret = ff_do_elbg(meta, 32, 1000 * c->mc_lifetime, best_cb, CHARSET_CHARS, 50, charmap, &c->randctx); if (ret < 0) return ret; /* create colorram map and a c64 readable charset */ render_charset(avctx, charset, colram); /* copy charset to buf */ memcpy(buf, charset, charset_size); /* advance pointers */ buf += charset_size; charset += charset_size; } /* write x frames to buf */ for (frame = 0; frame < c->mc_lifetime; frame++) { /* copy charmap to buf. buf is uchar*, charmap is int*, so no memcpy here, sorry */ for (y = 0; y < b_height; y++) { for (x = 0; x < b_width; x++) { buf[y * b_width + x] = charmap[y * b_width + x]; } } /* advance pointers */ buf += screen_size; req_size += screen_size; /* compress and copy colram to buf */ if (c->mc_use_5col) { a64_compress_colram(buf, charmap, colram); /* advance pointers */ buf += colram_size; req_size += colram_size; } /* advance to next charmap */ charmap += 1000; } AV_WB32(avctx->extradata + 4, c->mc_frame_counter); AV_WB32(avctx->extradata + 8, charset_size); AV_WB32(avctx->extradata + 12, screen_size + colram_size); /* reset counter */ c->mc_frame_counter = 0; pkt->pts = pkt->dts = c->next_pts; c->next_pts = AV_NOPTS_VALUE; pkt->size = req_size; pkt->flags |= AV_PKT_FLAG_KEY; *got_packet = !!req_size; } return 0; }","No, it is non-vulnerable."162160,"static void vm_completion(ReadLineState *rs, const char *str) { size_t len; BlockDriverState *bs; BdrvNextIterator *it = NULL; len = strlen(str); readline_set_completion_index(rs, len); while ((it = bdrv_next(it, &bs))) { SnapshotInfoList *snapshots, *snapshot; AioContext *ctx = bdrv_get_aio_context(bs); bool ok = false; aio_context_acquire(ctx); if (bdrv_can_snapshot(bs)) { ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0; } aio_context_release(ctx); if (!ok) { continue; } snapshot = snapshots; while (snapshot) { char *completion = snapshot->value->name; if (!strncmp(str, completion, len)) { readline_add_completion(rs, completion); } completion = snapshot->value->id; if (!strncmp(str, completion, len)) { readline_add_completion(rs, completion); } snapshot = snapshot->next; } qapi_free_SnapshotInfoList(snapshots); } }","Yes, it is vulnerable."163161,"static int mpegps_read_packet(AVFormatContext *s, AVPacket *pkt) { AVStream *st; int len, startcode, i, type, codec_id; int64_t pts, dts; redo: len = mpegps_read_pes_header(s, NULL, &startcode, &pts, &dts, 1); if (len < 0) return len; /* now find stream */ for(i=0;i<s->nb_streams;i++) { st = s->streams[i]; if (st->id == startcode) goto found; } if (startcode >= 0x1e0 && startcode <= 0x1ef) { type = CODEC_TYPE_VIDEO; codec_id = CODEC_ID_MPEG1VIDEO; } else if (startcode >= 0x1c0 && startcode <= 0x1df) { type = CODEC_TYPE_AUDIO; codec_id = CODEC_ID_MP2; } else if (startcode >= 0x80 && startcode <= 0x9f) { type = CODEC_TYPE_AUDIO; codec_id = CODEC_ID_AC3; } else if (startcode >= 0xa0 && startcode <= 0xbf) { type = CODEC_TYPE_AUDIO; codec_id = CODEC_ID_PCM_S16BE; } else { skip: /* skip packet */ url_fskip(&s->pb, len); goto redo; } /* no stream found: add a new stream */ st = av_new_stream(s, startcode); if (!st) goto skip; st->codec.codec_type = type; st->codec.codec_id = codec_id; if (codec_id != CODEC_ID_PCM_S16BE) st->need_parsing = 1; found: if (startcode >= 0xa0 && startcode <= 0xbf) { int b1, freq; static const int lpcm_freq_tab[4] = { 48000, 96000, 44100, 32000 }; /* for LPCM, we just skip the header and consider it is raw audio data */ if (len <= 3) goto skip; get_byte(&s->pb); /* emphasis (1), muse(1), reserved(1), frame number(5) */ b1 = get_byte(&s->pb); /* quant (2), freq(2), reserved(1), channels(3) */ get_byte(&s->pb); /* dynamic range control (0x80 = off) */ len -= 3; freq = (b1 >> 4) & 3; st->codec.sample_rate = lpcm_freq_tab[freq]; st->codec.channels = 1 + (b1 & 7); st->codec.bit_rate = st->codec.channels * st->codec.sample_rate * 2; } av_new_packet(pkt, len); get_buffer(&s->pb, pkt->data, pkt->size); pkt->pts = pts; pkt->dts = dts; pkt->stream_index = st->index; #if 0 printf(""%d: pts=%0.3f dts=%0.3f\n"", pkt->stream_index, pkt->pts / 90000.0, pkt->dts / 90000.0); #endif return 0; }","Yes, it is vulnerable."164162,"static int check_for_evdev(void) { SDL_SysWMinfo info; XkbDescPtr desc; int has_evdev = 0; const char *keycodes; SDL_VERSION(&info.version); if (!SDL_GetWMInfo(&info)) return 0; desc = XkbGetKeyboard(info.info.x11.display, XkbGBN_AllComponentsMask, XkbUseCoreKbd); if (desc == NULL || desc->names == NULL) return 0; keycodes = XGetAtomName(info.info.x11.display, desc->names->keycodes); if (keycodes == NULL) fprintf(stderr, ""could not lookup keycode name\n""); else if (strstart(keycodes, ""evdev"", NULL)) has_evdev = 1; else if (!strstart(keycodes, ""xfree86"", NULL)) fprintf(stderr, ""unknown keycodes `%s', please report to qemu-devel@nongnu.org\n"", keycodes); XkbFreeClientMap(desc, XkbGBN_AllComponentsMask, True); return has_evdev; }","Yes, it is vulnerable."165163,"static MemTxResult memory_region_oldmmio_read_accessor(MemoryRegion *mr, hwaddr addr, uint64_t *value, unsigned size, unsigned shift, uint64_t mask, MemTxAttrs attrs) { uint64_t tmp; tmp = mr->ops->old_mmio.read[ctz32(size)](mr->opaque, addr); if (mr->subpage) { trace_memory_region_subpage_read(get_cpu_index(), mr, addr, tmp, size); } else if (TRACE_MEMORY_REGION_OPS_READ_ENABLED) { hwaddr abs_addr = memory_region_to_absolute_addr(mr, addr); trace_memory_region_ops_read(get_cpu_index(), mr, abs_addr, tmp, size); } *value |= (tmp & mask) << shift; return MEMTX_OK; }","Yes, it is vulnerable."166164,"static int flic_decode_frame_8BPP(AVCodecContext *avctx, void *data, int *data_size, const uint8_t *buf, int buf_size) { FlicDecodeContext *s = avctx->priv_data; int stream_ptr = 0; int pixel_ptr; int palette_ptr; unsigned char palette_idx1; unsigned char palette_idx2; unsigned int frame_size; int num_chunks; unsigned int chunk_size; int chunk_type; int i, j; int color_packets; int color_changes; int color_shift; unsigned char r, g, b; int lines; int compressed_lines; int starting_line; signed short line_packets; int y_ptr; int byte_run; int pixel_skip; int pixel_countdown; unsigned char *pixels; unsigned int pixel_limit; s->frame.reference = 3; s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE; if (avctx->reget_buffer(avctx, &s->frame) < 0) { av_log(avctx, AV_LOG_ERROR, ""reget_buffer() failed\n""); return -1; } pixels = s->frame.data[0]; pixel_limit = s->avctx->height * s->frame.linesize[0]; if (buf_size < 16 || buf_size > INT_MAX - (3 * 256 + FF_INPUT_BUFFER_PADDING_SIZE)) return AVERROR_INVALIDDATA; frame_size = AV_RL32(&buf[stream_ptr]); if (frame_size > buf_size) frame_size = buf_size; stream_ptr += 6; /* skip the magic number */ num_chunks = AV_RL16(&buf[stream_ptr]); stream_ptr += 10; /* skip padding */ frame_size -= 16; /* iterate through the chunks */ while ((frame_size >= 6) && (num_chunks > 0)) { int stream_ptr_after_chunk; chunk_size = AV_RL32(&buf[stream_ptr]); if (chunk_size > frame_size) { av_log(avctx, AV_LOG_WARNING, ""Invalid chunk_size = %u > frame_size = %u\n"", chunk_size, frame_size); chunk_size = frame_size; } stream_ptr_after_chunk = stream_ptr + chunk_size; stream_ptr += 4; chunk_type = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; switch (chunk_type) { case FLI_256_COLOR: case FLI_COLOR: /* check special case: If this file is from the Magic Carpet * game and uses 6-bit colors even though it reports 256-color * chunks in a 0xAF12-type file (fli_type is set to 0xAF13 during * initialization) */ if ((chunk_type == FLI_256_COLOR) && (s->fli_type != FLC_MAGIC_CARPET_SYNTHETIC_TYPE_CODE)) color_shift = 0; else color_shift = 2; /* set up the palette */ color_packets = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; palette_ptr = 0; for (i = 0; i < color_packets; i++) { /* first byte is how many colors to skip */ palette_ptr += buf[stream_ptr++]; /* next byte indicates how many entries to change */ color_changes = buf[stream_ptr++]; /* if there are 0 color changes, there are actually 256 */ if (color_changes == 0) color_changes = 256; if (stream_ptr + color_changes * 3 > stream_ptr_after_chunk) break; for (j = 0; j < color_changes; j++) { unsigned int entry; /* wrap around, for good measure */ if ((unsigned)palette_ptr >= 256) palette_ptr = 0; r = buf[stream_ptr++] << color_shift; g = buf[stream_ptr++] << color_shift; b = buf[stream_ptr++] << color_shift; entry = 0xFF << 24 | r << 16 | g << 8 | b; if (color_shift == 2) entry |= entry >> 6 & 0x30303; if (s->palette[palette_ptr] != entry) s->new_palette = 1; s->palette[palette_ptr++] = entry; } } break; case FLI_DELTA: y_ptr = 0; compressed_lines = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; while (compressed_lines > 0) { if (stream_ptr + 2 > stream_ptr_after_chunk) break; line_packets = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; if ((line_packets & 0xC000) == 0xC000) { // line skip opcode line_packets = -line_packets; y_ptr += line_packets * s->frame.linesize[0]; } else if ((line_packets & 0xC000) == 0x4000) { av_log(avctx, AV_LOG_ERROR, ""Undefined opcode (%x) in DELTA_FLI\n"", line_packets); } else if ((line_packets & 0xC000) == 0x8000) { // ""last byte"" opcode pixel_ptr= y_ptr + s->frame.linesize[0] - 1; CHECK_PIXEL_PTR(0); pixels[pixel_ptr] = line_packets & 0xff; } else { compressed_lines--; pixel_ptr = y_ptr; CHECK_PIXEL_PTR(0); pixel_countdown = s->avctx->width; for (i = 0; i < line_packets; i++) { if (stream_ptr + 2 > stream_ptr_after_chunk) break; /* account for the skip bytes */ pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; byte_run = (signed char)(buf[stream_ptr++]); if (byte_run < 0) { byte_run = -byte_run; palette_idx1 = buf[stream_ptr++]; palette_idx2 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run * 2); for (j = 0; j < byte_run; j++, pixel_countdown -= 2) { pixels[pixel_ptr++] = palette_idx1; pixels[pixel_ptr++] = palette_idx2; } } else { CHECK_PIXEL_PTR(byte_run * 2); if (stream_ptr + byte_run * 2 > stream_ptr_after_chunk) break; for (j = 0; j < byte_run * 2; j++, pixel_countdown--) { palette_idx1 = buf[stream_ptr++]; pixels[pixel_ptr++] = palette_idx1; } } } y_ptr += s->frame.linesize[0]; } } break; case FLI_LC: /* line compressed */ starting_line = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; y_ptr = 0; y_ptr += starting_line * s->frame.linesize[0]; compressed_lines = AV_RL16(&buf[stream_ptr]); stream_ptr += 2; while (compressed_lines > 0) { pixel_ptr = y_ptr; CHECK_PIXEL_PTR(0); pixel_countdown = s->avctx->width; line_packets = buf[stream_ptr++]; if (stream_ptr + 2 * line_packets > stream_ptr_after_chunk) break; if (line_packets > 0) { for (i = 0; i < line_packets; i++) { /* account for the skip bytes */ pixel_skip = buf[stream_ptr++]; pixel_ptr += pixel_skip; pixel_countdown -= pixel_skip; byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { CHECK_PIXEL_PTR(byte_run); if (stream_ptr + byte_run > stream_ptr_after_chunk) break; for (j = 0; j < byte_run; j++, pixel_countdown--) { palette_idx1 = buf[stream_ptr++]; pixels[pixel_ptr++] = palette_idx1; } } else if (byte_run < 0) { byte_run = -byte_run; palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); for (j = 0; j < byte_run; j++, pixel_countdown--) { pixels[pixel_ptr++] = palette_idx1; } } } } y_ptr += s->frame.linesize[0]; compressed_lines--; } break; case FLI_BLACK: /* set the whole frame to color 0 (which is usually black) */ memset(pixels, 0, s->frame.linesize[0] * s->avctx->height); break; case FLI_BRUN: /* Byte run compression: This chunk type only occurs in the first * FLI frame and it will update the entire frame. */ y_ptr = 0; for (lines = 0; lines < s->avctx->height; lines++) { pixel_ptr = y_ptr; /* disregard the line packets; instead, iterate through all * pixels on a row */ stream_ptr++; pixel_countdown = s->avctx->width; while (pixel_countdown > 0) { if (stream_ptr + 1 > stream_ptr_after_chunk) break; byte_run = (signed char)(buf[stream_ptr++]); if (byte_run > 0) { palette_idx1 = buf[stream_ptr++]; CHECK_PIXEL_PTR(byte_run); for (j = 0; j < byte_run; j++) { pixels[pixel_ptr++] = palette_idx1; pixel_countdown--; if (pixel_countdown < 0) av_log(avctx, AV_LOG_ERROR, ""pixel_countdown < 0 (%d) at line %d\n"", pixel_countdown, lines); } } else { /* copy bytes if byte_run < 0 */ byte_run = -byte_run; CHECK_PIXEL_PTR(byte_run); if (stream_ptr + byte_run > stream_ptr_after_chunk) break; for (j = 0; j < byte_run; j++) { palette_idx1 = buf[stream_ptr++]; pixels[pixel_ptr++] = palette_idx1; pixel_countdown--; if (pixel_countdown < 0) av_log(avctx, AV_LOG_ERROR, ""pixel_countdown < 0 (%d) at line %d\n"", pixel_countdown, lines); } } } y_ptr += s->frame.linesize[0]; } break; case FLI_COPY: /* copy the chunk (uncompressed frame) */ if (chunk_size - 6 != s->avctx->width * s->avctx->height) { av_log(avctx, AV_LOG_ERROR, ""In chunk FLI_COPY : source data (%d bytes) "" \ ""has incorrect size, skipping chunk\n"", chunk_size - 6); } else { for (y_ptr = 0; y_ptr < s->frame.linesize[0] * s->avctx->height; y_ptr += s->frame.linesize[0]) { memcpy(&pixels[y_ptr], &buf[stream_ptr], s->avctx->width); stream_ptr += s->avctx->width; } } break; case FLI_MINI: /* some sort of a thumbnail? disregard this chunk... */ break; default: av_log(avctx, AV_LOG_ERROR, ""Unrecognized chunk type: %d\n"", chunk_type); break; } stream_ptr = stream_ptr_after_chunk; frame_size -= chunk_size; num_chunks--; } /* by the end of the chunk, the stream ptr should equal the frame * size (minus 1, possibly); if it doesn't, issue a warning */ if ((stream_ptr != buf_size) && (stream_ptr != buf_size - 1)) av_log(avctx, AV_LOG_ERROR, ""Processed FLI chunk where chunk size = %d "" \ ""and final chunk ptr = %d\n"", buf_size, stream_ptr); /* make the palette available on the way out */ memcpy(s->frame.data[1], s->palette, AVPALETTE_SIZE); if (s->new_palette) { s->frame.palette_has_changed = 1; s->new_palette = 0; } *data_size=sizeof(AVFrame); *(AVFrame*)data = s->frame; return buf_size; }","Yes, it is vulnerable."167165,"static int dcstr_read_header(AVFormatContext *s) { unsigned codec, align; AVStream *st; st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->channels = avio_rl32(s->pb); st->codecpar->sample_rate = avio_rl32(s->pb); codec = avio_rl32(s->pb); align = avio_rl32(s->pb); avio_skip(s->pb, 4); st->duration = avio_rl32(s->pb); st->codecpar->channels *= avio_rl32(s->pb); if (!align || align > INT_MAX / st->codecpar->channels) return AVERROR_INVALIDDATA; st->codecpar->block_align = align * st->codecpar->channels; switch (codec) { case 4: st->codecpar->codec_id = AV_CODEC_ID_ADPCM_AICA; break; case 16: st->codecpar->codec_id = AV_CODEC_ID_PCM_S16LE_PLANAR; break; default: avpriv_request_sample(s, ""codec %X"", codec); return AVERROR_PATCHWELCOME; } avio_skip(s->pb, 0x800 - avio_tell(s->pb)); avpriv_set_pts_info(st, 64, 1, st->codecpar->sample_rate); return 0; }","Yes, it is vulnerable."168166,"int ff_oss_audio_open(AVFormatContext *s1, int is_output, const char *audio_device) { OSSAudioData *s = s1->priv_data; int audio_fd; int tmp, err; char *flip = getenv(""AUDIO_FLIP_LEFT""); if (is_output) audio_fd = avpriv_open(audio_device, O_WRONLY); else audio_fd = avpriv_open(audio_device, O_RDONLY); if (audio_fd < 0) { av_log(s1, AV_LOG_ERROR, ""%s: %s\n"", audio_device, strerror(errno)); return AVERROR(EIO); } if (flip && *flip == '1') { s->flip_left = 1; } /* non blocking mode */ if (!is_output) fcntl(audio_fd, F_SETFL, O_NONBLOCK); s->frame_size = OSS_AUDIO_BLOCK_SIZE; /* select format : favour native format */ err = ioctl(audio_fd, SNDCTL_DSP_GETFMTS, &tmp); #if HAVE_BIGENDIAN if (tmp & AFMT_S16_BE) { tmp = AFMT_S16_BE; } else if (tmp & AFMT_S16_LE) { tmp = AFMT_S16_LE; } else { tmp = 0; } #else if (tmp & AFMT_S16_LE) { tmp = AFMT_S16_LE; } else if (tmp & AFMT_S16_BE) { tmp = AFMT_S16_BE; } else { tmp = 0; } #endif switch(tmp) { case AFMT_S16_LE: s->codec_id = AV_CODEC_ID_PCM_S16LE; break; case AFMT_S16_BE: s->codec_id = AV_CODEC_ID_PCM_S16BE; break; default: av_log(s1, AV_LOG_ERROR, ""Soundcard does not support 16 bit sample format\n""); close(audio_fd); return AVERROR(EIO); } err=ioctl(audio_fd, SNDCTL_DSP_SETFMT, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_SETFMT: %s\n"", strerror(errno)); goto fail; } tmp = (s->channels == 2); err = ioctl(audio_fd, SNDCTL_DSP_STEREO, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_STEREO: %s\n"", strerror(errno)); goto fail; } tmp = s->sample_rate; err = ioctl(audio_fd, SNDCTL_DSP_SPEED, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_SPEED: %s\n"", strerror(errno)); goto fail; } s->sample_rate = tmp; /* store real sample rate */ s->fd = audio_fd; return 0; fail: close(audio_fd); return AVERROR(EIO); }","Yes, it is vulnerable."169167,"static int RENAME(swScale)(SwsContext *c, uint8_t* src[], int srcStride[], int srcSliceY, int srcSliceH, uint8_t* dst[], int dstStride[]) { /* load a few things into local vars to make the code more readable? and faster */ const int srcW= c->srcW; const int dstW= c->dstW; const int dstH= c->dstH; const int chrDstW= c->chrDstW; const int chrSrcW= c->chrSrcW; const int lumXInc= c->lumXInc; const int chrXInc= c->chrXInc; const enum PixelFormat dstFormat= c->dstFormat; const enum PixelFormat srcFormat= c->srcFormat; const int flags= c->flags; int16_t *vLumFilterPos= c->vLumFilterPos; int16_t *vChrFilterPos= c->vChrFilterPos; int16_t *hLumFilterPos= c->hLumFilterPos; int16_t *hChrFilterPos= c->hChrFilterPos; int16_t *vLumFilter= c->vLumFilter; int16_t *vChrFilter= c->vChrFilter; int16_t *hLumFilter= c->hLumFilter; int16_t *hChrFilter= c->hChrFilter; int32_t *lumMmxFilter= c->lumMmxFilter; int32_t *chrMmxFilter= c->chrMmxFilter; int32_t *alpMmxFilter= c->alpMmxFilter; const int vLumFilterSize= c->vLumFilterSize; const int vChrFilterSize= c->vChrFilterSize; const int hLumFilterSize= c->hLumFilterSize; const int hChrFilterSize= c->hChrFilterSize; int16_t **lumPixBuf= c->lumPixBuf; int16_t **chrPixBuf= c->chrPixBuf; int16_t **alpPixBuf= c->alpPixBuf; const int vLumBufSize= c->vLumBufSize; const int vChrBufSize= c->vChrBufSize; uint8_t *formatConvBuffer= c->formatConvBuffer; const int chrSrcSliceY= srcSliceY >> c->chrSrcVSubSample; const int chrSrcSliceH= -((-srcSliceH) >> c->chrSrcVSubSample); int lastDstY; uint32_t *pal=c->pal_yuv; /* vars which will change and which we need to store back in the context */ int dstY= c->dstY; int lumBufIndex= c->lumBufIndex; int chrBufIndex= c->chrBufIndex; int lastInLumBuf= c->lastInLumBuf; int lastInChrBuf= c->lastInChrBuf; if (isPacked(c->srcFormat)) { src[0]= src[1]= src[2]= src[3]= src[0]; srcStride[0]= srcStride[1]= srcStride[2]= srcStride[3]= srcStride[0]; } srcStride[1]<<= c->vChrDrop; srcStride[2]<<= c->vChrDrop; DEBUG_BUFFERS(""swScale() %p[%d] %p[%d] %p[%d] %p[%d] -> %p[%d] %p[%d] %p[%d] %p[%d]\n"", src[0], srcStride[0], src[1], srcStride[1], src[2], srcStride[2], src[3], srcStride[3], dst[0], dstStride[0], dst[1], dstStride[1], dst[2], dstStride[2], dst[3], dstStride[3]); DEBUG_BUFFERS(""srcSliceY: %d srcSliceH: %d dstY: %d dstH: %d\n"", srcSliceY, srcSliceH, dstY, dstH); DEBUG_BUFFERS(""vLumFilterSize: %d vLumBufSize: %d vChrFilterSize: %d vChrBufSize: %d\n"", vLumFilterSize, vLumBufSize, vChrFilterSize, vChrBufSize); if (dstStride[0]%8 !=0 || dstStride[1]%8 !=0 || dstStride[2]%8 !=0 || dstStride[3]%8 != 0) { static int warnedAlready=0; //FIXME move this into the context perhaps if (flags & SWS_PRINT_INFO && !warnedAlready) { av_log(c, AV_LOG_WARNING, ""Warning: dstStride is not aligned!\n"" "" ->cannot do aligned memory accesses anymore\n""); warnedAlready=1; } } /* Note the user might start scaling the picture in the middle so this will not get executed. This is not really intended but works currently, so people might do it. */ if (srcSliceY ==0) { lumBufIndex=0; chrBufIndex=0; dstY=0; lastInLumBuf= -1; lastInChrBuf= -1; } lastDstY= dstY; for (;dstY < dstH; dstY++) { unsigned char *dest =dst[0]+dstStride[0]*dstY; const int chrDstY= dstY>>c->chrDstVSubSample; unsigned char *uDest=dst[1]+dstStride[1]*chrDstY; unsigned char *vDest=dst[2]+dstStride[2]*chrDstY; unsigned char *aDest=(CONFIG_SWSCALE_ALPHA && alpPixBuf) ? dst[3]+dstStride[3]*dstY : NULL; const int firstLumSrcY= vLumFilterPos[dstY]; //First line needed as input const int firstChrSrcY= vChrFilterPos[chrDstY]; //First line needed as input int lastLumSrcY= firstLumSrcY + vLumFilterSize -1; // Last line needed as input int lastChrSrcY= firstChrSrcY + vChrFilterSize -1; // Last line needed as input int enough_lines; //handle holes (FAST_BILINEAR & weird filters) if (firstLumSrcY > lastInLumBuf) lastInLumBuf= firstLumSrcY-1; if (firstChrSrcY > lastInChrBuf) lastInChrBuf= firstChrSrcY-1; assert(firstLumSrcY >= lastInLumBuf - vLumBufSize + 1); assert(firstChrSrcY >= lastInChrBuf - vChrBufSize + 1); // Do we have enough lines in this slice to output the dstY line enough_lines = lastLumSrcY < srcSliceY + srcSliceH && lastChrSrcY < -((-srcSliceY - srcSliceH)>>c->chrSrcVSubSample); if (!enough_lines) { lastLumSrcY = srcSliceY + srcSliceH - 1; lastChrSrcY = chrSrcSliceY + chrSrcSliceH - 1; } DEBUG_BUFFERS(""dstY: %d\n"", dstY); DEBUG_BUFFERS(""\tfirstLumSrcY: %d lastLumSrcY: %d lastInLumBuf: %d\n"", firstLumSrcY, lastLumSrcY, lastInLumBuf); DEBUG_BUFFERS(""\tfirstChrSrcY: %d lastChrSrcY: %d lastInChrBuf: %d\n"", firstChrSrcY, lastChrSrcY, lastInChrBuf); //Do horizontal scaling while(lastInLumBuf < lastLumSrcY) { uint8_t *src1= src[0]+(lastInLumBuf + 1 - srcSliceY)*srcStride[0]; uint8_t *src2= src[3]+(lastInLumBuf + 1 - srcSliceY)*srcStride[3]; lumBufIndex++; DEBUG_BUFFERS(""\t\tlumBufIndex %d: lastInLumBuf: %d\n"", lumBufIndex, lastInLumBuf); assert(lumBufIndex < 2*vLumBufSize); assert(lastInLumBuf + 1 - srcSliceY < srcSliceH); assert(lastInLumBuf + 1 - srcSliceY >= 0); RENAME(hyscale)(c, lumPixBuf[ lumBufIndex ], dstW, src1, srcW, lumXInc, flags, hLumFilter, hLumFilterPos, hLumFilterSize, c->srcFormat, formatConvBuffer, pal, 0); if (CONFIG_SWSCALE_ALPHA && alpPixBuf) RENAME(hyscale)(c, alpPixBuf[ lumBufIndex ], dstW, src2, srcW, lumXInc, flags, hLumFilter, hLumFilterPos, hLumFilterSize, c->srcFormat, formatConvBuffer, pal, 1); lastInLumBuf++; } while(lastInChrBuf < lastChrSrcY) { uint8_t *src1= src[1]+(lastInChrBuf + 1 - chrSrcSliceY)*srcStride[1]; uint8_t *src2= src[2]+(lastInChrBuf + 1 - chrSrcSliceY)*srcStride[2]; chrBufIndex++; DEBUG_BUFFERS(""\t\tchrBufIndex %d: lastInChrBuf: %d\n"", chrBufIndex, lastInChrBuf); assert(chrBufIndex < 2*vChrBufSize); assert(lastInChrBuf + 1 - chrSrcSliceY < (chrSrcSliceH)); assert(lastInChrBuf + 1 - chrSrcSliceY >= 0); //FIXME replace parameters through context struct (some at least) if (!(isGray(srcFormat) || isGray(dstFormat))) RENAME(hcscale)(c, chrPixBuf[ chrBufIndex ], chrDstW, src1, src2, chrSrcW, chrXInc, flags, hChrFilter, hChrFilterPos, hChrFilterSize, c->srcFormat, formatConvBuffer, pal); lastInChrBuf++; } //wrap buf index around to stay inside the ring buffer if (lumBufIndex >= vLumBufSize) lumBufIndex-= vLumBufSize; if (chrBufIndex >= vChrBufSize) chrBufIndex-= vChrBufSize; if (!enough_lines) break; //we can't output a dstY line so let's try with the next slice #if COMPILE_TEMPLATE_MMX c->blueDither= ff_dither8[dstY&1]; if (c->dstFormat == PIX_FMT_RGB555 || c->dstFormat == PIX_FMT_BGR555) c->greenDither= ff_dither8[dstY&1]; else c->greenDither= ff_dither4[dstY&1]; c->redDither= ff_dither8[(dstY+1)&1]; #endif if (dstY < dstH-2) { const int16_t **lumSrcPtr= (const int16_t **) lumPixBuf + lumBufIndex + firstLumSrcY - lastInLumBuf + vLumBufSize; const int16_t **chrSrcPtr= (const int16_t **) chrPixBuf + chrBufIndex + firstChrSrcY - lastInChrBuf + vChrBufSize; const int16_t **alpSrcPtr= (CONFIG_SWSCALE_ALPHA && alpPixBuf) ? (const int16_t **) alpPixBuf + lumBufIndex + firstLumSrcY - lastInLumBuf + vLumBufSize : NULL; #if COMPILE_TEMPLATE_MMX int i; if (flags & SWS_ACCURATE_RND) { int s= APCK_SIZE / 8; for (i=0; i<vLumFilterSize; i+=2) { *(void**)&lumMmxFilter[s*i ]= lumSrcPtr[i ]; *(void**)&lumMmxFilter[s*i+APCK_PTR2/4 ]= lumSrcPtr[i+(vLumFilterSize>1)]; lumMmxFilter[s*i+APCK_COEF/4 ]= lumMmxFilter[s*i+APCK_COEF/4+1]= vLumFilter[dstY*vLumFilterSize + i ] + (vLumFilterSize>1 ? vLumFilter[dstY*vLumFilterSize + i + 1]<<16 : 0); if (CONFIG_SWSCALE_ALPHA && alpPixBuf) { *(void**)&alpMmxFilter[s*i ]= alpSrcPtr[i ]; *(void**)&alpMmxFilter[s*i+APCK_PTR2/4 ]= alpSrcPtr[i+(vLumFilterSize>1)]; alpMmxFilter[s*i+APCK_COEF/4 ]= alpMmxFilter[s*i+APCK_COEF/4+1]= lumMmxFilter[s*i+APCK_COEF/4 ]; } } for (i=0; i<vChrFilterSize; i+=2) { *(void**)&chrMmxFilter[s*i ]= chrSrcPtr[i ]; *(void**)&chrMmxFilter[s*i+APCK_PTR2/4 ]= chrSrcPtr[i+(vChrFilterSize>1)]; chrMmxFilter[s*i+APCK_COEF/4 ]= chrMmxFilter[s*i+APCK_COEF/4+1]= vChrFilter[chrDstY*vChrFilterSize + i ] + (vChrFilterSize>1 ? vChrFilter[chrDstY*vChrFilterSize + i + 1]<<16 : 0); } } else { for (i=0; i<vLumFilterSize; i++) { lumMmxFilter[4*i+0]= (int32_t)lumSrcPtr[i]; lumMmxFilter[4*i+1]= (uint64_t)lumSrcPtr[i] >> 32; lumMmxFilter[4*i+2]= lumMmxFilter[4*i+3]= ((uint16_t)vLumFilter[dstY*vLumFilterSize + i])*0x10001; if (CONFIG_SWSCALE_ALPHA && alpPixBuf) { alpMmxFilter[4*i+0]= (int32_t)alpSrcPtr[i]; alpMmxFilter[4*i+1]= (uint64_t)alpSrcPtr[i] >> 32; alpMmxFilter[4*i+2]= alpMmxFilter[4*i+3]= lumMmxFilter[4*i+2]; } } for (i=0; i<vChrFilterSize; i++) { chrMmxFilter[4*i+0]= (int32_t)chrSrcPtr[i]; chrMmxFilter[4*i+1]= (uint64_t)chrSrcPtr[i] >> 32; chrMmxFilter[4*i+2]= chrMmxFilter[4*i+3]= ((uint16_t)vChrFilter[chrDstY*vChrFilterSize + i])*0x10001; } } #endif if (dstFormat == PIX_FMT_NV12 || dstFormat == PIX_FMT_NV21) { const int chrSkipMask= (1<<c->chrDstVSubSample)-1; if (dstY&chrSkipMask) uDest= NULL; //FIXME split functions in lumi / chromi c->yuv2nv12X(c, vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, dest, uDest, dstW, chrDstW, dstFormat); } else if (isPlanarYUV(dstFormat) || dstFormat==PIX_FMT_GRAY8) { //YV12 like const int chrSkipMask= (1<<c->chrDstVSubSample)-1; if ((dstY&chrSkipMask) || isGray(dstFormat)) uDest=vDest= NULL; //FIXME split functions in lumi / chromi if (is16BPS(dstFormat)) { yuv2yuvX16inC( vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, (uint16_t *) dest, (uint16_t *) uDest, (uint16_t *) vDest, (uint16_t *) aDest, dstW, chrDstW, dstFormat); } else if (vLumFilterSize == 1 && vChrFilterSize == 1) { // unscaled YV12 int16_t *lumBuf = lumSrcPtr[0]; int16_t *chrBuf= chrSrcPtr[0]; int16_t *alpBuf= (CONFIG_SWSCALE_ALPHA && alpPixBuf) ? alpSrcPtr[0] : NULL; c->yuv2yuv1(c, lumBuf, chrBuf, alpBuf, dest, uDest, vDest, aDest, dstW, chrDstW); } else { //General YV12 c->yuv2yuvX(c, vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, uDest, vDest, aDest, dstW, chrDstW); } } else { assert(lumSrcPtr + vLumFilterSize - 1 < lumPixBuf + vLumBufSize*2); assert(chrSrcPtr + vChrFilterSize - 1 < chrPixBuf + vChrBufSize*2); if (vLumFilterSize == 1 && vChrFilterSize == 2) { //unscaled RGB int chrAlpha= vChrFilter[2*dstY+1]; if(flags & SWS_FULL_CHR_H_INT) { yuv2rgbXinC_full(c, //FIXME write a packed1_full function vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } else { c->yuv2packed1(c, *lumSrcPtr, *chrSrcPtr, *(chrSrcPtr+1), alpPixBuf ? *alpSrcPtr : NULL, dest, dstW, chrAlpha, dstFormat, flags, dstY); } } else if (vLumFilterSize == 2 && vChrFilterSize == 2) { //bilinear upscale RGB int lumAlpha= vLumFilter[2*dstY+1]; int chrAlpha= vChrFilter[2*dstY+1]; lumMmxFilter[2]= lumMmxFilter[3]= vLumFilter[2*dstY ]*0x10001; chrMmxFilter[2]= chrMmxFilter[3]= vChrFilter[2*chrDstY]*0x10001; if(flags & SWS_FULL_CHR_H_INT) { yuv2rgbXinC_full(c, //FIXME write a packed2_full function vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } else { c->yuv2packed2(c, *lumSrcPtr, *(lumSrcPtr+1), *chrSrcPtr, *(chrSrcPtr+1), alpPixBuf ? *alpSrcPtr : NULL, alpPixBuf ? *(alpSrcPtr+1) : NULL, dest, dstW, lumAlpha, chrAlpha, dstY); } } else { //general RGB if(flags & SWS_FULL_CHR_H_INT) { yuv2rgbXinC_full(c, vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } else { c->yuv2packedX(c, vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } } } } else { // hmm looks like we can't use MMX here without overwriting this array's tail const int16_t **lumSrcPtr= (const int16_t **)lumPixBuf + lumBufIndex + firstLumSrcY - lastInLumBuf + vLumBufSize; const int16_t **chrSrcPtr= (const int16_t **)chrPixBuf + chrBufIndex + firstChrSrcY - lastInChrBuf + vChrBufSize; const int16_t **alpSrcPtr= (CONFIG_SWSCALE_ALPHA && alpPixBuf) ? (const int16_t **)alpPixBuf + lumBufIndex + firstLumSrcY - lastInLumBuf + vLumBufSize : NULL; if (dstFormat == PIX_FMT_NV12 || dstFormat == PIX_FMT_NV21) { const int chrSkipMask= (1<<c->chrDstVSubSample)-1; if (dstY&chrSkipMask) uDest= NULL; //FIXME split functions in lumi / chromi yuv2nv12XinC( vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, dest, uDest, dstW, chrDstW, dstFormat); } else if (isPlanarYUV(dstFormat) || dstFormat==PIX_FMT_GRAY8) { //YV12 const int chrSkipMask= (1<<c->chrDstVSubSample)-1; if ((dstY&chrSkipMask) || isGray(dstFormat)) uDest=vDest= NULL; //FIXME split functions in lumi / chromi if (is16BPS(dstFormat)) { yuv2yuvX16inC( vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, (uint16_t *) dest, (uint16_t *) uDest, (uint16_t *) vDest, (uint16_t *) aDest, dstW, chrDstW, dstFormat); } else { yuv2yuvXinC( vLumFilter+dstY*vLumFilterSize , lumSrcPtr, vLumFilterSize, vChrFilter+chrDstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, uDest, vDest, aDest, dstW, chrDstW); } } else { assert(lumSrcPtr + vLumFilterSize - 1 < lumPixBuf + vLumBufSize*2); assert(chrSrcPtr + vChrFilterSize - 1 < chrPixBuf + vChrBufSize*2); if(flags & SWS_FULL_CHR_H_INT) { yuv2rgbXinC_full(c, vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } else { yuv2packedXinC(c, vLumFilter+dstY*vLumFilterSize, lumSrcPtr, vLumFilterSize, vChrFilter+dstY*vChrFilterSize, chrSrcPtr, vChrFilterSize, alpSrcPtr, dest, dstW, dstY); } } } } if ((dstFormat == PIX_FMT_YUVA420P) && !alpPixBuf) fillPlane(dst[3], dstStride[3], dstW, dstY-lastDstY, lastDstY, 255); #if COMPILE_TEMPLATE_MMX if (flags & SWS_CPU_CAPS_MMX2 ) __asm__ volatile(""sfence"":::""memory""); /* On K6 femms is faster than emms. On K7 femms is directly mapped to emms. */ if (flags & SWS_CPU_CAPS_3DNOW) __asm__ volatile(""femms"" :::""memory""); else __asm__ volatile(""emms"" :::""memory""); #endif /* store changed local vars back in the context */ c->dstY= dstY; c->lumBufIndex= lumBufIndex; c->chrBufIndex= chrBufIndex; c->lastInLumBuf= lastInLumBuf; c->lastInChrBuf= lastInChrBuf; return dstY - lastDstY; }","No, it is non-vulnerable."170168,"static uint32_t bonito_spciconf_readb(void *opaque, target_phys_addr_t addr) { PCIBonitoState *s = opaque; uint32_t pciaddr; uint16_t status; DPRINTF(""bonito_spciconf_readb ""TARGET_FMT_plx"" \n"", addr); pciaddr = bonito_sbridge_pciaddr(s, addr); if (pciaddr == 0xffffffff) { return 0xff; } /* set the pci address in s->config_reg */ s->pcihost->config_reg = (pciaddr) | (1u << 31); /* clear PCI_STATUS_REC_MASTER_ABORT and PCI_STATUS_REC_TARGET_ABORT */ status = pci_get_word(s->dev.config + PCI_STATUS); status &= ~(PCI_STATUS_REC_MASTER_ABORT | PCI_STATUS_REC_TARGET_ABORT); pci_set_word(s->dev.config + PCI_STATUS, status); return pci_data_read(s->pcihost->bus, s->pcihost->config_reg, 1); }","No, it is non-vulnerable."171169,"static void qdev_get_legacy_property(DeviceState *dev, Visitor *v, void *opaque, const char *name, Error **errp) { Property *prop = opaque; if (prop->info->print) { char buffer[1024]; char *ptr = buffer; prop->info->print(dev, prop, buffer, sizeof(buffer)); visit_type_str(v, &ptr, name, errp); } else { error_set(errp, QERR_PERMISSION_DENIED); } }","No, it is non-vulnerable."172170,"static char *value_string(char *buf, int buf_size, struct unit_value uv) { double vald; int show_float = 0; if (uv.unit == unit_second_str) { vald = uv.val.d; show_float = 1; } else { vald = uv.val.i; } if (uv.unit == unit_second_str && use_value_sexagesimal_format) { double secs; int hours, mins; secs = vald; mins = (int)secs / 60; secs = secs - mins * 60; hours = mins / 60; mins %= 60; snprintf(buf, buf_size, ""%d:%02d:%09.6f"", hours, mins, secs); } else { const char *prefix_string = """"; int l; if (use_value_prefix && vald > 1) { long long int index; if (uv.unit == unit_byte_str && use_byte_value_binary_prefix) { index = (long long int) (log2(vald)) / 10; index = av_clip(index, 0, FF_ARRAY_ELEMS(binary_unit_prefixes) - 1); vald /= exp2(index * 10); prefix_string = binary_unit_prefixes[index]; } else { index = (long long int) (log10(vald)) / 3; index = av_clip(index, 0, FF_ARRAY_ELEMS(decimal_unit_prefixes) - 1); vald /= pow(10, index * 3); prefix_string = decimal_unit_prefixes[index]; } } if (show_float || (use_value_prefix && vald != (long long int)vald)) l = snprintf(buf, buf_size, ""%f"", vald); else l = snprintf(buf, buf_size, ""%lld"", (long long int)vald); snprintf(buf+l, buf_size-l, ""%s%s%s"", *prefix_string || show_value_unit ? "" "" : """", prefix_string, show_value_unit ? uv.unit : """"); } return buf; }","No, it is non-vulnerable."173171,"static int mjpeg_decode_dht(MJpegDecodeContext *s) { int len, index, i, class, n, v, code_max; uint8_t bits_table[17]; uint8_t val_table[256]; len = get_bits(&s->gb, 16) - 2; while (len > 0) { if (len < 17) return -1; class = get_bits(&s->gb, 4); if (class >= 2) return -1; index = get_bits(&s->gb, 4); if (index >= 4) return -1; n = 0; for(i=1;i<=16;i++) { bits_table[i] = get_bits(&s->gb, 8); n += bits_table[i]; } len -= 17; if (len < n || n > 256) return -1; code_max = 0; for(i=0;i<n;i++) { v = get_bits(&s->gb, 8); if (v > code_max) code_max = v; val_table[i] = v; } len -= n; /* build VLC and flush previous vlc if present */ free_vlc(&s->vlcs[class][index]); dprintf(""class=%d index=%d nb_codes=%d\n"", class, index, code_max + 1); if(build_vlc(&s->vlcs[class][index], bits_table, val_table, code_max + 1) < 0){ return -1; } } return 0; }","Yes, it is vulnerable."174172,"static target_ulong disas_insn(CPUX86State *env, DisasContext *s, target_ulong pc_start) { int b, prefixes; int shift; TCGMemOp ot, aflag, dflag; int modrm, reg, rm, mod, op, opreg, val; target_ulong next_eip, tval; int rex_w, rex_r; s->pc_start = s->pc = pc_start; prefixes = 0; s->override = -1; rex_w = -1; rex_r = 0; #ifdef TARGET_X86_64 s->rex_x = 0; s->rex_b = 0; x86_64_hregs = 0; #endif s->rip_offset = 0; /* for relative ip address */ s->vex_l = 0; s->vex_v = 0; next_byte: /* x86 has an upper limit of 15 bytes for an instruction. Since we * do not want to decode and generate IR for an illegal * instruction, the following check limits the instruction size to * 25 bytes: 14 prefix + 1 opc + 6 (modrm+sib+ofs) + 4 imm */ if (s->pc - pc_start > 14) { goto illegal_op; b = cpu_ldub_code(env, s->pc); s->pc++; /* Collect prefixes. */ switch (b) { case 0xf3: prefixes |= PREFIX_REPZ; goto next_byte; case 0xf2: prefixes |= PREFIX_REPNZ; goto next_byte; case 0xf0: prefixes |= PREFIX_LOCK; goto next_byte; case 0x2e: s->override = R_CS; goto next_byte; case 0x36: s->override = R_SS; goto next_byte; case 0x3e: s->override = R_DS; goto next_byte; case 0x26: s->override = R_ES; goto next_byte; case 0x64: s->override = R_FS; goto next_byte; case 0x65: s->override = R_GS; goto next_byte; case 0x66: prefixes |= PREFIX_DATA; goto next_byte; case 0x67: prefixes |= PREFIX_ADR; goto next_byte; #ifdef TARGET_X86_64 case 0x40 ... 0x4f: if (CODE64(s)) { /* REX prefix */ rex_w = (b >> 3) & 1; rex_r = (b & 0x4) << 1; s->rex_x = (b & 0x2) << 2; REX_B(s) = (b & 0x1) << 3; x86_64_hregs = 1; /* select uniform byte register addressing */ goto next_byte; break; #endif case 0xc5: /* 2-byte VEX */ case 0xc4: /* 3-byte VEX */ /* VEX prefixes cannot be used except in 32-bit mode. Otherwise the instruction is LES or LDS. */ if (s->code32 && !s->vm86) { static const int pp_prefix[4] = { 0, PREFIX_DATA, PREFIX_REPZ, PREFIX_REPNZ }; int vex3, vex2 = cpu_ldub_code(env, s->pc); if (!CODE64(s) && (vex2 & 0xc0) != 0xc0) { /* 4.1.4.6: In 32-bit mode, bits [7:6] must be 11b, otherwise the instruction is LES or LDS. */ break; s->pc++; /* 4.1.1-4.1.3: No preceding lock, 66, f2, f3, or rex prefixes. */ if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ | PREFIX_LOCK | PREFIX_DATA)) { goto illegal_op; #ifdef TARGET_X86_64 if (x86_64_hregs) { goto illegal_op; #endif rex_r = (~vex2 >> 4) & 8; if (b == 0xc5) { vex3 = vex2; b = cpu_ldub_code(env, s->pc++); } else { #ifdef TARGET_X86_64 s->rex_x = (~vex2 >> 3) & 8; s->rex_b = (~vex2 >> 2) & 8; #endif vex3 = cpu_ldub_code(env, s->pc++); rex_w = (vex3 >> 7) & 1; switch (vex2 & 0x1f) { case 0x01: /* Implied 0f leading opcode bytes. */ b = cpu_ldub_code(env, s->pc++) | 0x100; break; case 0x02: /* Implied 0f 38 leading opcode bytes. */ b = 0x138; break; case 0x03: /* Implied 0f 3a leading opcode bytes. */ b = 0x13a; break; default: /* Reserved for future use. */ goto unknown_op; s->vex_v = (~vex3 >> 3) & 0xf; s->vex_l = (vex3 >> 2) & 1; prefixes |= pp_prefix[vex3 & 3] | PREFIX_VEX; break; /* Post-process prefixes. */ if (CODE64(s)) { /* In 64-bit mode, the default data size is 32-bit. Select 64-bit data with rex_w, and 16-bit data with 0x66; rex_w takes precedence over 0x66 if both are present. */ dflag = (rex_w > 0 ? MO_64 : prefixes & PREFIX_DATA ? MO_16 : MO_32); /* In 64-bit mode, 0x67 selects 32-bit addressing. */ aflag = (prefixes & PREFIX_ADR ? MO_32 : MO_64); } else { /* In 16/32-bit mode, 0x66 selects the opposite data size. */ if (s->code32 ^ ((prefixes & PREFIX_DATA) != 0)) { dflag = MO_32; } else { dflag = MO_16; /* In 16/32-bit mode, 0x67 selects the opposite addressing. */ if (s->code32 ^ ((prefixes & PREFIX_ADR) != 0)) { aflag = MO_32; } else { aflag = MO_16; s->prefix = prefixes; s->aflag = aflag; s->dflag = dflag; /* now check op code */ reswitch: switch(b) { case 0x0f: /**************************/ /* extended op code */ b = cpu_ldub_code(env, s->pc++) | 0x100; goto reswitch; /**************************/ /* arith & logic */ case 0x00 ... 0x05: case 0x08 ... 0x0d: case 0x10 ... 0x15: case 0x18 ... 0x1d: case 0x20 ... 0x25: case 0x28 ... 0x2d: case 0x30 ... 0x35: case 0x38 ... 0x3d: { int op, f, val; op = (b >> 3) & 7; f = (b >> 1) & 3; ot = mo_b_d(b, dflag); switch(f) { case 0: /* OP Ev, Gv */ modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); if (mod != 3) { gen_lea_modrm(env, s, modrm); opreg = OR_TMP0; } else if (op == OP_XORL && rm == reg) { xor_zero: /* xor reg, reg optimisation */ set_cc_op(s, CC_OP_CLR); tcg_gen_movi_tl(cpu_T0, 0); gen_op_mov_reg_v(ot, reg, cpu_T0); break; } else { opreg = rm; gen_op_mov_v_reg(ot, cpu_T1, reg); gen_op(s, op, ot, opreg); break; case 1: /* OP Gv, Ev */ modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; reg = ((modrm >> 3) & 7) | rex_r; rm = (modrm & 7) | REX_B(s); if (mod != 3) { gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, ot, cpu_T1, cpu_A0); } else if (op == OP_XORL && rm == reg) { goto xor_zero; } else { gen_op_mov_v_reg(ot, cpu_T1, rm); gen_op(s, op, ot, reg); break; case 2: /* OP A, Iv */ val = insn_get(env, s, ot); tcg_gen_movi_tl(cpu_T1, val); gen_op(s, op, ot, OR_EAX); break; break; case 0x82: if (CODE64(s)) goto illegal_op; case 0x80: /* GRP1 */ case 0x81: case 0x83: { int val; ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); op = (modrm >> 3) & 7; if (mod != 3) { if (b == 0x83) s->rip_offset = 1; else s->rip_offset = insn_const_size(ot); gen_lea_modrm(env, s, modrm); opreg = OR_TMP0; } else { opreg = rm; switch(b) { default: case 0x80: case 0x81: case 0x82: val = insn_get(env, s, ot); break; case 0x83: val = (int8_t)insn_get(env, s, MO_8); break; tcg_gen_movi_tl(cpu_T1, val); gen_op(s, op, ot, opreg); break; /**************************/ /* inc, dec, and other misc arith */ case 0x40 ... 0x47: /* inc Gv */ ot = dflag; gen_inc(s, ot, OR_EAX + (b & 7), 1); break; case 0x48 ... 0x4f: /* dec Gv */ ot = dflag; gen_inc(s, ot, OR_EAX + (b & 7), -1); break; case 0xf6: /* GRP3 */ case 0xf7: ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); op = (modrm >> 3) & 7; if (mod != 3) { if (op == 0) { s->rip_offset = insn_const_size(ot); gen_lea_modrm(env, s, modrm); /* For those below that handle locked memory, don't load here. */ if (!(s->prefix & PREFIX_LOCK) || op != 2) { gen_op_ld_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_v_reg(ot, cpu_T0, rm); switch(op) { case 0: /* test */ val = insn_get(env, s, ot); tcg_gen_movi_tl(cpu_T1, val); gen_op_testl_T0_T1_cc(); set_cc_op(s, CC_OP_LOGICB + ot); break; case 2: /* not */ if (s->prefix & PREFIX_LOCK) { if (mod == 3) { goto illegal_op; tcg_gen_movi_tl(cpu_T0, ~0); tcg_gen_atomic_xor_fetch_tl(cpu_T0, cpu_A0, cpu_T0, s->mem_index, ot | MO_LE); } else { tcg_gen_not_tl(cpu_T0, cpu_T0); if (mod != 3) { gen_op_st_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_reg_v(ot, rm, cpu_T0); break; case 3: /* neg */ if (s->prefix & PREFIX_LOCK) { TCGLabel *label1; TCGv a0, t0, t1, t2; if (mod == 3) { goto illegal_op; a0 = tcg_temp_local_new(); t0 = tcg_temp_local_new(); label1 = gen_new_label(); tcg_gen_mov_tl(a0, cpu_A0); tcg_gen_mov_tl(t0, cpu_T0); gen_set_label(label1); t1 = tcg_temp_new(); t2 = tcg_temp_new(); tcg_gen_mov_tl(t2, t0); tcg_gen_neg_tl(t1, t0); tcg_gen_atomic_cmpxchg_tl(t0, a0, t0, t1, s->mem_index, ot | MO_LE); tcg_temp_free(t1); tcg_gen_brcond_tl(TCG_COND_NE, t0, t2, label1); tcg_temp_free(t2); tcg_temp_free(a0); tcg_gen_mov_tl(cpu_T0, t0); tcg_temp_free(t0); } else { tcg_gen_neg_tl(cpu_T0, cpu_T0); if (mod != 3) { gen_op_st_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_reg_v(ot, rm, cpu_T0); gen_op_update_neg_cc(); set_cc_op(s, CC_OP_SUBB + ot); break; case 4: /* mul */ switch(ot) { case MO_8: gen_op_mov_v_reg(MO_8, cpu_T1, R_EAX); tcg_gen_ext8u_tl(cpu_T0, cpu_T0); tcg_gen_ext8u_tl(cpu_T1, cpu_T1); /* XXX: use 32 bit mul which could be faster */ tcg_gen_mul_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); tcg_gen_andi_tl(cpu_cc_src, cpu_T0, 0xff00); set_cc_op(s, CC_OP_MULB); break; case MO_16: gen_op_mov_v_reg(MO_16, cpu_T1, R_EAX); tcg_gen_ext16u_tl(cpu_T0, cpu_T0); tcg_gen_ext16u_tl(cpu_T1, cpu_T1); /* XXX: use 32 bit mul which could be faster */ tcg_gen_mul_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); tcg_gen_shri_tl(cpu_T0, cpu_T0, 16); gen_op_mov_reg_v(MO_16, R_EDX, cpu_T0); tcg_gen_mov_tl(cpu_cc_src, cpu_T0); set_cc_op(s, CC_OP_MULW); break; default: case MO_32: tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_regs[R_EAX]); tcg_gen_mulu2_i32(cpu_tmp2_i32, cpu_tmp3_i32, cpu_tmp2_i32, cpu_tmp3_i32); tcg_gen_extu_i32_tl(cpu_regs[R_EAX], cpu_tmp2_i32); tcg_gen_extu_i32_tl(cpu_regs[R_EDX], cpu_tmp3_i32); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]); tcg_gen_mov_tl(cpu_cc_src, cpu_regs[R_EDX]); set_cc_op(s, CC_OP_MULL); break; #ifdef TARGET_X86_64 case MO_64: tcg_gen_mulu2_i64(cpu_regs[R_EAX], cpu_regs[R_EDX], cpu_T0, cpu_regs[R_EAX]); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]); tcg_gen_mov_tl(cpu_cc_src, cpu_regs[R_EDX]); set_cc_op(s, CC_OP_MULQ); break; #endif break; case 5: /* imul */ switch(ot) { case MO_8: gen_op_mov_v_reg(MO_8, cpu_T1, R_EAX); tcg_gen_ext8s_tl(cpu_T0, cpu_T0); tcg_gen_ext8s_tl(cpu_T1, cpu_T1); /* XXX: use 32 bit mul which could be faster */ tcg_gen_mul_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); tcg_gen_ext8s_tl(cpu_tmp0, cpu_T0); tcg_gen_sub_tl(cpu_cc_src, cpu_T0, cpu_tmp0); set_cc_op(s, CC_OP_MULB); break; case MO_16: gen_op_mov_v_reg(MO_16, cpu_T1, R_EAX); tcg_gen_ext16s_tl(cpu_T0, cpu_T0); tcg_gen_ext16s_tl(cpu_T1, cpu_T1); /* XXX: use 32 bit mul which could be faster */ tcg_gen_mul_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); tcg_gen_ext16s_tl(cpu_tmp0, cpu_T0); tcg_gen_sub_tl(cpu_cc_src, cpu_T0, cpu_tmp0); tcg_gen_shri_tl(cpu_T0, cpu_T0, 16); gen_op_mov_reg_v(MO_16, R_EDX, cpu_T0); set_cc_op(s, CC_OP_MULW); break; default: case MO_32: tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_regs[R_EAX]); tcg_gen_muls2_i32(cpu_tmp2_i32, cpu_tmp3_i32, cpu_tmp2_i32, cpu_tmp3_i32); tcg_gen_extu_i32_tl(cpu_regs[R_EAX], cpu_tmp2_i32); tcg_gen_extu_i32_tl(cpu_regs[R_EDX], cpu_tmp3_i32); tcg_gen_sari_i32(cpu_tmp2_i32, cpu_tmp2_i32, 31); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]); tcg_gen_sub_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32); tcg_gen_extu_i32_tl(cpu_cc_src, cpu_tmp2_i32); set_cc_op(s, CC_OP_MULL); break; #ifdef TARGET_X86_64 case MO_64: tcg_gen_muls2_i64(cpu_regs[R_EAX], cpu_regs[R_EDX], cpu_T0, cpu_regs[R_EAX]); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[R_EAX]); tcg_gen_sari_tl(cpu_cc_src, cpu_regs[R_EAX], 63); tcg_gen_sub_tl(cpu_cc_src, cpu_cc_src, cpu_regs[R_EDX]); set_cc_op(s, CC_OP_MULQ); break; #endif break; case 6: /* div */ switch(ot) { case MO_8: gen_helper_divb_AL(cpu_env, cpu_T0); break; case MO_16: gen_helper_divw_AX(cpu_env, cpu_T0); break; default: case MO_32: gen_helper_divl_EAX(cpu_env, cpu_T0); break; #ifdef TARGET_X86_64 case MO_64: gen_helper_divq_EAX(cpu_env, cpu_T0); break; #endif break; case 7: /* idiv */ switch(ot) { case MO_8: gen_helper_idivb_AL(cpu_env, cpu_T0); break; case MO_16: gen_helper_idivw_AX(cpu_env, cpu_T0); break; default: case MO_32: gen_helper_idivl_EAX(cpu_env, cpu_T0); break; #ifdef TARGET_X86_64 case MO_64: gen_helper_idivq_EAX(cpu_env, cpu_T0); break; #endif break; default: goto unknown_op; break; case 0xfe: /* GRP4 */ case 0xff: /* GRP5 */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); op = (modrm >> 3) & 7; if (op >= 2 && b == 0xfe) { goto unknown_op; if (CODE64(s)) { if (op == 2 || op == 4) { /* operand size for jumps is 64 bit */ ot = MO_64; } else if (op == 3 || op == 5) { ot = dflag != MO_16 ? MO_32 + (rex_w == 1) : MO_16; } else if (op == 6) { /* default push size is 64 bit */ ot = mo_pushpop(s, dflag); if (mod != 3) { gen_lea_modrm(env, s, modrm); if (op >= 2 && op != 3 && op != 5) gen_op_ld_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_v_reg(ot, cpu_T0, rm); switch(op) { case 0: /* inc Ev */ if (mod != 3) opreg = OR_TMP0; else opreg = rm; gen_inc(s, ot, opreg, 1); break; case 1: /* dec Ev */ if (mod != 3) opreg = OR_TMP0; else opreg = rm; gen_inc(s, ot, opreg, -1); break; case 2: /* call Ev */ /* XXX: optimize if memory (no 'and' is necessary) */ if (dflag == MO_16) { tcg_gen_ext16u_tl(cpu_T0, cpu_T0); next_eip = s->pc - s->cs_base; tcg_gen_movi_tl(cpu_T1, next_eip); gen_push_v(s, cpu_T1); gen_op_jmp_v(cpu_T0); gen_bnd_jmp(s); gen_jr(s, cpu_T0); break; case 3: /* lcall Ev */ gen_op_ld_v(s, ot, cpu_T1, cpu_A0); gen_add_A0_im(s, 1 << ot); gen_op_ld_v(s, MO_16, cpu_T0, cpu_A0); do_lcall: if (s->pe && !s->vm86) { tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_lcall_protected(cpu_env, cpu_tmp2_i32, cpu_T1, tcg_const_i32(dflag - 1), tcg_const_tl(s->pc - s->cs_base)); } else { tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_lcall_real(cpu_env, cpu_tmp2_i32, cpu_T1, tcg_const_i32(dflag - 1), tcg_const_i32(s->pc - s->cs_base)); tcg_gen_ld_tl(cpu_tmp4, cpu_env, offsetof(CPUX86State, eip)); gen_jr(s, cpu_tmp4); break; case 4: /* jmp Ev */ if (dflag == MO_16) { tcg_gen_ext16u_tl(cpu_T0, cpu_T0); gen_op_jmp_v(cpu_T0); gen_bnd_jmp(s); gen_jr(s, cpu_T0); break; case 5: /* ljmp Ev */ gen_op_ld_v(s, ot, cpu_T1, cpu_A0); gen_add_A0_im(s, 1 << ot); gen_op_ld_v(s, MO_16, cpu_T0, cpu_A0); do_ljmp: if (s->pe && !s->vm86) { tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_ljmp_protected(cpu_env, cpu_tmp2_i32, cpu_T1, tcg_const_tl(s->pc - s->cs_base)); } else { gen_op_movl_seg_T0_vm(R_CS); gen_op_jmp_v(cpu_T1); tcg_gen_ld_tl(cpu_tmp4, cpu_env, offsetof(CPUX86State, eip)); gen_jr(s, cpu_tmp4); break; case 6: /* push Ev */ gen_push_v(s, cpu_T0); break; default: goto unknown_op; break; case 0x84: /* test Ev, Gv */ case 0x85: ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0); gen_op_mov_v_reg(ot, cpu_T1, reg); gen_op_testl_T0_T1_cc(); set_cc_op(s, CC_OP_LOGICB + ot); break; case 0xa8: /* test eAX, Iv */ case 0xa9: ot = mo_b_d(b, dflag); val = insn_get(env, s, ot); gen_op_mov_v_reg(ot, cpu_T0, OR_EAX); tcg_gen_movi_tl(cpu_T1, val); gen_op_testl_T0_T1_cc(); set_cc_op(s, CC_OP_LOGICB + ot); break; case 0x98: /* CWDE/CBW */ switch (dflag) { #ifdef TARGET_X86_64 case MO_64: gen_op_mov_v_reg(MO_32, cpu_T0, R_EAX); tcg_gen_ext32s_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_64, R_EAX, cpu_T0); break; #endif case MO_32: gen_op_mov_v_reg(MO_16, cpu_T0, R_EAX); tcg_gen_ext16s_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_32, R_EAX, cpu_T0); break; case MO_16: gen_op_mov_v_reg(MO_8, cpu_T0, R_EAX); tcg_gen_ext8s_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); break; default: tcg_abort(); break; case 0x99: /* CDQ/CWD */ switch (dflag) { #ifdef TARGET_X86_64 case MO_64: gen_op_mov_v_reg(MO_64, cpu_T0, R_EAX); tcg_gen_sari_tl(cpu_T0, cpu_T0, 63); gen_op_mov_reg_v(MO_64, R_EDX, cpu_T0); break; #endif case MO_32: gen_op_mov_v_reg(MO_32, cpu_T0, R_EAX); tcg_gen_ext32s_tl(cpu_T0, cpu_T0); tcg_gen_sari_tl(cpu_T0, cpu_T0, 31); gen_op_mov_reg_v(MO_32, R_EDX, cpu_T0); break; case MO_16: gen_op_mov_v_reg(MO_16, cpu_T0, R_EAX); tcg_gen_ext16s_tl(cpu_T0, cpu_T0); tcg_gen_sari_tl(cpu_T0, cpu_T0, 15); gen_op_mov_reg_v(MO_16, R_EDX, cpu_T0); break; default: tcg_abort(); break; case 0x1af: /* imul Gv, Ev */ case 0x69: /* imul Gv, Ev, I */ case 0x6b: ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; if (b == 0x69) s->rip_offset = insn_const_size(ot); else if (b == 0x6b) s->rip_offset = 1; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0); if (b == 0x69) { val = insn_get(env, s, ot); tcg_gen_movi_tl(cpu_T1, val); } else if (b == 0x6b) { val = (int8_t)insn_get(env, s, MO_8); tcg_gen_movi_tl(cpu_T1, val); } else { gen_op_mov_v_reg(ot, cpu_T1, reg); switch (ot) { #ifdef TARGET_X86_64 case MO_64: tcg_gen_muls2_i64(cpu_regs[reg], cpu_T1, cpu_T0, cpu_T1); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[reg]); tcg_gen_sari_tl(cpu_cc_src, cpu_cc_dst, 63); tcg_gen_sub_tl(cpu_cc_src, cpu_cc_src, cpu_T1); break; #endif case MO_32: tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T1); tcg_gen_muls2_i32(cpu_tmp2_i32, cpu_tmp3_i32, cpu_tmp2_i32, cpu_tmp3_i32); tcg_gen_extu_i32_tl(cpu_regs[reg], cpu_tmp2_i32); tcg_gen_sari_i32(cpu_tmp2_i32, cpu_tmp2_i32, 31); tcg_gen_mov_tl(cpu_cc_dst, cpu_regs[reg]); tcg_gen_sub_i32(cpu_tmp2_i32, cpu_tmp2_i32, cpu_tmp3_i32); tcg_gen_extu_i32_tl(cpu_cc_src, cpu_tmp2_i32); break; default: tcg_gen_ext16s_tl(cpu_T0, cpu_T0); tcg_gen_ext16s_tl(cpu_T1, cpu_T1); /* XXX: use 32 bit mul which could be faster */ tcg_gen_mul_tl(cpu_T0, cpu_T0, cpu_T1); tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); tcg_gen_ext16s_tl(cpu_tmp0, cpu_T0); tcg_gen_sub_tl(cpu_cc_src, cpu_T0, cpu_tmp0); gen_op_mov_reg_v(ot, reg, cpu_T0); break; set_cc_op(s, CC_OP_MULB + ot); break; case 0x1c0: case 0x1c1: /* xadd Ev, Gv */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; gen_op_mov_v_reg(ot, cpu_T0, reg); if (mod == 3) { rm = (modrm & 7) | REX_B(s); gen_op_mov_v_reg(ot, cpu_T1, rm); tcg_gen_add_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_mov_reg_v(ot, reg, cpu_T1); gen_op_mov_reg_v(ot, rm, cpu_T0); } else { gen_lea_modrm(env, s, modrm); if (s->prefix & PREFIX_LOCK) { tcg_gen_atomic_fetch_add_tl(cpu_T1, cpu_A0, cpu_T0, s->mem_index, ot | MO_LE); tcg_gen_add_tl(cpu_T0, cpu_T0, cpu_T1); } else { gen_op_ld_v(s, ot, cpu_T1, cpu_A0); tcg_gen_add_tl(cpu_T0, cpu_T0, cpu_T1); gen_op_st_v(s, ot, cpu_T0, cpu_A0); gen_op_mov_reg_v(ot, reg, cpu_T1); gen_op_update2_cc(); set_cc_op(s, CC_OP_ADDB + ot); break; case 0x1b0: case 0x1b1: /* cmpxchg Ev, Gv */ { TCGv oldv, newv, cmpv; ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; oldv = tcg_temp_new(); newv = tcg_temp_new(); cmpv = tcg_temp_new(); gen_op_mov_v_reg(ot, newv, reg); tcg_gen_mov_tl(cmpv, cpu_regs[R_EAX]); if (s->prefix & PREFIX_LOCK) { if (mod == 3) { goto illegal_op; gen_lea_modrm(env, s, modrm); tcg_gen_atomic_cmpxchg_tl(oldv, cpu_A0, cmpv, newv, s->mem_index, ot | MO_LE); gen_op_mov_reg_v(ot, R_EAX, oldv); } else { if (mod == 3) { rm = (modrm & 7) | REX_B(s); gen_op_mov_v_reg(ot, oldv, rm); } else { gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, ot, oldv, cpu_A0); rm = 0; /* avoid warning */ gen_extu(ot, oldv); gen_extu(ot, cmpv); /* store value = (old == cmp ? new : old); */ tcg_gen_movcond_tl(TCG_COND_EQ, newv, oldv, cmpv, newv, oldv); if (mod == 3) { gen_op_mov_reg_v(ot, R_EAX, oldv); gen_op_mov_reg_v(ot, rm, newv); } else { /* Perform an unconditional store cycle like physical cpu; must be before changing accumulator to ensure idempotency if the store faults and the instruction is restarted */ gen_op_st_v(s, ot, newv, cpu_A0); gen_op_mov_reg_v(ot, R_EAX, oldv); tcg_gen_mov_tl(cpu_cc_src, oldv); tcg_gen_mov_tl(cpu_cc_srcT, cmpv); tcg_gen_sub_tl(cpu_cc_dst, cmpv, oldv); set_cc_op(s, CC_OP_SUBB + ot); tcg_temp_free(oldv); tcg_temp_free(newv); tcg_temp_free(cmpv); break; case 0x1c7: /* cmpxchg8b */ modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; if ((mod == 3) || ((modrm & 0x38) != 0x8)) goto illegal_op; #ifdef TARGET_X86_64 if (dflag == MO_64) { if (!(s->cpuid_ext_features & CPUID_EXT_CX16)) goto illegal_op; gen_lea_modrm(env, s, modrm); if ((s->prefix & PREFIX_LOCK) && parallel_cpus) { gen_helper_cmpxchg16b(cpu_env, cpu_A0); } else { gen_helper_cmpxchg16b_unlocked(cpu_env, cpu_A0); } else #endif { if (!(s->cpuid_features & CPUID_CX8)) goto illegal_op; gen_lea_modrm(env, s, modrm); if ((s->prefix & PREFIX_LOCK) && parallel_cpus) { gen_helper_cmpxchg8b(cpu_env, cpu_A0); } else { gen_helper_cmpxchg8b_unlocked(cpu_env, cpu_A0); set_cc_op(s, CC_OP_EFLAGS); break; /**************************/ /* push/pop */ case 0x50 ... 0x57: /* push */ gen_op_mov_v_reg(MO_32, cpu_T0, (b & 7) | REX_B(s)); gen_push_v(s, cpu_T0); break; case 0x58 ... 0x5f: /* pop */ ot = gen_pop_T0(s); /* NOTE: order is important for pop %sp */ gen_pop_update(s, ot); gen_op_mov_reg_v(ot, (b & 7) | REX_B(s), cpu_T0); break; case 0x60: /* pusha */ if (CODE64(s)) goto illegal_op; gen_pusha(s); break; case 0x61: /* popa */ if (CODE64(s)) goto illegal_op; gen_popa(s); break; case 0x68: /* push Iv */ case 0x6a: ot = mo_pushpop(s, dflag); if (b == 0x68) val = insn_get(env, s, ot); else val = (int8_t)insn_get(env, s, MO_8); tcg_gen_movi_tl(cpu_T0, val); gen_push_v(s, cpu_T0); break; case 0x8f: /* pop Ev */ modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; ot = gen_pop_T0(s); if (mod == 3) { /* NOTE: order is important for pop %sp */ gen_pop_update(s, ot); rm = (modrm & 7) | REX_B(s); gen_op_mov_reg_v(ot, rm, cpu_T0); } else { /* NOTE: order is important too for MMU exceptions */ s->popl_esp_hack = 1 << ot; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1); s->popl_esp_hack = 0; gen_pop_update(s, ot); break; case 0xc8: /* enter */ { int level; val = cpu_lduw_code(env, s->pc); s->pc += 2; level = cpu_ldub_code(env, s->pc++); gen_enter(s, val, level); break; case 0xc9: /* leave */ gen_leave(s); break; case 0x06: /* push es */ case 0x0e: /* push cs */ case 0x16: /* push ss */ case 0x1e: /* push ds */ if (CODE64(s)) goto illegal_op; gen_op_movl_T0_seg(b >> 3); gen_push_v(s, cpu_T0); break; case 0x1a0: /* push fs */ case 0x1a8: /* push gs */ gen_op_movl_T0_seg((b >> 3) & 7); gen_push_v(s, cpu_T0); break; case 0x07: /* pop es */ case 0x17: /* pop ss */ case 0x1f: /* pop ds */ if (CODE64(s)) goto illegal_op; reg = b >> 3; ot = gen_pop_T0(s); gen_movl_seg_T0(s, reg); gen_pop_update(s, ot); /* Note that reg == R_SS in gen_movl_seg_T0 always sets is_jmp. */ if (s->is_jmp) { gen_jmp_im(s->pc - s->cs_base); if (reg == R_SS) { s->tf = 0; gen_eob_inhibit_irq(s, true); } else { gen_eob(s); break; case 0x1a1: /* pop fs */ case 0x1a9: /* pop gs */ ot = gen_pop_T0(s); gen_movl_seg_T0(s, (b >> 3) & 7); gen_pop_update(s, ot); if (s->is_jmp) { gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; /**************************/ /* mov */ case 0x88: case 0x89: /* mov Gv, Ev */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; /* generate a generic store */ gen_ldst_modrm(env, s, modrm, ot, reg, 1); break; case 0xc6: case 0xc7: /* mov Ev, Iv */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; if (mod != 3) { s->rip_offset = insn_const_size(ot); gen_lea_modrm(env, s, modrm); val = insn_get(env, s, ot); tcg_gen_movi_tl(cpu_T0, val); if (mod != 3) { gen_op_st_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_reg_v(ot, (modrm & 7) | REX_B(s), cpu_T0); break; case 0x8a: case 0x8b: /* mov Ev, Gv */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0); gen_op_mov_reg_v(ot, reg, cpu_T0); break; case 0x8e: /* mov seg, Gv */ modrm = cpu_ldub_code(env, s->pc++); reg = (modrm >> 3) & 7; if (reg >= 6 || reg == R_CS) goto illegal_op; gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); gen_movl_seg_T0(s, reg); /* Note that reg == R_SS in gen_movl_seg_T0 always sets is_jmp. */ if (s->is_jmp) { gen_jmp_im(s->pc - s->cs_base); if (reg == R_SS) { s->tf = 0; gen_eob_inhibit_irq(s, true); } else { gen_eob(s); break; case 0x8c: /* mov Gv, seg */ modrm = cpu_ldub_code(env, s->pc++); reg = (modrm >> 3) & 7; mod = (modrm >> 6) & 3; if (reg >= 6) goto illegal_op; gen_op_movl_T0_seg(reg); ot = mod == 3 ? dflag : MO_16; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1); break; case 0x1b6: /* movzbS Gv, Eb */ case 0x1b7: /* movzwS Gv, Eb */ case 0x1be: /* movsbS Gv, Eb */ case 0x1bf: /* movswS Gv, Eb */ { TCGMemOp d_ot; TCGMemOp s_ot; /* d_ot is the size of destination */ d_ot = dflag; /* ot is the size of source */ ot = (b & 1) + MO_8; /* s_ot is the sign+size of source */ s_ot = b & 8 ? MO_SIGN | ot : ot; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); if (mod == 3) { if (s_ot == MO_SB && byte_reg_is_xH(rm)) { tcg_gen_sextract_tl(cpu_T0, cpu_regs[rm - 4], 8, 8); } else { gen_op_mov_v_reg(ot, cpu_T0, rm); switch (s_ot) { case MO_UB: tcg_gen_ext8u_tl(cpu_T0, cpu_T0); break; case MO_SB: tcg_gen_ext8s_tl(cpu_T0, cpu_T0); break; case MO_UW: tcg_gen_ext16u_tl(cpu_T0, cpu_T0); break; default: case MO_SW: tcg_gen_ext16s_tl(cpu_T0, cpu_T0); break; gen_op_mov_reg_v(d_ot, reg, cpu_T0); } else { gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, s_ot, cpu_T0, cpu_A0); gen_op_mov_reg_v(d_ot, reg, cpu_T0); break; case 0x8d: /* lea */ modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; if (mod == 3) goto illegal_op; reg = ((modrm >> 3) & 7) | rex_r; { AddressParts a = gen_lea_modrm_0(env, s, modrm); TCGv ea = gen_lea_modrm_1(a); gen_lea_v_seg(s, s->aflag, ea, -1, -1); gen_op_mov_reg_v(dflag, reg, cpu_A0); break; case 0xa0: /* mov EAX, Ov */ case 0xa1: case 0xa2: /* mov Ov, EAX */ case 0xa3: { target_ulong offset_addr; ot = mo_b_d(b, dflag); switch (s->aflag) { #ifdef TARGET_X86_64 case MO_64: offset_addr = cpu_ldq_code(env, s->pc); s->pc += 8; break; #endif default: offset_addr = insn_get(env, s, s->aflag); break; tcg_gen_movi_tl(cpu_A0, offset_addr); gen_add_A0_ds_seg(s); if ((b & 2) == 0) { gen_op_ld_v(s, ot, cpu_T0, cpu_A0); gen_op_mov_reg_v(ot, R_EAX, cpu_T0); } else { gen_op_mov_v_reg(ot, cpu_T0, R_EAX); gen_op_st_v(s, ot, cpu_T0, cpu_A0); break; case 0xd7: /* xlat */ tcg_gen_mov_tl(cpu_A0, cpu_regs[R_EBX]); tcg_gen_ext8u_tl(cpu_T0, cpu_regs[R_EAX]); tcg_gen_add_tl(cpu_A0, cpu_A0, cpu_T0); gen_extu(s->aflag, cpu_A0); gen_add_A0_ds_seg(s); gen_op_ld_v(s, MO_8, cpu_T0, cpu_A0); gen_op_mov_reg_v(MO_8, R_EAX, cpu_T0); break; case 0xb0 ... 0xb7: /* mov R, Ib */ val = insn_get(env, s, MO_8); tcg_gen_movi_tl(cpu_T0, val); gen_op_mov_reg_v(MO_8, (b & 7) | REX_B(s), cpu_T0); break; case 0xb8 ... 0xbf: /* mov R, Iv */ #ifdef TARGET_X86_64 if (dflag == MO_64) { uint64_t tmp; /* 64 bit case */ tmp = cpu_ldq_code(env, s->pc); s->pc += 8; reg = (b & 7) | REX_B(s); tcg_gen_movi_tl(cpu_T0, tmp); gen_op_mov_reg_v(MO_64, reg, cpu_T0); } else #endif { ot = dflag; val = insn_get(env, s, ot); reg = (b & 7) | REX_B(s); tcg_gen_movi_tl(cpu_T0, val); gen_op_mov_reg_v(ot, reg, cpu_T0); break; case 0x91 ... 0x97: /* xchg R, EAX */ do_xchg_reg_eax: ot = dflag; reg = (b & 7) | REX_B(s); rm = R_EAX; goto do_xchg_reg; case 0x86: case 0x87: /* xchg Ev, Gv */ ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; if (mod == 3) { rm = (modrm & 7) | REX_B(s); do_xchg_reg: gen_op_mov_v_reg(ot, cpu_T0, reg); gen_op_mov_v_reg(ot, cpu_T1, rm); gen_op_mov_reg_v(ot, rm, cpu_T0); gen_op_mov_reg_v(ot, reg, cpu_T1); } else { gen_lea_modrm(env, s, modrm); gen_op_mov_v_reg(ot, cpu_T0, reg); /* for xchg, lock is implicit */ tcg_gen_atomic_xchg_tl(cpu_T1, cpu_A0, cpu_T0, s->mem_index, ot | MO_LE); gen_op_mov_reg_v(ot, reg, cpu_T1); break; case 0xc4: /* les Gv */ /* In CODE64 this is VEX3; see above. */ op = R_ES; goto do_lxx; case 0xc5: /* lds Gv */ /* In CODE64 this is VEX2; see above. */ op = R_DS; goto do_lxx; case 0x1b2: /* lss Gv */ op = R_SS; goto do_lxx; case 0x1b4: /* lfs Gv */ op = R_FS; goto do_lxx; case 0x1b5: /* lgs Gv */ op = R_GS; do_lxx: ot = dflag != MO_16 ? MO_32 : MO_16; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; if (mod == 3) goto illegal_op; gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, ot, cpu_T1, cpu_A0); gen_add_A0_im(s, 1 << ot); /* load the segment first to handle exceptions properly */ gen_op_ld_v(s, MO_16, cpu_T0, cpu_A0); gen_movl_seg_T0(s, op); /* then put the data */ gen_op_mov_reg_v(ot, reg, cpu_T1); if (s->is_jmp) { gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; /************************/ /* shifts */ case 0xc0: case 0xc1: /* shift Ev,Ib */ shift = 2; grp2: { ot = mo_b_d(b, dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; op = (modrm >> 3) & 7; if (mod != 3) { if (shift == 2) { s->rip_offset = 1; gen_lea_modrm(env, s, modrm); opreg = OR_TMP0; } else { opreg = (modrm & 7) | REX_B(s); /* simpler op */ if (shift == 0) { gen_shift(s, op, ot, opreg, OR_ECX); } else { if (shift == 2) { shift = cpu_ldub_code(env, s->pc++); gen_shifti(s, op, ot, opreg, shift); break; case 0xd0: case 0xd1: /* shift Ev,1 */ shift = 1; goto grp2; case 0xd2: case 0xd3: /* shift Ev,cl */ shift = 0; goto grp2; case 0x1a4: /* shld imm */ op = 0; shift = 1; goto do_shiftd; case 0x1a5: /* shld cl */ op = 0; shift = 0; goto do_shiftd; case 0x1ac: /* shrd imm */ op = 1; shift = 1; goto do_shiftd; case 0x1ad: /* shrd cl */ op = 1; shift = 0; do_shiftd: ot = dflag; modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); reg = ((modrm >> 3) & 7) | rex_r; if (mod != 3) { gen_lea_modrm(env, s, modrm); opreg = OR_TMP0; } else { opreg = rm; gen_op_mov_v_reg(ot, cpu_T1, reg); if (shift) { TCGv imm = tcg_const_tl(cpu_ldub_code(env, s->pc++)); gen_shiftd_rm_T1(s, ot, opreg, op, imm); tcg_temp_free(imm); } else { gen_shiftd_rm_T1(s, ot, opreg, op, cpu_regs[R_ECX]); break; /************************/ /* floats */ case 0xd8 ... 0xdf: if (s->flags & (HF_EM_MASK | HF_TS_MASK)) { /* if CR0.EM or CR0.TS are set, generate an FPU exception */ /* XXX: what to do if illegal op ? */ gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; rm = modrm & 7; op = ((b & 7) << 3) | ((modrm >> 3) & 7); if (mod != 3) { /* memory op */ gen_lea_modrm(env, s, modrm); switch(op) { case 0x00 ... 0x07: /* fxxxs */ case 0x10 ... 0x17: /* fixxxl */ case 0x20 ... 0x27: /* fxxxl */ case 0x30 ... 0x37: /* fixxx */ { int op1; op1 = op & 7; switch(op >> 4) { case 0: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); gen_helper_flds_FT0(cpu_env, cpu_tmp2_i32); break; case 1: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); gen_helper_fildl_FT0(cpu_env, cpu_tmp2_i32); break; case 2: tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fldl_FT0(cpu_env, cpu_tmp1_i64); break; case 3: default: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LESW); gen_helper_fildl_FT0(cpu_env, cpu_tmp2_i32); break; gen_helper_fp_arith_ST0_FT0(op1); if (op1 == 3) { /* fcomp needs pop */ gen_helper_fpop(cpu_env); break; case 0x08: /* flds */ case 0x0a: /* fsts */ case 0x0b: /* fstps */ case 0x18 ... 0x1b: /* fildl, fisttpl, fistl, fistpl */ case 0x28 ... 0x2b: /* fldl, fisttpll, fstl, fstpl */ case 0x38 ... 0x3b: /* filds, fisttps, fists, fistps */ switch(op & 7) { case 0: switch(op >> 4) { case 0: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); gen_helper_flds_ST0(cpu_env, cpu_tmp2_i32); break; case 1: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); gen_helper_fildl_ST0(cpu_env, cpu_tmp2_i32); break; case 2: tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fldl_ST0(cpu_env, cpu_tmp1_i64); break; case 3: default: tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LESW); gen_helper_fildl_ST0(cpu_env, cpu_tmp2_i32); break; break; case 1: /* XXX: the corresponding CPUID bit must be tested ! */ switch(op >> 4) { case 1: gen_helper_fisttl_ST0(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); break; case 2: gen_helper_fisttll_ST0(cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); break; case 3: default: gen_helper_fistt_ST0(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUW); break; gen_helper_fpop(cpu_env); break; default: switch(op >> 4) { case 0: gen_helper_fsts_ST0(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); break; case 1: gen_helper_fistl_ST0(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); break; case 2: gen_helper_fstl_ST0(cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); break; case 3: default: gen_helper_fist_ST0(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUW); break; if ((op & 7) == 3) gen_helper_fpop(cpu_env); break; break; case 0x0c: /* fldenv mem */ gen_helper_fldenv(cpu_env, cpu_A0, tcg_const_i32(dflag - 1)); break; case 0x0d: /* fldcw mem */ tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUW); gen_helper_fldcw(cpu_env, cpu_tmp2_i32); break; case 0x0e: /* fnstenv mem */ gen_helper_fstenv(cpu_env, cpu_A0, tcg_const_i32(dflag - 1)); break; case 0x0f: /* fnstcw mem */ gen_helper_fnstcw(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUW); break; case 0x1d: /* fldt mem */ gen_helper_fldt_ST0(cpu_env, cpu_A0); break; case 0x1f: /* fstpt mem */ gen_helper_fstt_ST0(cpu_env, cpu_A0); gen_helper_fpop(cpu_env); break; case 0x2c: /* frstor mem */ gen_helper_frstor(cpu_env, cpu_A0, tcg_const_i32(dflag - 1)); break; case 0x2e: /* fnsave mem */ gen_helper_fsave(cpu_env, cpu_A0, tcg_const_i32(dflag - 1)); break; case 0x2f: /* fnstsw mem */ gen_helper_fnstsw(cpu_tmp2_i32, cpu_env); tcg_gen_qemu_st_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUW); break; case 0x3c: /* fbld */ gen_helper_fbld_ST0(cpu_env, cpu_A0); break; case 0x3e: /* fbstp */ gen_helper_fbst_ST0(cpu_env, cpu_A0); gen_helper_fpop(cpu_env); break; case 0x3d: /* fildll */ tcg_gen_qemu_ld_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fildll_ST0(cpu_env, cpu_tmp1_i64); break; case 0x3f: /* fistpll */ gen_helper_fistll_ST0(cpu_tmp1_i64, cpu_env); tcg_gen_qemu_st_i64(cpu_tmp1_i64, cpu_A0, s->mem_index, MO_LEQ); gen_helper_fpop(cpu_env); break; default: goto unknown_op; } else { /* register float ops */ opreg = rm; switch(op) { case 0x08: /* fld sti */ gen_helper_fpush(cpu_env); gen_helper_fmov_ST0_STN(cpu_env, tcg_const_i32((opreg + 1) & 7)); break; case 0x09: /* fxchg sti */ case 0x29: /* fxchg4 sti, undocumented op */ case 0x39: /* fxchg7 sti, undocumented op */ gen_helper_fxchg_ST0_STN(cpu_env, tcg_const_i32(opreg)); break; case 0x0a: /* grp d9/2 */ switch(rm) { case 0: /* fnop */ /* check exceptions (FreeBSD FPU probe) */ gen_helper_fwait(cpu_env); break; default: goto unknown_op; break; case 0x0c: /* grp d9/4 */ switch(rm) { case 0: /* fchs */ gen_helper_fchs_ST0(cpu_env); break; case 1: /* fabs */ gen_helper_fabs_ST0(cpu_env); break; case 4: /* ftst */ gen_helper_fldz_FT0(cpu_env); gen_helper_fcom_ST0_FT0(cpu_env); break; case 5: /* fxam */ gen_helper_fxam_ST0(cpu_env); break; default: goto unknown_op; break; case 0x0d: /* grp d9/5 */ { switch(rm) { case 0: gen_helper_fpush(cpu_env); gen_helper_fld1_ST0(cpu_env); break; case 1: gen_helper_fpush(cpu_env); gen_helper_fldl2t_ST0(cpu_env); break; case 2: gen_helper_fpush(cpu_env); gen_helper_fldl2e_ST0(cpu_env); break; case 3: gen_helper_fpush(cpu_env); gen_helper_fldpi_ST0(cpu_env); break; case 4: gen_helper_fpush(cpu_env); gen_helper_fldlg2_ST0(cpu_env); break; case 5: gen_helper_fpush(cpu_env); gen_helper_fldln2_ST0(cpu_env); break; case 6: gen_helper_fpush(cpu_env); gen_helper_fldz_ST0(cpu_env); break; default: goto unknown_op; break; case 0x0e: /* grp d9/6 */ switch(rm) { case 0: /* f2xm1 */ gen_helper_f2xm1(cpu_env); break; case 1: /* fyl2x */ gen_helper_fyl2x(cpu_env); break; case 2: /* fptan */ gen_helper_fptan(cpu_env); break; case 3: /* fpatan */ gen_helper_fpatan(cpu_env); break; case 4: /* fxtract */ gen_helper_fxtract(cpu_env); break; case 5: /* fprem1 */ gen_helper_fprem1(cpu_env); break; case 6: /* fdecstp */ gen_helper_fdecstp(cpu_env); break; default: case 7: /* fincstp */ gen_helper_fincstp(cpu_env); break; break; case 0x0f: /* grp d9/7 */ switch(rm) { case 0: /* fprem */ gen_helper_fprem(cpu_env); break; case 1: /* fyl2xp1 */ gen_helper_fyl2xp1(cpu_env); break; case 2: /* fsqrt */ gen_helper_fsqrt(cpu_env); break; case 3: /* fsincos */ gen_helper_fsincos(cpu_env); break; case 5: /* fscale */ gen_helper_fscale(cpu_env); break; case 4: /* frndint */ gen_helper_frndint(cpu_env); break; case 6: /* fsin */ gen_helper_fsin(cpu_env); break; default: case 7: /* fcos */ gen_helper_fcos(cpu_env); break; break; case 0x00: case 0x01: case 0x04 ... 0x07: /* fxxx st, sti */ case 0x20: case 0x21: case 0x24 ... 0x27: /* fxxx sti, st */ case 0x30: case 0x31: case 0x34 ... 0x37: /* fxxxp sti, st */ { int op1; op1 = op & 7; if (op >= 0x20) { gen_helper_fp_arith_STN_ST0(op1, opreg); if (op >= 0x30) gen_helper_fpop(cpu_env); } else { gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fp_arith_ST0_FT0(op1); break; case 0x02: /* fcom */ case 0x22: /* fcom2, undocumented op */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fcom_ST0_FT0(cpu_env); break; case 0x03: /* fcomp */ case 0x23: /* fcomp3, undocumented op */ case 0x32: /* fcomp5, undocumented op */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fcom_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); break; case 0x15: /* da/5 */ switch(rm) { case 1: /* fucompp */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(1)); gen_helper_fucom_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); gen_helper_fpop(cpu_env); break; default: goto unknown_op; break; case 0x1c: switch(rm) { case 0: /* feni (287 only, just do nop here) */ break; case 1: /* fdisi (287 only, just do nop here) */ break; case 2: /* fclex */ gen_helper_fclex(cpu_env); break; case 3: /* fninit */ gen_helper_fninit(cpu_env); break; case 4: /* fsetpm (287 only, just do nop here) */ break; default: goto unknown_op; break; case 0x1d: /* fucomi */ if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; gen_update_cc_op(s); gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fucomi_ST0_FT0(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x1e: /* fcomi */ if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; gen_update_cc_op(s); gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fcomi_ST0_FT0(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x28: /* ffree sti */ gen_helper_ffree_STN(cpu_env, tcg_const_i32(opreg)); break; case 0x2a: /* fst sti */ gen_helper_fmov_STN_ST0(cpu_env, tcg_const_i32(opreg)); break; case 0x2b: /* fstp sti */ case 0x0b: /* fstp1 sti, undocumented op */ case 0x3a: /* fstp8 sti, undocumented op */ case 0x3b: /* fstp9 sti, undocumented op */ gen_helper_fmov_STN_ST0(cpu_env, tcg_const_i32(opreg)); gen_helper_fpop(cpu_env); break; case 0x2c: /* fucom st(i) */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fucom_ST0_FT0(cpu_env); break; case 0x2d: /* fucomp st(i) */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fucom_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); break; case 0x33: /* de/3 */ switch(rm) { case 1: /* fcompp */ gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(1)); gen_helper_fcom_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); gen_helper_fpop(cpu_env); break; default: goto unknown_op; break; case 0x38: /* ffreep sti, undocumented op */ gen_helper_ffree_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fpop(cpu_env); break; case 0x3c: /* df/4 */ switch(rm) { case 0: gen_helper_fnstsw(cpu_tmp2_i32, cpu_env); tcg_gen_extu_i32_tl(cpu_T0, cpu_tmp2_i32); gen_op_mov_reg_v(MO_16, R_EAX, cpu_T0); break; default: goto unknown_op; break; case 0x3d: /* fucomip */ if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; gen_update_cc_op(s); gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fucomi_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x3e: /* fcomip */ if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; gen_update_cc_op(s); gen_helper_fmov_FT0_STN(cpu_env, tcg_const_i32(opreg)); gen_helper_fcomi_ST0_FT0(cpu_env); gen_helper_fpop(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x10 ... 0x13: /* fcmovxx */ case 0x18 ... 0x1b: { int op1; TCGLabel *l1; static const uint8_t fcmov_cc[8] = { (JCC_B << 1), (JCC_Z << 1), (JCC_BE << 1), (JCC_P << 1), }; if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; op1 = fcmov_cc[op & 3] | (((op >> 3) & 1) ^ 1); l1 = gen_new_label(); gen_jcc1_noeob(s, op1, l1); gen_helper_fmov_ST0_STN(cpu_env, tcg_const_i32(opreg)); gen_set_label(l1); break; default: goto unknown_op; break; /************************/ /* string ops */ case 0xa4: /* movsS */ case 0xa5: ot = mo_b_d(b, dflag); if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_movs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { gen_movs(s, ot); break; case 0xaa: /* stosS */ case 0xab: ot = mo_b_d(b, dflag); if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_stos(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { gen_stos(s, ot); break; case 0xac: /* lodsS */ case 0xad: ot = mo_b_d(b, dflag); if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_lods(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { gen_lods(s, ot); break; case 0xae: /* scasS */ case 0xaf: ot = mo_b_d(b, dflag); if (prefixes & PREFIX_REPNZ) { gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1); } else if (prefixes & PREFIX_REPZ) { gen_repz_scas(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0); } else { gen_scas(s, ot); break; case 0xa6: /* cmpsS */ case 0xa7: ot = mo_b_d(b, dflag); if (prefixes & PREFIX_REPNZ) { gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 1); } else if (prefixes & PREFIX_REPZ) { gen_repz_cmps(s, ot, pc_start - s->cs_base, s->pc - s->cs_base, 0); } else { gen_cmps(s, ot); break; case 0x6c: /* insS */ case 0x6d: ot = mo_b_d32(b, dflag); tcg_gen_ext16u_tl(cpu_T0, cpu_regs[R_EDX]); gen_check_io(s, ot, pc_start - s->cs_base, SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes) | 4); if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_ins(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { gen_ins(s, ot); gen_jmp(s, s->pc - s->cs_base); break; case 0x6e: /* outsS */ case 0x6f: ot = mo_b_d32(b, dflag); tcg_gen_ext16u_tl(cpu_T0, cpu_regs[R_EDX]); gen_check_io(s, ot, pc_start - s->cs_base, svm_is_rep(prefixes) | 4); if (prefixes & (PREFIX_REPZ | PREFIX_REPNZ)) { gen_repz_outs(s, ot, pc_start - s->cs_base, s->pc - s->cs_base); } else { gen_outs(s, ot); gen_jmp(s, s->pc - s->cs_base); break; /************************/ /* port I/O */ case 0xe4: case 0xe5: ot = mo_b_d32(b, dflag); val = cpu_ldub_code(env, s->pc++); tcg_gen_movi_tl(cpu_T0, val); gen_check_io(s, ot, pc_start - s->cs_base, SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes)); tcg_gen_movi_i32(cpu_tmp2_i32, val); gen_helper_in_func(ot, cpu_T1, cpu_tmp2_i32); gen_op_mov_reg_v(ot, R_EAX, cpu_T1); gen_bpt_io(s, cpu_tmp2_i32, ot); gen_jmp(s, s->pc - s->cs_base); break; case 0xe6: case 0xe7: ot = mo_b_d32(b, dflag); val = cpu_ldub_code(env, s->pc++); tcg_gen_movi_tl(cpu_T0, val); gen_check_io(s, ot, pc_start - s->cs_base, svm_is_rep(prefixes)); gen_op_mov_v_reg(ot, cpu_T1, R_EAX); tcg_gen_movi_i32(cpu_tmp2_i32, val); tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T1); gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32); gen_bpt_io(s, cpu_tmp2_i32, ot); gen_jmp(s, s->pc - s->cs_base); break; case 0xec: case 0xed: ot = mo_b_d32(b, dflag); tcg_gen_ext16u_tl(cpu_T0, cpu_regs[R_EDX]); gen_check_io(s, ot, pc_start - s->cs_base, SVM_IOIO_TYPE_MASK | svm_is_rep(prefixes)); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_in_func(ot, cpu_T1, cpu_tmp2_i32); gen_op_mov_reg_v(ot, R_EAX, cpu_T1); gen_bpt_io(s, cpu_tmp2_i32, ot); gen_jmp(s, s->pc - s->cs_base); break; case 0xee: case 0xef: ot = mo_b_d32(b, dflag); tcg_gen_ext16u_tl(cpu_T0, cpu_regs[R_EDX]); gen_check_io(s, ot, pc_start - s->cs_base, svm_is_rep(prefixes)); gen_op_mov_v_reg(ot, cpu_T1, R_EAX); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); tcg_gen_trunc_tl_i32(cpu_tmp3_i32, cpu_T1); gen_helper_out_func(ot, cpu_tmp2_i32, cpu_tmp3_i32); gen_bpt_io(s, cpu_tmp2_i32, ot); gen_jmp(s, s->pc - s->cs_base); break; /************************/ /* control */ case 0xc2: /* ret im */ val = cpu_ldsw_code(env, s->pc); s->pc += 2; ot = gen_pop_T0(s); gen_stack_update(s, val + (1 << ot)); /* Note that gen_pop_T0 uses a zero-extending load. */ gen_op_jmp_v(cpu_T0); gen_bnd_jmp(s); gen_jr(s, cpu_T0); break; case 0xc3: /* ret */ ot = gen_pop_T0(s); gen_pop_update(s, ot); /* Note that gen_pop_T0 uses a zero-extending load. */ gen_op_jmp_v(cpu_T0); gen_bnd_jmp(s); gen_jr(s, cpu_T0); break; case 0xca: /* lret im */ val = cpu_ldsw_code(env, s->pc); s->pc += 2; do_lret: if (s->pe && !s->vm86) { gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_lret_protected(cpu_env, tcg_const_i32(dflag - 1), tcg_const_i32(val)); } else { gen_stack_A0(s); /* pop offset */ gen_op_ld_v(s, dflag, cpu_T0, cpu_A0); /* NOTE: keeping EIP updated is not a problem in case of exception */ gen_op_jmp_v(cpu_T0); /* pop selector */ gen_add_A0_im(s, 1 << dflag); gen_op_ld_v(s, dflag, cpu_T0, cpu_A0); gen_op_movl_seg_T0_vm(R_CS); /* add stack offset */ gen_stack_update(s, val + (2 << dflag)); gen_eob(s); break; case 0xcb: /* lret */ val = 0; goto do_lret; case 0xcf: /* iret */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_IRET); if (!s->pe) { /* real mode */ gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1)); set_cc_op(s, CC_OP_EFLAGS); } else if (s->vm86) { if (s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_helper_iret_real(cpu_env, tcg_const_i32(dflag - 1)); set_cc_op(s, CC_OP_EFLAGS); } else { gen_helper_iret_protected(cpu_env, tcg_const_i32(dflag - 1), tcg_const_i32(s->pc - s->cs_base)); set_cc_op(s, CC_OP_EFLAGS); gen_eob(s); break; case 0xe8: /* call im */ { if (dflag != MO_16) { tval = (int32_t)insn_get(env, s, MO_32); } else { tval = (int16_t)insn_get(env, s, MO_16); next_eip = s->pc - s->cs_base; tval += next_eip; if (dflag == MO_16) { tval &= 0xffff; } else if (!CODE64(s)) { tval &= 0xffffffff; tcg_gen_movi_tl(cpu_T0, next_eip); gen_push_v(s, cpu_T0); gen_bnd_jmp(s); gen_jmp(s, tval); break; case 0x9a: /* lcall im */ { unsigned int selector, offset; if (CODE64(s)) goto illegal_op; ot = dflag; offset = insn_get(env, s, ot); selector = insn_get(env, s, MO_16); tcg_gen_movi_tl(cpu_T0, selector); tcg_gen_movi_tl(cpu_T1, offset); goto do_lcall; case 0xe9: /* jmp im */ if (dflag != MO_16) { tval = (int32_t)insn_get(env, s, MO_32); } else { tval = (int16_t)insn_get(env, s, MO_16); tval += s->pc - s->cs_base; if (dflag == MO_16) { tval &= 0xffff; } else if (!CODE64(s)) { tval &= 0xffffffff; gen_bnd_jmp(s); gen_jmp(s, tval); break; case 0xea: /* ljmp im */ { unsigned int selector, offset; if (CODE64(s)) goto illegal_op; ot = dflag; offset = insn_get(env, s, ot); selector = insn_get(env, s, MO_16); tcg_gen_movi_tl(cpu_T0, selector); tcg_gen_movi_tl(cpu_T1, offset); goto do_ljmp; case 0xeb: /* jmp Jb */ tval = (int8_t)insn_get(env, s, MO_8); tval += s->pc - s->cs_base; if (dflag == MO_16) { tval &= 0xffff; gen_jmp(s, tval); break; case 0x70 ... 0x7f: /* jcc Jb */ tval = (int8_t)insn_get(env, s, MO_8); goto do_jcc; case 0x180 ... 0x18f: /* jcc Jv */ if (dflag != MO_16) { tval = (int32_t)insn_get(env, s, MO_32); } else { tval = (int16_t)insn_get(env, s, MO_16); do_jcc: next_eip = s->pc - s->cs_base; tval += next_eip; if (dflag == MO_16) { tval &= 0xffff; gen_bnd_jmp(s); gen_jcc(s, b, tval, next_eip); break; case 0x190 ... 0x19f: /* setcc Gv */ modrm = cpu_ldub_code(env, s->pc++); gen_setcc1(s, b, cpu_T0); gen_ldst_modrm(env, s, modrm, MO_8, OR_TMP0, 1); break; case 0x140 ... 0x14f: /* cmov Gv, Ev */ if (!(s->cpuid_features & CPUID_CMOV)) { goto illegal_op; ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; gen_cmovcc1(env, s, ot, b, modrm, reg); break; /************************/ /* flags */ case 0x9c: /* pushf */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_PUSHF); if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_update_cc_op(s); gen_helper_read_eflags(cpu_T0, cpu_env); gen_push_v(s, cpu_T0); break; case 0x9d: /* popf */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_POPF); if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { ot = gen_pop_T0(s); if (s->cpl == 0) { if (dflag != MO_16) { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK | IF_MASK | IOPL_MASK))); } else { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK | IF_MASK | IOPL_MASK) & 0xffff)); } else { if (s->cpl <= s->iopl) { if (dflag != MO_16) { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK | IF_MASK))); } else { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK | IF_MASK) & 0xffff)); } else { if (dflag != MO_16) { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK))); } else { gen_helper_write_eflags(cpu_env, cpu_T0, tcg_const_i32((TF_MASK | AC_MASK | ID_MASK | NT_MASK) & 0xffff)); gen_pop_update(s, ot); set_cc_op(s, CC_OP_EFLAGS); /* abort translation because TF/AC flag may change */ gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; case 0x9e: /* sahf */ if (CODE64(s) && !(s->cpuid_ext3_features & CPUID_EXT3_LAHF_LM)) goto illegal_op; gen_op_mov_v_reg(MO_8, cpu_T0, R_AH); gen_compute_eflags(s); tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, CC_O); tcg_gen_andi_tl(cpu_T0, cpu_T0, CC_S | CC_Z | CC_A | CC_P | CC_C); tcg_gen_or_tl(cpu_cc_src, cpu_cc_src, cpu_T0); break; case 0x9f: /* lahf */ if (CODE64(s) && !(s->cpuid_ext3_features & CPUID_EXT3_LAHF_LM)) goto illegal_op; gen_compute_eflags(s); /* Note: gen_compute_eflags() only gives the condition codes */ tcg_gen_ori_tl(cpu_T0, cpu_cc_src, 0x02); gen_op_mov_reg_v(MO_8, R_AH, cpu_T0); break; case 0xf5: /* cmc */ gen_compute_eflags(s); tcg_gen_xori_tl(cpu_cc_src, cpu_cc_src, CC_C); break; case 0xf8: /* clc */ gen_compute_eflags(s); tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, ~CC_C); break; case 0xf9: /* stc */ gen_compute_eflags(s); tcg_gen_ori_tl(cpu_cc_src, cpu_cc_src, CC_C); break; case 0xfc: /* cld */ tcg_gen_movi_i32(cpu_tmp2_i32, 1); tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, offsetof(CPUX86State, df)); break; case 0xfd: /* std */ tcg_gen_movi_i32(cpu_tmp2_i32, -1); tcg_gen_st_i32(cpu_tmp2_i32, cpu_env, offsetof(CPUX86State, df)); break; /************************/ /* bit operations */ case 0x1ba: /* bt/bts/btr/btc Gv, im */ ot = dflag; modrm = cpu_ldub_code(env, s->pc++); op = (modrm >> 3) & 7; mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); if (mod != 3) { s->rip_offset = 1; gen_lea_modrm(env, s, modrm); if (!(s->prefix & PREFIX_LOCK)) { gen_op_ld_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_v_reg(ot, cpu_T0, rm); /* load shift */ val = cpu_ldub_code(env, s->pc++); tcg_gen_movi_tl(cpu_T1, val); if (op < 4) goto unknown_op; op -= 4; goto bt_op; case 0x1a3: /* bt Gv, Ev */ op = 0; goto do_btx; case 0x1ab: /* bts */ op = 1; goto do_btx; case 0x1b3: /* btr */ op = 2; goto do_btx; case 0x1bb: /* btc */ op = 3; do_btx: ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); gen_op_mov_v_reg(MO_32, cpu_T1, reg); if (mod != 3) { AddressParts a = gen_lea_modrm_0(env, s, modrm); /* specific case: we need to add a displacement */ gen_exts(ot, cpu_T1); tcg_gen_sari_tl(cpu_tmp0, cpu_T1, 3 + ot); tcg_gen_shli_tl(cpu_tmp0, cpu_tmp0, ot); tcg_gen_add_tl(cpu_A0, gen_lea_modrm_1(a), cpu_tmp0); gen_lea_v_seg(s, s->aflag, cpu_A0, a.def_seg, s->override); if (!(s->prefix & PREFIX_LOCK)) { gen_op_ld_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_v_reg(ot, cpu_T0, rm); bt_op: tcg_gen_andi_tl(cpu_T1, cpu_T1, (1 << (3 + ot)) - 1); tcg_gen_movi_tl(cpu_tmp0, 1); tcg_gen_shl_tl(cpu_tmp0, cpu_tmp0, cpu_T1); if (s->prefix & PREFIX_LOCK) { switch (op) { case 0: /* bt */ /* Needs no atomic ops; we surpressed the normal memory load for LOCK above so do it now. */ gen_op_ld_v(s, ot, cpu_T0, cpu_A0); break; case 1: /* bts */ tcg_gen_atomic_fetch_or_tl(cpu_T0, cpu_A0, cpu_tmp0, s->mem_index, ot | MO_LE); break; case 2: /* btr */ tcg_gen_not_tl(cpu_tmp0, cpu_tmp0); tcg_gen_atomic_fetch_and_tl(cpu_T0, cpu_A0, cpu_tmp0, s->mem_index, ot | MO_LE); break; default: case 3: /* btc */ tcg_gen_atomic_fetch_xor_tl(cpu_T0, cpu_A0, cpu_tmp0, s->mem_index, ot | MO_LE); break; tcg_gen_shr_tl(cpu_tmp4, cpu_T0, cpu_T1); } else { tcg_gen_shr_tl(cpu_tmp4, cpu_T0, cpu_T1); switch (op) { case 0: /* bt */ /* Data already loaded; nothing to do. */ break; case 1: /* bts */ tcg_gen_or_tl(cpu_T0, cpu_T0, cpu_tmp0); break; case 2: /* btr */ tcg_gen_andc_tl(cpu_T0, cpu_T0, cpu_tmp0); break; default: case 3: /* btc */ tcg_gen_xor_tl(cpu_T0, cpu_T0, cpu_tmp0); break; if (op != 0) { if (mod != 3) { gen_op_st_v(s, ot, cpu_T0, cpu_A0); } else { gen_op_mov_reg_v(ot, rm, cpu_T0); /* Delay all CC updates until after the store above. Note that C is the result of the test, Z is unchanged, and the others are all undefined. */ switch (s->cc_op) { case CC_OP_MULB ... CC_OP_MULQ: case CC_OP_ADDB ... CC_OP_ADDQ: case CC_OP_ADCB ... CC_OP_ADCQ: case CC_OP_SUBB ... CC_OP_SUBQ: case CC_OP_SBBB ... CC_OP_SBBQ: case CC_OP_LOGICB ... CC_OP_LOGICQ: case CC_OP_INCB ... CC_OP_INCQ: case CC_OP_DECB ... CC_OP_DECQ: case CC_OP_SHLB ... CC_OP_SHLQ: case CC_OP_SARB ... CC_OP_SARQ: case CC_OP_BMILGB ... CC_OP_BMILGQ: /* Z was going to be computed from the non-zero status of CC_DST. We can get that same Z value (and the new C value) by leaving CC_DST alone, setting CC_SRC, and using a CC_OP_SAR of the same width. */ tcg_gen_mov_tl(cpu_cc_src, cpu_tmp4); set_cc_op(s, ((s->cc_op - CC_OP_MULB) & 3) + CC_OP_SARB); break; default: /* Otherwise, generate EFLAGS and replace the C bit. */ gen_compute_eflags(s); tcg_gen_deposit_tl(cpu_cc_src, cpu_cc_src, cpu_tmp4, ctz32(CC_C), 1); break; break; case 0x1bc: /* bsf / tzcnt */ case 0x1bd: /* bsr / lzcnt */ ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0); gen_extu(ot, cpu_T0); /* Note that lzcnt and tzcnt are in different extensions. */ if ((prefixes & PREFIX_REPZ) && (b & 1 ? s->cpuid_ext3_features & CPUID_EXT3_ABM : s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_BMI1)) { int size = 8 << ot; /* For lzcnt/tzcnt, C bit is defined related to the input. */ tcg_gen_mov_tl(cpu_cc_src, cpu_T0); if (b & 1) { /* For lzcnt, reduce the target_ulong result by the number of zeros that we expect to find at the top. */ tcg_gen_clzi_tl(cpu_T0, cpu_T0, TARGET_LONG_BITS); tcg_gen_subi_tl(cpu_T0, cpu_T0, TARGET_LONG_BITS - size); } else { /* For tzcnt, a zero input must return the operand size. */ tcg_gen_ctzi_tl(cpu_T0, cpu_T0, size); /* For lzcnt/tzcnt, Z bit is defined related to the result. */ gen_op_update1_cc(); set_cc_op(s, CC_OP_BMILGB + ot); } else { /* For bsr/bsf, only the Z bit is defined and it is related to the input and not the result. */ tcg_gen_mov_tl(cpu_cc_dst, cpu_T0); set_cc_op(s, CC_OP_LOGICB + ot); /* ??? The manual says that the output is undefined when the input is zero, but real hardware leaves it unchanged, and real programs appear to depend on that. Accomplish this by passing the output as the value to return upon zero. */ if (b & 1) { /* For bsr, return the bit index of the first 1 bit, not the count of leading zeros. */ tcg_gen_xori_tl(cpu_T1, cpu_regs[reg], TARGET_LONG_BITS - 1); tcg_gen_clz_tl(cpu_T0, cpu_T0, cpu_T1); tcg_gen_xori_tl(cpu_T0, cpu_T0, TARGET_LONG_BITS - 1); } else { tcg_gen_ctz_tl(cpu_T0, cpu_T0, cpu_regs[reg]); gen_op_mov_reg_v(ot, reg, cpu_T0); break; /************************/ /* bcd */ case 0x27: /* daa */ if (CODE64(s)) goto illegal_op; gen_update_cc_op(s); gen_helper_daa(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x2f: /* das */ if (CODE64(s)) goto illegal_op; gen_update_cc_op(s); gen_helper_das(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x37: /* aaa */ if (CODE64(s)) goto illegal_op; gen_update_cc_op(s); gen_helper_aaa(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0x3f: /* aas */ if (CODE64(s)) goto illegal_op; gen_update_cc_op(s); gen_helper_aas(cpu_env); set_cc_op(s, CC_OP_EFLAGS); break; case 0xd4: /* aam */ if (CODE64(s)) goto illegal_op; val = cpu_ldub_code(env, s->pc++); if (val == 0) { gen_exception(s, EXCP00_DIVZ, pc_start - s->cs_base); } else { gen_helper_aam(cpu_env, tcg_const_i32(val)); set_cc_op(s, CC_OP_LOGICB); break; case 0xd5: /* aad */ if (CODE64(s)) goto illegal_op; val = cpu_ldub_code(env, s->pc++); gen_helper_aad(cpu_env, tcg_const_i32(val)); set_cc_op(s, CC_OP_LOGICB); break; /************************/ /* misc */ case 0x90: /* nop */ /* XXX: correct lock test for all insn */ if (prefixes & PREFIX_LOCK) { goto illegal_op; /* If REX_B is set, then this is xchg eax, r8d, not a nop. */ if (REX_B(s)) { goto do_xchg_reg_eax; if (prefixes & PREFIX_REPZ) { gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_pause(cpu_env, tcg_const_i32(s->pc - pc_start)); s->is_jmp = DISAS_TB_JUMP; break; case 0x9b: /* fwait */ if ((s->flags & (HF_MP_MASK | HF_TS_MASK)) == (HF_MP_MASK | HF_TS_MASK)) { gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); } else { gen_helper_fwait(cpu_env); break; case 0xcc: /* int3 */ gen_interrupt(s, EXCP03_INT3, pc_start - s->cs_base, s->pc - s->cs_base); break; case 0xcd: /* int N */ val = cpu_ldub_code(env, s->pc++); if (s->vm86 && s->iopl != 3) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_interrupt(s, val, pc_start - s->cs_base, s->pc - s->cs_base); break; case 0xce: /* into */ if (CODE64(s)) goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_into(cpu_env, tcg_const_i32(s->pc - pc_start)); break; #ifdef WANT_ICEBP case 0xf1: /* icebp (undocumented, exits to external debugger) */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_ICEBP); #if 1 gen_debug(s, pc_start - s->cs_base); #else /* start debug */ tb_flush(CPU(x86_env_get_cpu(env))); qemu_set_log(CPU_LOG_INT | CPU_LOG_TB_IN_ASM); #endif break; #endif case 0xfa: /* cli */ if (!s->vm86) { if (s->cpl <= s->iopl) { gen_helper_cli(cpu_env); } else { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { if (s->iopl == 3) { gen_helper_cli(cpu_env); } else { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; case 0xfb: /* sti */ if (s->vm86 ? s->iopl == 3 : s->cpl <= s->iopl) { gen_helper_sti(cpu_env); /* interruptions are enabled only the first insn after sti */ gen_jmp_im(s->pc - s->cs_base); gen_eob_inhibit_irq(s, true); } else { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; case 0x62: /* bound */ if (CODE64(s)) goto illegal_op; ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = (modrm >> 3) & 7; mod = (modrm >> 6) & 3; if (mod == 3) goto illegal_op; gen_op_mov_v_reg(ot, cpu_T0, reg); gen_lea_modrm(env, s, modrm); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); if (ot == MO_16) { gen_helper_boundw(cpu_env, cpu_A0, cpu_tmp2_i32); } else { gen_helper_boundl(cpu_env, cpu_A0, cpu_tmp2_i32); break; case 0x1c8 ... 0x1cf: /* bswap reg */ reg = (b & 7) | REX_B(s); #ifdef TARGET_X86_64 if (dflag == MO_64) { gen_op_mov_v_reg(MO_64, cpu_T0, reg); tcg_gen_bswap64_i64(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_64, reg, cpu_T0); } else #endif { gen_op_mov_v_reg(MO_32, cpu_T0, reg); tcg_gen_ext32u_tl(cpu_T0, cpu_T0); tcg_gen_bswap32_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_32, reg, cpu_T0); break; case 0xd6: /* salc */ if (CODE64(s)) goto illegal_op; gen_compute_eflags_c(s, cpu_T0); tcg_gen_neg_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(MO_8, R_EAX, cpu_T0); break; case 0xe0: /* loopnz */ case 0xe1: /* loopz */ case 0xe2: /* loop */ case 0xe3: /* jecxz */ { TCGLabel *l1, *l2, *l3; tval = (int8_t)insn_get(env, s, MO_8); next_eip = s->pc - s->cs_base; tval += next_eip; if (dflag == MO_16) { tval &= 0xffff; l1 = gen_new_label(); l2 = gen_new_label(); l3 = gen_new_label(); b &= 3; switch(b) { case 0: /* loopnz */ case 1: /* loopz */ gen_op_add_reg_im(s->aflag, R_ECX, -1); gen_op_jz_ecx(s->aflag, l3); gen_jcc1(s, (JCC_Z << 1) | (b ^ 1), l1); break; case 2: /* loop */ gen_op_add_reg_im(s->aflag, R_ECX, -1); gen_op_jnz_ecx(s->aflag, l1); break; default: case 3: /* jcxz */ gen_op_jz_ecx(s->aflag, l1); break; gen_set_label(l3); gen_jmp_im(next_eip); tcg_gen_br(l2); gen_set_label(l1); gen_jmp_im(tval); gen_set_label(l2); gen_eob(s); break; case 0x130: /* wrmsr */ case 0x132: /* rdmsr */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); if (b & 2) { gen_helper_rdmsr(cpu_env); } else { gen_helper_wrmsr(cpu_env); break; case 0x131: /* rdtsc */ gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_rdtsc(cpu_env); gen_jmp(s, s->pc - s->cs_base); break; case 0x133: /* rdpmc */ gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_rdpmc(cpu_env); break; case 0x134: /* sysenter */ /* For Intel SYSENTER is valid on 64-bit */ if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) goto illegal_op; if (!s->pe) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_helper_sysenter(cpu_env); gen_eob(s); break; case 0x135: /* sysexit */ /* For Intel SYSEXIT is valid on 64-bit */ if (CODE64(s) && env->cpuid_vendor1 != CPUID_VENDOR_INTEL_1) goto illegal_op; if (!s->pe) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_helper_sysexit(cpu_env, tcg_const_i32(dflag - 1)); gen_eob(s); break; #ifdef TARGET_X86_64 case 0x105: /* syscall */ /* XXX: is it usable in real mode ? */ gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_syscall(cpu_env, tcg_const_i32(s->pc - pc_start)); /* TF handling for the syscall insn is different. The TF bit is checked after the syscall insn completes. This allows #DB to not be generated after one has entered CPL0 if TF is set in FMASK. */ gen_eob_worker(s, false, true); break; case 0x107: /* sysret */ if (!s->pe) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_helper_sysret(cpu_env, tcg_const_i32(dflag - 1)); /* condition codes are modified only in long mode */ if (s->lma) { set_cc_op(s, CC_OP_EFLAGS); /* TF handling for the sysret insn is different. The TF bit is checked after the sysret insn completes. This allows #DB to be generated ""as if"" the syscall insn in userspace has just completed. */ gen_eob_worker(s, false, true); break; #endif case 0x1a2: /* cpuid */ gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_cpuid(cpu_env); break; case 0xf4: /* hlt */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_hlt(cpu_env, tcg_const_i32(s->pc - pc_start)); s->is_jmp = DISAS_TB_JUMP; break; case 0x100: modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; op = (modrm >> 3) & 7; switch(op) { case 0: /* sldt */ if (!s->pe || s->vm86) goto illegal_op; gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_READ); tcg_gen_ld32u_tl(cpu_T0, cpu_env, offsetof(CPUX86State, ldt.selector)); ot = mod == 3 ? dflag : MO_16; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1); break; case 2: /* lldt */ if (!s->pe || s->vm86) goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_svm_check_intercept(s, pc_start, SVM_EXIT_LDTR_WRITE); gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_lldt(cpu_env, cpu_tmp2_i32); break; case 1: /* str */ if (!s->pe || s->vm86) goto illegal_op; gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_READ); tcg_gen_ld32u_tl(cpu_T0, cpu_env, offsetof(CPUX86State, tr.selector)); ot = mod == 3 ? dflag : MO_16; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1); break; case 3: /* ltr */ if (!s->pe || s->vm86) goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_svm_check_intercept(s, pc_start, SVM_EXIT_TR_WRITE); gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_T0); gen_helper_ltr(cpu_env, cpu_tmp2_i32); break; case 4: /* verr */ case 5: /* verw */ if (!s->pe || s->vm86) goto illegal_op; gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); gen_update_cc_op(s); if (op == 4) { gen_helper_verr(cpu_env, cpu_T0); } else { gen_helper_verw(cpu_env, cpu_T0); set_cc_op(s, CC_OP_EFLAGS); break; default: goto unknown_op; break; case 0x101: modrm = cpu_ldub_code(env, s->pc++); switch (modrm) { CASE_MODRM_MEM_OP(0): /* sgdt */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_READ); gen_lea_modrm(env, s, modrm); tcg_gen_ld32u_tl(cpu_T0, cpu_env, offsetof(CPUX86State, gdt.limit)); gen_op_st_v(s, MO_16, cpu_T0, cpu_A0); gen_add_A0_im(s, 2); tcg_gen_ld_tl(cpu_T0, cpu_env, offsetof(CPUX86State, gdt.base)); if (dflag == MO_16) { tcg_gen_andi_tl(cpu_T0, cpu_T0, 0xffffff); gen_op_st_v(s, CODE64(s) + MO_32, cpu_T0, cpu_A0); break; case 0xc8: /* monitor */ if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) || s->cpl != 0) { goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); tcg_gen_mov_tl(cpu_A0, cpu_regs[R_EAX]); gen_extu(s->aflag, cpu_A0); gen_add_A0_ds_seg(s); gen_helper_monitor(cpu_env, cpu_A0); break; case 0xc9: /* mwait */ if (!(s->cpuid_ext_features & CPUID_EXT_MONITOR) || s->cpl != 0) { goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_mwait(cpu_env, tcg_const_i32(s->pc - pc_start)); gen_eob(s); break; case 0xca: /* clac */ if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_SMAP) || s->cpl != 0) { goto illegal_op; gen_helper_clac(cpu_env); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; case 0xcb: /* stac */ if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_SMAP) || s->cpl != 0) { goto illegal_op; gen_helper_stac(cpu_env); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; CASE_MODRM_MEM_OP(1): /* sidt */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_READ); gen_lea_modrm(env, s, modrm); tcg_gen_ld32u_tl(cpu_T0, cpu_env, offsetof(CPUX86State, idt.limit)); gen_op_st_v(s, MO_16, cpu_T0, cpu_A0); gen_add_A0_im(s, 2); tcg_gen_ld_tl(cpu_T0, cpu_env, offsetof(CPUX86State, idt.base)); if (dflag == MO_16) { tcg_gen_andi_tl(cpu_T0, cpu_T0, 0xffffff); gen_op_st_v(s, CODE64(s) + MO_32, cpu_T0, cpu_A0); break; case 0xd0: /* xgetbv */ if ((s->cpuid_ext_features & CPUID_EXT_XSAVE) == 0 || (s->prefix & (PREFIX_LOCK | PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) { goto illegal_op; tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_ECX]); gen_helper_xgetbv(cpu_tmp1_i64, cpu_env, cpu_tmp2_i32); tcg_gen_extr_i64_tl(cpu_regs[R_EAX], cpu_regs[R_EDX], cpu_tmp1_i64); break; case 0xd1: /* xsetbv */ if ((s->cpuid_ext_features & CPUID_EXT_XSAVE) == 0 || (s->prefix & (PREFIX_LOCK | PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; tcg_gen_concat_tl_i64(cpu_tmp1_i64, cpu_regs[R_EAX], cpu_regs[R_EDX]); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_ECX]); gen_helper_xsetbv(cpu_env, cpu_tmp2_i32, cpu_tmp1_i64); /* End TB because translation flags may change. */ gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; case 0xd8: /* VMRUN */ if (!(s->flags & HF_SVME_MASK) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_vmrun(cpu_env, tcg_const_i32(s->aflag - 1), tcg_const_i32(s->pc - pc_start)); tcg_gen_exit_tb(0); s->is_jmp = DISAS_TB_JUMP; break; case 0xd9: /* VMMCALL */ if (!(s->flags & HF_SVME_MASK)) { goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_vmmcall(cpu_env); break; case 0xda: /* VMLOAD */ if (!(s->flags & HF_SVME_MASK) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_vmload(cpu_env, tcg_const_i32(s->aflag - 1)); break; case 0xdb: /* VMSAVE */ if (!(s->flags & HF_SVME_MASK) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_vmsave(cpu_env, tcg_const_i32(s->aflag - 1)); break; case 0xdc: /* STGI */ if ((!(s->flags & HF_SVME_MASK) && !(s->cpuid_ext3_features & CPUID_EXT3_SKINIT)) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_stgi(cpu_env); break; case 0xdd: /* CLGI */ if (!(s->flags & HF_SVME_MASK) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_clgi(cpu_env); break; case 0xde: /* SKINIT */ if ((!(s->flags & HF_SVME_MASK) && !(s->cpuid_ext3_features & CPUID_EXT3_SKINIT)) || !s->pe) { goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_skinit(cpu_env); break; case 0xdf: /* INVLPGA */ if (!(s->flags & HF_SVME_MASK) || !s->pe) { goto illegal_op; if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_invlpga(cpu_env, tcg_const_i32(s->aflag - 1)); break; CASE_MODRM_MEM_OP(2): /* lgdt */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_svm_check_intercept(s, pc_start, SVM_EXIT_GDTR_WRITE); gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, MO_16, cpu_T1, cpu_A0); gen_add_A0_im(s, 2); gen_op_ld_v(s, CODE64(s) + MO_32, cpu_T0, cpu_A0); if (dflag == MO_16) { tcg_gen_andi_tl(cpu_T0, cpu_T0, 0xffffff); tcg_gen_st_tl(cpu_T0, cpu_env, offsetof(CPUX86State, gdt.base)); tcg_gen_st32_tl(cpu_T1, cpu_env, offsetof(CPUX86State, gdt.limit)); break; CASE_MODRM_MEM_OP(3): /* lidt */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_svm_check_intercept(s, pc_start, SVM_EXIT_IDTR_WRITE); gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, MO_16, cpu_T1, cpu_A0); gen_add_A0_im(s, 2); gen_op_ld_v(s, CODE64(s) + MO_32, cpu_T0, cpu_A0); if (dflag == MO_16) { tcg_gen_andi_tl(cpu_T0, cpu_T0, 0xffffff); tcg_gen_st_tl(cpu_T0, cpu_env, offsetof(CPUX86State, idt.base)); tcg_gen_st32_tl(cpu_T1, cpu_env, offsetof(CPUX86State, idt.limit)); break; CASE_MODRM_OP(4): /* smsw */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_CR0); tcg_gen_ld_tl(cpu_T0, cpu_env, offsetof(CPUX86State, cr[0])); if (CODE64(s)) { mod = (modrm >> 6) & 3; ot = (mod != 3 ? MO_16 : s->dflag); } else { ot = MO_16; gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 1); break; case 0xee: /* rdpkru */ if (prefixes & PREFIX_LOCK) { goto illegal_op; tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_ECX]); gen_helper_rdpkru(cpu_tmp1_i64, cpu_env, cpu_tmp2_i32); tcg_gen_extr_i64_tl(cpu_regs[R_EAX], cpu_regs[R_EDX], cpu_tmp1_i64); break; case 0xef: /* wrpkru */ if (prefixes & PREFIX_LOCK) { goto illegal_op; tcg_gen_concat_tl_i64(cpu_tmp1_i64, cpu_regs[R_EAX], cpu_regs[R_EDX]); tcg_gen_trunc_tl_i32(cpu_tmp2_i32, cpu_regs[R_ECX]); gen_helper_wrpkru(cpu_env, cpu_tmp2_i32, cpu_tmp1_i64); break; CASE_MODRM_OP(6): /* lmsw */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0); gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); gen_helper_lmsw(cpu_env, cpu_T0); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; CASE_MODRM_MEM_OP(7): /* invlpg */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); break; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_lea_modrm(env, s, modrm); gen_helper_invlpg(cpu_env, cpu_A0); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; case 0xf8: /* swapgs */ #ifdef TARGET_X86_64 if (CODE64(s)) { if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { tcg_gen_mov_tl(cpu_T0, cpu_seg_base[R_GS]); tcg_gen_ld_tl(cpu_seg_base[R_GS], cpu_env, offsetof(CPUX86State, kernelgsbase)); tcg_gen_st_tl(cpu_T0, cpu_env, offsetof(CPUX86State, kernelgsbase)); break; #endif goto illegal_op; case 0xf9: /* rdtscp */ if (!(s->cpuid_ext2_features & CPUID_EXT2_RDTSCP)) { goto illegal_op; gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); gen_helper_rdtscp(cpu_env); gen_jmp(s, s->pc - s->cs_base); break; default: goto unknown_op; break; case 0x108: /* invd */ case 0x109: /* wbinvd */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_svm_check_intercept(s, pc_start, (b & 2) ? SVM_EXIT_INVD : SVM_EXIT_WBINVD); /* nothing to do */ break; case 0x63: /* arpl or movslS (x86_64) */ #ifdef TARGET_X86_64 if (CODE64(s)) { int d_ot; /* d_ot is the size of destination */ d_ot = dflag; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; mod = (modrm >> 6) & 3; rm = (modrm & 7) | REX_B(s); if (mod == 3) { gen_op_mov_v_reg(MO_32, cpu_T0, rm); /* sign extend */ if (d_ot == MO_64) { tcg_gen_ext32s_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(d_ot, reg, cpu_T0); } else { gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, MO_32 | MO_SIGN, cpu_T0, cpu_A0); gen_op_mov_reg_v(d_ot, reg, cpu_T0); } else #endif { TCGLabel *label1; TCGv t0, t1, t2, a0; if (!s->pe || s->vm86) goto illegal_op; t0 = tcg_temp_local_new(); t1 = tcg_temp_local_new(); t2 = tcg_temp_local_new(); ot = MO_16; modrm = cpu_ldub_code(env, s->pc++); reg = (modrm >> 3) & 7; mod = (modrm >> 6) & 3; rm = modrm & 7; if (mod != 3) { gen_lea_modrm(env, s, modrm); gen_op_ld_v(s, ot, t0, cpu_A0); a0 = tcg_temp_local_new(); tcg_gen_mov_tl(a0, cpu_A0); } else { gen_op_mov_v_reg(ot, t0, rm); TCGV_UNUSED(a0); gen_op_mov_v_reg(ot, t1, reg); tcg_gen_andi_tl(cpu_tmp0, t0, 3); tcg_gen_andi_tl(t1, t1, 3); tcg_gen_movi_tl(t2, 0); label1 = gen_new_label(); tcg_gen_brcond_tl(TCG_COND_GE, cpu_tmp0, t1, label1); tcg_gen_andi_tl(t0, t0, ~3); tcg_gen_or_tl(t0, t0, t1); tcg_gen_movi_tl(t2, CC_Z); gen_set_label(label1); if (mod != 3) { gen_op_st_v(s, ot, t0, a0); tcg_temp_free(a0); } else { gen_op_mov_reg_v(ot, rm, t0); gen_compute_eflags(s); tcg_gen_andi_tl(cpu_cc_src, cpu_cc_src, ~CC_Z); tcg_gen_or_tl(cpu_cc_src, cpu_cc_src, t2); tcg_temp_free(t0); tcg_temp_free(t1); tcg_temp_free(t2); break; case 0x102: /* lar */ case 0x103: /* lsl */ { TCGLabel *label1; TCGv t0; if (!s->pe || s->vm86) goto illegal_op; ot = dflag != MO_16 ? MO_32 : MO_16; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; gen_ldst_modrm(env, s, modrm, MO_16, OR_TMP0, 0); t0 = tcg_temp_local_new(); gen_update_cc_op(s); if (b == 0x102) { gen_helper_lar(t0, cpu_env, cpu_T0); } else { gen_helper_lsl(t0, cpu_env, cpu_T0); tcg_gen_andi_tl(cpu_tmp0, cpu_cc_src, CC_Z); label1 = gen_new_label(); tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_tmp0, 0, label1); gen_op_mov_reg_v(ot, reg, t0); gen_set_label(label1); set_cc_op(s, CC_OP_EFLAGS); tcg_temp_free(t0); break; case 0x118: modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; op = (modrm >> 3) & 7; switch(op) { case 0: /* prefetchnta */ case 1: /* prefetchnt0 */ case 2: /* prefetchnt0 */ case 3: /* prefetchnt0 */ if (mod == 3) goto illegal_op; gen_nop_modrm(env, s, modrm); /* nothing more to do */ break; default: /* nop (multi byte) */ gen_nop_modrm(env, s, modrm); break; break; case 0x11a: modrm = cpu_ldub_code(env, s->pc++); if (s->flags & HF_MPX_EN_MASK) { mod = (modrm >> 6) & 3; reg = ((modrm >> 3) & 7) | rex_r; if (prefixes & PREFIX_REPZ) { /* bndcl */ if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16) { goto illegal_op; gen_bndck(env, s, modrm, TCG_COND_LTU, cpu_bndl[reg]); } else if (prefixes & PREFIX_REPNZ) { /* bndcu */ if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16) { goto illegal_op; TCGv_i64 notu = tcg_temp_new_i64(); tcg_gen_not_i64(notu, cpu_bndu[reg]); gen_bndck(env, s, modrm, TCG_COND_GTU, notu); tcg_temp_free_i64(notu); } else if (prefixes & PREFIX_DATA) { /* bndmov -- from reg/mem */ if (reg >= 4 || s->aflag == MO_16) { goto illegal_op; if (mod == 3) { int reg2 = (modrm & 7) | REX_B(s); if (reg2 >= 4 || (prefixes & PREFIX_LOCK)) { goto illegal_op; if (s->flags & HF_MPX_IU_MASK) { tcg_gen_mov_i64(cpu_bndl[reg], cpu_bndl[reg2]); tcg_gen_mov_i64(cpu_bndu[reg], cpu_bndu[reg2]); } else { gen_lea_modrm(env, s, modrm); if (CODE64(s)) { tcg_gen_qemu_ld_i64(cpu_bndl[reg], cpu_A0, s->mem_index, MO_LEQ); tcg_gen_addi_tl(cpu_A0, cpu_A0, 8); tcg_gen_qemu_ld_i64(cpu_bndu[reg], cpu_A0, s->mem_index, MO_LEQ); } else { tcg_gen_qemu_ld_i64(cpu_bndl[reg], cpu_A0, s->mem_index, MO_LEUL); tcg_gen_addi_tl(cpu_A0, cpu_A0, 4); tcg_gen_qemu_ld_i64(cpu_bndu[reg], cpu_A0, s->mem_index, MO_LEUL); /* bnd registers are now in-use */ gen_set_hflag(s, HF_MPX_IU_MASK); } else if (mod != 3) { /* bndldx */ AddressParts a = gen_lea_modrm_0(env, s, modrm); if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16 || a.base < -1) { goto illegal_op; if (a.base >= 0) { tcg_gen_addi_tl(cpu_A0, cpu_regs[a.base], a.disp); } else { tcg_gen_movi_tl(cpu_A0, 0); gen_lea_v_seg(s, s->aflag, cpu_A0, a.def_seg, s->override); if (a.index >= 0) { tcg_gen_mov_tl(cpu_T0, cpu_regs[a.index]); } else { tcg_gen_movi_tl(cpu_T0, 0); if (CODE64(s)) { gen_helper_bndldx64(cpu_bndl[reg], cpu_env, cpu_A0, cpu_T0); tcg_gen_ld_i64(cpu_bndu[reg], cpu_env, offsetof(CPUX86State, mmx_t0.MMX_Q(0))); } else { gen_helper_bndldx32(cpu_bndu[reg], cpu_env, cpu_A0, cpu_T0); tcg_gen_ext32u_i64(cpu_bndl[reg], cpu_bndu[reg]); tcg_gen_shri_i64(cpu_bndu[reg], cpu_bndu[reg], 32); gen_set_hflag(s, HF_MPX_IU_MASK); gen_nop_modrm(env, s, modrm); break; case 0x11b: modrm = cpu_ldub_code(env, s->pc++); if (s->flags & HF_MPX_EN_MASK) { mod = (modrm >> 6) & 3; reg = ((modrm >> 3) & 7) | rex_r; if (mod != 3 && (prefixes & PREFIX_REPZ)) { /* bndmk */ if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16) { goto illegal_op; AddressParts a = gen_lea_modrm_0(env, s, modrm); if (a.base >= 0) { tcg_gen_extu_tl_i64(cpu_bndl[reg], cpu_regs[a.base]); if (!CODE64(s)) { tcg_gen_ext32u_i64(cpu_bndl[reg], cpu_bndl[reg]); } else if (a.base == -1) { /* no base register has lower bound of 0 */ tcg_gen_movi_i64(cpu_bndl[reg], 0); } else { /* rip-relative generates #ud */ goto illegal_op; tcg_gen_not_tl(cpu_A0, gen_lea_modrm_1(a)); if (!CODE64(s)) { tcg_gen_ext32u_tl(cpu_A0, cpu_A0); tcg_gen_extu_tl_i64(cpu_bndu[reg], cpu_A0); /* bnd registers are now in-use */ gen_set_hflag(s, HF_MPX_IU_MASK); break; } else if (prefixes & PREFIX_REPNZ) { /* bndcn */ if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16) { goto illegal_op; gen_bndck(env, s, modrm, TCG_COND_GTU, cpu_bndu[reg]); } else if (prefixes & PREFIX_DATA) { /* bndmov -- to reg/mem */ if (reg >= 4 || s->aflag == MO_16) { goto illegal_op; if (mod == 3) { int reg2 = (modrm & 7) | REX_B(s); if (reg2 >= 4 || (prefixes & PREFIX_LOCK)) { goto illegal_op; if (s->flags & HF_MPX_IU_MASK) { tcg_gen_mov_i64(cpu_bndl[reg2], cpu_bndl[reg]); tcg_gen_mov_i64(cpu_bndu[reg2], cpu_bndu[reg]); } else { gen_lea_modrm(env, s, modrm); if (CODE64(s)) { tcg_gen_qemu_st_i64(cpu_bndl[reg], cpu_A0, s->mem_index, MO_LEQ); tcg_gen_addi_tl(cpu_A0, cpu_A0, 8); tcg_gen_qemu_st_i64(cpu_bndu[reg], cpu_A0, s->mem_index, MO_LEQ); } else { tcg_gen_qemu_st_i64(cpu_bndl[reg], cpu_A0, s->mem_index, MO_LEUL); tcg_gen_addi_tl(cpu_A0, cpu_A0, 4); tcg_gen_qemu_st_i64(cpu_bndu[reg], cpu_A0, s->mem_index, MO_LEUL); } else if (mod != 3) { /* bndstx */ AddressParts a = gen_lea_modrm_0(env, s, modrm); if (reg >= 4 || (prefixes & PREFIX_LOCK) || s->aflag == MO_16 || a.base < -1) { goto illegal_op; if (a.base >= 0) { tcg_gen_addi_tl(cpu_A0, cpu_regs[a.base], a.disp); } else { tcg_gen_movi_tl(cpu_A0, 0); gen_lea_v_seg(s, s->aflag, cpu_A0, a.def_seg, s->override); if (a.index >= 0) { tcg_gen_mov_tl(cpu_T0, cpu_regs[a.index]); } else { tcg_gen_movi_tl(cpu_T0, 0); if (CODE64(s)) { gen_helper_bndstx64(cpu_env, cpu_A0, cpu_T0, cpu_bndl[reg], cpu_bndu[reg]); } else { gen_helper_bndstx32(cpu_env, cpu_A0, cpu_T0, cpu_bndl[reg], cpu_bndu[reg]); gen_nop_modrm(env, s, modrm); break; case 0x119: case 0x11c ... 0x11f: /* nop (multi byte) */ modrm = cpu_ldub_code(env, s->pc++); gen_nop_modrm(env, s, modrm); break; case 0x120: /* mov reg, crN */ case 0x122: /* mov crN, reg */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { modrm = cpu_ldub_code(env, s->pc++); /* Ignore the mod bits (assume (modrm&0xc0)==0xc0). * AMD documentation (24594.pdf) and testing of * intel 386 and 486 processors all show that the mod bits * are assumed to be 1's, regardless of actual values. */ rm = (modrm & 7) | REX_B(s); reg = ((modrm >> 3) & 7) | rex_r; if (CODE64(s)) ot = MO_64; else ot = MO_32; if ((prefixes & PREFIX_LOCK) && (reg == 0) && (s->cpuid_ext3_features & CPUID_EXT3_CR8LEG)) { reg = 8; switch(reg) { case 0: case 2: case 3: case 4: case 8: gen_update_cc_op(s); gen_jmp_im(pc_start - s->cs_base); if (b & 2) { gen_op_mov_v_reg(ot, cpu_T0, rm); gen_helper_write_crN(cpu_env, tcg_const_i32(reg), cpu_T0); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); } else { gen_helper_read_crN(cpu_T0, cpu_env, tcg_const_i32(reg)); gen_op_mov_reg_v(ot, rm, cpu_T0); break; default: goto unknown_op; break; case 0x121: /* mov reg, drN */ case 0x123: /* mov drN, reg */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { modrm = cpu_ldub_code(env, s->pc++); /* Ignore the mod bits (assume (modrm&0xc0)==0xc0). * AMD documentation (24594.pdf) and testing of * intel 386 and 486 processors all show that the mod bits * are assumed to be 1's, regardless of actual values. */ rm = (modrm & 7) | REX_B(s); reg = ((modrm >> 3) & 7) | rex_r; if (CODE64(s)) ot = MO_64; else ot = MO_32; if (reg >= 8) { goto illegal_op; if (b & 2) { gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_DR0 + reg); gen_op_mov_v_reg(ot, cpu_T0, rm); tcg_gen_movi_i32(cpu_tmp2_i32, reg); gen_helper_set_dr(cpu_env, cpu_tmp2_i32, cpu_T0); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); } else { gen_svm_check_intercept(s, pc_start, SVM_EXIT_READ_DR0 + reg); tcg_gen_movi_i32(cpu_tmp2_i32, reg); gen_helper_get_dr(cpu_T0, cpu_env, cpu_tmp2_i32); gen_op_mov_reg_v(ot, rm, cpu_T0); break; case 0x106: /* clts */ if (s->cpl != 0) { gen_exception(s, EXCP0D_GPF, pc_start - s->cs_base); } else { gen_svm_check_intercept(s, pc_start, SVM_EXIT_WRITE_CR0); gen_helper_clts(cpu_env); /* abort block because static cpu state changed */ gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; /* MMX/3DNow!/SSE/SSE2/SSE3/SSSE3/SSE4 support */ case 0x1c3: /* MOVNTI reg, mem */ if (!(s->cpuid_features & CPUID_SSE2)) goto illegal_op; ot = mo_64_32(dflag); modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; if (mod == 3) goto illegal_op; reg = ((modrm >> 3) & 7) | rex_r; /* generate a generic store */ gen_ldst_modrm(env, s, modrm, ot, reg, 1); break; case 0x1ae: modrm = cpu_ldub_code(env, s->pc++); switch (modrm) { CASE_MODRM_MEM_OP(0): /* fxsave */ if (!(s->cpuid_features & CPUID_FXSR) || (prefixes & PREFIX_LOCK)) { goto illegal_op; if ((s->flags & HF_EM_MASK) || (s->flags & HF_TS_MASK)) { gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; gen_lea_modrm(env, s, modrm); gen_helper_fxsave(cpu_env, cpu_A0); break; CASE_MODRM_MEM_OP(1): /* fxrstor */ if (!(s->cpuid_features & CPUID_FXSR) || (prefixes & PREFIX_LOCK)) { goto illegal_op; if ((s->flags & HF_EM_MASK) || (s->flags & HF_TS_MASK)) { gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; gen_lea_modrm(env, s, modrm); gen_helper_fxrstor(cpu_env, cpu_A0); break; CASE_MODRM_MEM_OP(2): /* ldmxcsr */ if ((s->flags & HF_EM_MASK) || !(s->flags & HF_OSFXSR_MASK)) { goto illegal_op; if (s->flags & HF_TS_MASK) { gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; gen_lea_modrm(env, s, modrm); tcg_gen_qemu_ld_i32(cpu_tmp2_i32, cpu_A0, s->mem_index, MO_LEUL); gen_helper_ldmxcsr(cpu_env, cpu_tmp2_i32); break; CASE_MODRM_MEM_OP(3): /* stmxcsr */ if ((s->flags & HF_EM_MASK) || !(s->flags & HF_OSFXSR_MASK)) { goto illegal_op; if (s->flags & HF_TS_MASK) { gen_exception(s, EXCP07_PREX, pc_start - s->cs_base); break; gen_lea_modrm(env, s, modrm); tcg_gen_ld32u_tl(cpu_T0, cpu_env, offsetof(CPUX86State, mxcsr)); gen_op_st_v(s, MO_32, cpu_T0, cpu_A0); break; CASE_MODRM_MEM_OP(4): /* xsave */ if ((s->cpuid_ext_features & CPUID_EXT_XSAVE) == 0 || (prefixes & (PREFIX_LOCK | PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) { goto illegal_op; gen_lea_modrm(env, s, modrm); tcg_gen_concat_tl_i64(cpu_tmp1_i64, cpu_regs[R_EAX], cpu_regs[R_EDX]); gen_helper_xsave(cpu_env, cpu_A0, cpu_tmp1_i64); break; CASE_MODRM_MEM_OP(5): /* xrstor */ if ((s->cpuid_ext_features & CPUID_EXT_XSAVE) == 0 || (prefixes & (PREFIX_LOCK | PREFIX_DATA | PREFIX_REPZ | PREFIX_REPNZ))) { goto illegal_op; gen_lea_modrm(env, s, modrm); tcg_gen_concat_tl_i64(cpu_tmp1_i64, cpu_regs[R_EAX], cpu_regs[R_EDX]); gen_helper_xrstor(cpu_env, cpu_A0, cpu_tmp1_i64); /* XRSTOR is how MPX is enabled, which changes how we translate. Thus we need to end the TB. */ gen_update_cc_op(s); gen_jmp_im(s->pc - s->cs_base); gen_eob(s); break; CASE_MODRM_MEM_OP(6): /* xsaveopt / clwb */ if (prefixes & PREFIX_LOCK) { goto illegal_op; if (prefixes & PREFIX_DATA) { /* clwb */ if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_CLWB)) { goto illegal_op; gen_nop_modrm(env, s, modrm); } else { /* xsaveopt */ if ((s->cpuid_ext_features & CPUID_EXT_XSAVE) == 0 || (s->cpuid_xsave_features & CPUID_XSAVE_XSAVEOPT) == 0 || (prefixes & (PREFIX_REPZ | PREFIX_REPNZ))) { goto illegal_op; gen_lea_modrm(env, s, modrm); tcg_gen_concat_tl_i64(cpu_tmp1_i64, cpu_regs[R_EAX], cpu_regs[R_EDX]); gen_helper_xsaveopt(cpu_env, cpu_A0, cpu_tmp1_i64); break; CASE_MODRM_MEM_OP(7): /* clflush / clflushopt */ if (prefixes & PREFIX_LOCK) { goto illegal_op; if (prefixes & PREFIX_DATA) { /* clflushopt */ if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_CLFLUSHOPT)) { goto illegal_op; } else { /* clflush */ if ((s->prefix & (PREFIX_REPZ | PREFIX_REPNZ)) || !(s->cpuid_features & CPUID_CLFLUSH)) { goto illegal_op; gen_nop_modrm(env, s, modrm); break; case 0xc0 ... 0xc7: /* rdfsbase (f3 0f ae /0) */ case 0xc8 ... 0xc8: /* rdgsbase (f3 0f ae /1) */ case 0xd0 ... 0xd7: /* wrfsbase (f3 0f ae /2) */ case 0xd8 ... 0xd8: /* wrgsbase (f3 0f ae /3) */ if (CODE64(s) && (prefixes & PREFIX_REPZ) && !(prefixes & PREFIX_LOCK) && (s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_FSGSBASE)) { TCGv base, treg, src, dst; /* Preserve hflags bits by testing CR4 at runtime. */ tcg_gen_movi_i32(cpu_tmp2_i32, CR4_FSGSBASE_MASK); gen_helper_cr4_testbit(cpu_env, cpu_tmp2_i32); base = cpu_seg_base[modrm & 8 ? R_GS : R_FS]; treg = cpu_regs[(modrm & 7) | REX_B(s)]; if (modrm & 0x10) { /* wr*base */ dst = base, src = treg; } else { /* rd*base */ dst = treg, src = base; if (s->dflag == MO_32) { tcg_gen_ext32u_tl(dst, src); } else { tcg_gen_mov_tl(dst, src); break; goto unknown_op; case 0xf8: /* sfence / pcommit */ if (prefixes & PREFIX_DATA) { /* pcommit */ if (!(s->cpuid_7_0_ebx_features & CPUID_7_0_EBX_PCOMMIT) || (prefixes & PREFIX_LOCK)) { goto illegal_op; break; /* fallthru */ case 0xf9 ... 0xff: /* sfence */ if (!(s->cpuid_features & CPUID_SSE) || (prefixes & PREFIX_LOCK)) { goto illegal_op; tcg_gen_mb(TCG_MO_ST_ST | TCG_BAR_SC); break; case 0xe8 ... 0xef: /* lfence */ if (!(s->cpuid_features & CPUID_SSE) || (prefixes & PREFIX_LOCK)) { goto illegal_op; tcg_gen_mb(TCG_MO_LD_LD | TCG_BAR_SC); break; case 0xf0 ... 0xf7: /* mfence */ if (!(s->cpuid_features & CPUID_SSE2) || (prefixes & PREFIX_LOCK)) { goto illegal_op; tcg_gen_mb(TCG_MO_ALL | TCG_BAR_SC); break; default: goto unknown_op; break; case 0x10d: /* 3DNow! prefetch(w) */ modrm = cpu_ldub_code(env, s->pc++); mod = (modrm >> 6) & 3; if (mod == 3) goto illegal_op; gen_nop_modrm(env, s, modrm); break; case 0x1aa: /* rsm */ gen_svm_check_intercept(s, pc_start, SVM_EXIT_RSM); if (!(s->flags & HF_SMM_MASK)) goto illegal_op; gen_update_cc_op(s); gen_jmp_im(s->pc - s->cs_base); gen_helper_rsm(cpu_env); gen_eob(s); break; case 0x1b8: /* SSE4.2 popcnt */ if ((prefixes & (PREFIX_REPZ | PREFIX_LOCK | PREFIX_REPNZ)) != PREFIX_REPZ) goto illegal_op; if (!(s->cpuid_ext_features & CPUID_EXT_POPCNT)) goto illegal_op; modrm = cpu_ldub_code(env, s->pc++); reg = ((modrm >> 3) & 7) | rex_r; if (s->prefix & PREFIX_DATA) { ot = MO_16; } else { ot = mo_64_32(dflag); gen_ldst_modrm(env, s, modrm, ot, OR_TMP0, 0); gen_extu(ot, cpu_T0); tcg_gen_mov_tl(cpu_cc_src, cpu_T0); tcg_gen_ctpop_tl(cpu_T0, cpu_T0); gen_op_mov_reg_v(ot, reg, cpu_T0); set_cc_op(s, CC_OP_POPCNT); break; case 0x10e ... 0x10f: /* 3DNow! instructions, ignore prefixes */ s->prefix &= ~(PREFIX_REPZ | PREFIX_REPNZ | PREFIX_DATA); case 0x110 ... 0x117: case 0x128 ... 0x12f: case 0x138 ... 0x13a: case 0x150 ... 0x179: case 0x17c ... 0x17f: case 0x1c2: case 0x1c4 ... 0x1c6: case 0x1d0 ... 0x1fe: gen_sse(env, s, b, pc_start, rex_r); break; default: goto unknown_op; return s->pc; illegal_op: gen_illegal_opcode(s); return s->pc; unknown_op: gen_unknown_opcode(env, s); return s->pc;","Yes, it is vulnerable."175173,"START_TEST(escaped_string) { int i; struct { const char *encoded; const char *decoded; } test_cases[] = { { ""\""\\\""\"""", ""\"""" }, { ""\""hello world \\\""embedded string\\\""\"""", ""hello world \""embedded string\"""" }, { ""\""hello world\\nwith new line\"""", ""hello world\nwith new line"" }, { ""\""single byte utf-8 \\u0020\"""", ""single byte utf-8 "" }, { ""\""double byte utf-8 \\u00A2\"""", ""double byte utf-8 \xc2\xa2"" }, { ""\""triple byte utf-8 \\u20AC\"""", ""triple byte utf-8 \xe2\x82\xac"" }, {} }; for (i = 0; test_cases[i].encoded; i++) { QObject *obj; QString *str; obj = qobject_from_json(test_cases[i].encoded); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QSTRING); str = qobject_to_qstring(obj); fail_unless(strcmp(qstring_get_str(str), test_cases[i].decoded) == 0); QDECREF(str); } }","No, it is non-vulnerable."176174,"static void handle_mrs(DisasContext *s, uint32_t insn, unsigned int op0, unsigned int op1, unsigned int op2, unsigned int crn, unsigned int crm, unsigned int rt) { unsupported_encoding(s, insn); }","No, it is non-vulnerable."177175,"int kvm_irqchip_add_msi_route(KVMState *s, MSIMessage msg) { struct kvm_irq_routing_entry kroute; int virq; if (!kvm_gsi_routing_enabled()) { return -ENOSYS; } virq = kvm_irqchip_get_virq(s); if (virq < 0) { return virq; } kroute.gsi = virq; kroute.type = KVM_IRQ_ROUTING_MSI; kroute.flags = 0; kroute.u.msi.address_lo = (uint32_t)msg.address; kroute.u.msi.address_hi = msg.address >> 32; kroute.u.msi.data = le32_to_cpu(msg.data); kvm_add_routing_entry(s, &kroute); kvm_irqchip_commit_routes(s); return virq; }","Yes, it is vulnerable."178176,"static int oma_read_header(AVFormatContext *s) { int ret, framesize, jsflag, samplerate; uint32_t codec_params, channel_id; int16_t eid; uint8_t buf[EA3_HEADER_SIZE]; uint8_t *edata; AVStream *st; ID3v2ExtraMeta *extra_meta = NULL; OMAContext *oc = s->priv_data; ff_id3v2_read(s, ID3v2_EA3_MAGIC, &extra_meta, 0); ret = avio_read(s->pb, buf, EA3_HEADER_SIZE); if (ret < EA3_HEADER_SIZE) return -1; if (memcmp(buf, ((const uint8_t[]){'E', 'A', '3'}), 3) || buf[4] != 0 || buf[5] != EA3_HEADER_SIZE) { av_log(s, AV_LOG_ERROR, ""Couldn't find the EA3 header !\n""); return AVERROR_INVALIDDATA; } oc->content_start = avio_tell(s->pb); /* encrypted file */ eid = AV_RB16(&buf[6]); if (eid != -1 && eid != -128 && decrypt_init(s, extra_meta, buf) < 0) { ff_id3v2_free_extra_meta(&extra_meta); return -1; } ff_id3v2_free_extra_meta(&extra_meta); codec_params = AV_RB24(&buf[33]); st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); st->start_time = 0; st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_tag = buf[32]; st->codecpar->codec_id = ff_codec_get_id(ff_oma_codec_tags, st->codecpar->codec_tag); switch (buf[32]) { case OMA_CODECID_ATRAC3: samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100; if (!samplerate) { av_log(s, AV_LOG_ERROR, ""Unsupported sample rate\n""); return AVERROR_INVALIDDATA; } if (samplerate != 44100) avpriv_request_sample(s, ""Sample rate %d"", samplerate); framesize = (codec_params & 0x3FF) * 8; /* get stereo coding mode, 1 for joint-stereo */ jsflag = (codec_params >> 17) & 1; st->codecpar->channels = 2; st->codecpar->channel_layout = AV_CH_LAYOUT_STEREO; st->codecpar->sample_rate = samplerate; st->codecpar->bit_rate = st->codecpar->sample_rate * framesize * 8 / 1024; /* fake the ATRAC3 extradata * (wav format, makes stream copy to wav work) */ if (ff_alloc_extradata(st->codecpar, 14)) return AVERROR(ENOMEM); edata = st->codecpar->extradata; AV_WL16(&edata[0], 1); // always 1 AV_WL32(&edata[2], samplerate); // samples rate AV_WL16(&edata[6], jsflag); // coding mode AV_WL16(&edata[8], jsflag); // coding mode AV_WL16(&edata[10], 1); // always 1 // AV_WL16(&edata[12], 0); // always 0 avpriv_set_pts_info(st, 64, 1, st->codecpar->sample_rate); break; case OMA_CODECID_ATRAC3P: channel_id = (codec_params >> 10) & 7; if (!channel_id) { av_log(s, AV_LOG_ERROR, ""Invalid ATRAC-X channel id: %""PRIu32""\n"", channel_id); return AVERROR_INVALIDDATA; } st->codecpar->channel_layout = ff_oma_chid_to_native_layout[channel_id - 1]; st->codecpar->channels = ff_oma_chid_to_num_channels[channel_id - 1]; framesize = ((codec_params & 0x3FF) * 8) + 8; samplerate = ff_oma_srate_tab[(codec_params >> 13) & 7] * 100; if (!samplerate) { av_log(s, AV_LOG_ERROR, ""Unsupported sample rate\n""); return AVERROR_INVALIDDATA; } st->codecpar->sample_rate = samplerate; st->codecpar->bit_rate = samplerate * framesize * 8 / 2048; avpriv_set_pts_info(st, 64, 1, samplerate); break; case OMA_CODECID_MP3: st->need_parsing = AVSTREAM_PARSE_FULL_RAW; framesize = 1024; break; case OMA_CODECID_LPCM: /* PCM 44.1 kHz 16 bit stereo big-endian */ st->codecpar->channels = 2; st->codecpar->channel_layout = AV_CH_LAYOUT_STEREO; st->codecpar->sample_rate = 44100; framesize = 1024; /* bit rate = sample rate x PCM block align (= 4) x 8 */ st->codecpar->bit_rate = st->codecpar->sample_rate * 32; st->codecpar->bits_per_coded_sample = av_get_bits_per_sample(st->codecpar->codec_id); avpriv_set_pts_info(st, 64, 1, st->codecpar->sample_rate); break; default: av_log(s, AV_LOG_ERROR, ""Unsupported codec %d!\n"", buf[32]); return AVERROR(ENOSYS); } st->codecpar->block_align = framesize; return 0; }","Yes, it is vulnerable."179177,"static int temporal_luma_motion_vector(HEVCContext *s, int x0, int y0, int nPbW, int nPbH, int refIdxLx, Mv *mvLXCol, int X) { MvField *tab_mvf; MvField temp_col; int x, y, x_pu, y_pu; int min_pu_width = s->sps->min_pu_width; int availableFlagLXCol = 0; int colPic; HEVCFrame *ref = s->ref->collocated_ref; if (!ref) return 0; tab_mvf = ref->tab_mvf; colPic = ref->poc; //bottom right collocated motion vector x = x0 + nPbW; y = y0 + nPbH; if (tab_mvf && (y0 >> s->sps->log2_ctb_size) == (y >> s->sps->log2_ctb_size) && y < s->sps->height && x < s->sps->width) { x &= ~15; y &= ~15; ff_thread_await_progress(&ref->tf, y, 0); x_pu = x >> s->sps->log2_min_pu_size; y_pu = y >> s->sps->log2_min_pu_size; temp_col = TAB_MVF(x_pu, y_pu); availableFlagLXCol = DERIVE_TEMPORAL_COLOCATED_MVS; } // derive center collocated motion vector if (tab_mvf && !availableFlagLXCol) { x = x0 + (nPbW >> 1); y = y0 + (nPbH >> 1); x &= ~15; y &= ~15; ff_thread_await_progress(&ref->tf, y, 0); x_pu = x >> s->sps->log2_min_pu_size; y_pu = y >> s->sps->log2_min_pu_size; temp_col = TAB_MVF(x_pu, y_pu); availableFlagLXCol = DERIVE_TEMPORAL_COLOCATED_MVS; } return availableFlagLXCol; }","No, it is non-vulnerable."180178,"static int decode_audio_specific_config(AACContext *ac, AVCodecContext *avctx, MPEG4AudioConfig *m4ac, const uint8_t *data, int bit_size, int sync_extension) { GetBitContext gb; int i, ret; ff_dlog(avctx, ""audio specific config size %d\n"", bit_size >> 3); for (i = 0; i < bit_size >> 3; i++) ff_dlog(avctx, ""%02x "", data[i]); ff_dlog(avctx, ""\n""); if ((ret = init_get_bits(&gb, data, bit_size)) < 0) return ret; if ((i = avpriv_mpeg4audio_get_config(m4ac, data, bit_size, sync_extension)) < 0) return AVERROR_INVALIDDATA; if (m4ac->sampling_index > 12) { av_log(avctx, AV_LOG_ERROR, ""invalid sampling rate index %d\n"", m4ac->sampling_index); return AVERROR_INVALIDDATA; } if (m4ac->object_type == AOT_ER_AAC_LD && (m4ac->sampling_index < 3 || m4ac->sampling_index > 7)) { av_log(avctx, AV_LOG_ERROR, ""invalid low delay sampling rate index %d\n"", m4ac->sampling_index); return AVERROR_INVALIDDATA; } skip_bits_long(&gb, i); switch (m4ac->object_type) { case AOT_AAC_MAIN: case AOT_AAC_LC: case AOT_AAC_LTP: case AOT_ER_AAC_LC: case AOT_ER_AAC_LD: if ((ret = decode_ga_specific_config(ac, avctx, &gb, m4ac, m4ac->chan_config)) < 0) return ret; break; case AOT_ER_AAC_ELD: if ((ret = decode_eld_specific_config(ac, avctx, &gb, m4ac, m4ac->chan_config)) < 0) return ret; break; default: avpriv_report_missing_feature(avctx, ""Audio object type %s%d"", m4ac->sbr == 1 ? ""SBR+"" : """", m4ac->object_type); return AVERROR(ENOSYS); } ff_dlog(avctx, ""AOT %d chan config %d sampling index %d (%d) SBR %d PS %d\n"", m4ac->object_type, m4ac->chan_config, m4ac->sampling_index, m4ac->sample_rate, m4ac->sbr, m4ac->ps); return get_bits_count(&gb); }","Yes, it is vulnerable."181179,"long do_sigreturn(CPUS390XState *env) { sigframe *frame; abi_ulong frame_addr = env->regs[15]; target_sigset_t target_set; sigset_t set; trace_user_do_sigreturn(env, frame_addr); if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { goto badframe; } __get_user(target_set.sig[0], &frame->sc.oldmask[0]); target_to_host_sigset_internal(&set, &target_set); set_sigmask(&set); /* ~_BLOCKABLE? */ if (restore_sigregs(env, &frame->sregs)) { goto badframe; } unlock_user_struct(frame, frame_addr, 0); return -TARGET_QEMU_ESIGRETURN; badframe: force_sig(TARGET_SIGSEGV); return 0; }","Yes, it is vulnerable."182180,"static inline int get_symbol_inline(RangeCoder *c, uint8_t *state, int is_signed){ if(get_rac(c, state+0)) return 0; else{ int i, e, a; e= 0; while(get_rac(c, state+1 + e) && e<9){ //1..10 e++; } a= 1; for(i=e-1; i>=0; i--){ a += a + get_rac(c, state+22 + i); //22..31 } e= -(is_signed && get_rac(c, state+11 + e)); //11..21 return (a^e)-e; } }","No, it is non-vulnerable."183181,START_TEST(qobject_to_qint_test) { QInt *qi; qi = qint_from_int(0); fail_unless(qobject_to_qint(QOBJECT(qi)) == qi); QDECREF(qi); },"No, it is non-vulnerable."184182,"static void tcg_out_label(TCGContext *s, TCGLabel *l, tcg_insn_unit *ptr) { intptr_t value = (intptr_t)ptr; TCGRelocation *r; assert(!l->has_value); for (r = l->u.first_reloc; r != NULL; r = r->next) { patch_reloc(r->ptr, r->type, value, r->addend); } l->has_value = 1; l->u.value_ptr = ptr; }","No, it is non-vulnerable."185183,"BlockDriverState *bdrv_lookup_bs(const char *device, const char *node_name, Error **errp) { BlockBackend *blk; BlockDriverState *bs; if (device) { blk = blk_by_name(device); if (blk) { return blk_bs(blk); } } if (node_name) { bs = bdrv_find_node(node_name); if (bs) { return bs; } } error_setg(errp, ""Cannot find device=%s nor node_name=%s"", device ? device : """", node_name ? node_name : """"); return NULL; }","No, it is non-vulnerable."186184,"static int idcin_read_packet(AVFormatContext *s, AVPacket *pkt) { int ret; unsigned int command; unsigned int chunk_size; IdcinDemuxContext *idcin = s->priv_data; AVIOContext *pb = s->pb; int i; int palette_scale; unsigned char r, g, b; unsigned char palette_buffer[768]; uint32_t palette[256]; if (s->pb->eof_reached) return AVERROR(EIO); if (idcin->next_chunk_is_video) { command = avio_rl32(pb); if (command == 2) { return AVERROR(EIO); } else if (command == 1) { /* trigger a palette change */ if (avio_read(pb, palette_buffer, 768) != 768) return AVERROR(EIO); /* scale the palette as necessary */ palette_scale = 2; for (i = 0; i < 768; i++) if (palette_buffer[i] > 63) { palette_scale = 0; break; } for (i = 0; i < 256; i++) { r = palette_buffer[i * 3 ] << palette_scale; g = palette_buffer[i * 3 + 1] << palette_scale; b = palette_buffer[i * 3 + 2] << palette_scale; palette[i] = (r << 16) | (g << 8) | (b); } } chunk_size = avio_rl32(pb); if (chunk_size < 4 || chunk_size > INT_MAX - 4) { av_log(s, AV_LOG_ERROR, ""invalid chunk size: %u\n"", chunk_size); return AVERROR_INVALIDDATA; } /* skip the number of decoded bytes (always equal to width * height) */ avio_skip(pb, 4); chunk_size -= 4; ret= av_get_packet(pb, pkt, chunk_size); if (ret < 0) return ret; if (command == 1) { uint8_t *pal; pal = av_packet_new_side_data(pkt, AV_PKT_DATA_PALETTE, AVPALETTE_SIZE); if (ret < 0) return ret; memcpy(pal, palette, AVPALETTE_SIZE); pkt->flags |= AV_PKT_FLAG_KEY; } pkt->stream_index = idcin->video_stream_index; pkt->duration = 1; } else { /* send out the audio chunk */ if (idcin->current_audio_chunk) chunk_size = idcin->audio_chunk_size2; else chunk_size = idcin->audio_chunk_size1; ret= av_get_packet(pb, pkt, chunk_size); if (ret < 0) return ret; pkt->stream_index = idcin->audio_stream_index; pkt->duration = chunk_size / idcin->block_align; idcin->current_audio_chunk ^= 1; } if (idcin->audio_present) idcin->next_chunk_is_video ^= 1; return ret; }","No, it is non-vulnerable."187185,"void avcodec_register_all(void) { static int initialized; if (initialized) return; initialized = 1; /* hardware accelerators */ REGISTER_HWACCEL(H263_VAAPI, h263_vaapi); REGISTER_HWACCEL(H264_D3D11VA, h264_d3d11va); REGISTER_HWACCEL(H264_DXVA2, h264_dxva2); REGISTER_HWACCEL(H264_MMAL, h264_mmal); REGISTER_HWACCEL(H264_QSV, h264_qsv); REGISTER_HWACCEL(H264_VAAPI, h264_vaapi); REGISTER_HWACCEL(H264_VDA, h264_vda); REGISTER_HWACCEL(H264_VDA_OLD, h264_vda_old); REGISTER_HWACCEL(H264_VDPAU, h264_vdpau); REGISTER_HWACCEL(HEVC_D3D11VA, hevc_d3d11va); REGISTER_HWACCEL(HEVC_DXVA2, hevc_dxva2); REGISTER_HWACCEL(HEVC_QSV, hevc_qsv); REGISTER_HWACCEL(HEVC_VAAPI, hevc_vaapi); REGISTER_HWACCEL(HEVC_VDPAU, hevc_vdpau); REGISTER_HWACCEL(MPEG1_VDPAU, mpeg1_vdpau); REGISTER_HWACCEL(MPEG2_D3D11VA, mpeg2_d3d11va); REGISTER_HWACCEL(MPEG2_DXVA2, mpeg2_dxva2); REGISTER_HWACCEL(MPEG2_MMAL, mpeg2_mmal); REGISTER_HWACCEL(MPEG2_QSV, mpeg2_qsv); REGISTER_HWACCEL(MPEG2_VAAPI, mpeg2_vaapi); REGISTER_HWACCEL(MPEG2_VDPAU, mpeg2_vdpau); REGISTER_HWACCEL(MPEG4_VAAPI, mpeg4_vaapi); REGISTER_HWACCEL(MPEG4_VDPAU, mpeg4_vdpau); REGISTER_HWACCEL(VC1_D3D11VA, vc1_d3d11va); REGISTER_HWACCEL(VC1_DXVA2, vc1_dxva2); REGISTER_HWACCEL(VC1_QSV, vc1_qsv); REGISTER_HWACCEL(VC1_VAAPI, vc1_vaapi); REGISTER_HWACCEL(VC1_VDPAU, vc1_vdpau); REGISTER_HWACCEL(VC1_MMAL, vc1_mmal); REGISTER_HWACCEL(VP8_QSV, vp8_qsv); REGISTER_HWACCEL(VP8_VAAPI, vp8_vaapi); REGISTER_HWACCEL(WMV3_D3D11VA, wmv3_d3d11va); REGISTER_HWACCEL(WMV3_DXVA2, wmv3_dxva2); REGISTER_HWACCEL(WMV3_VAAPI, wmv3_vaapi); REGISTER_HWACCEL(WMV3_VDPAU, wmv3_vdpau); /* video codecs */ REGISTER_ENCODER(A64MULTI, a64multi); REGISTER_ENCODER(A64MULTI5, a64multi5); REGISTER_DECODER(AASC, aasc); REGISTER_DECODER(AIC, aic); REGISTER_ENCDEC (ALIAS_PIX, alias_pix); REGISTER_DECODER(AMV, amv); REGISTER_DECODER(ANM, anm); REGISTER_DECODER(ANSI, ansi); REGISTER_ENCDEC (ASV1, asv1); REGISTER_ENCDEC (ASV2, asv2); REGISTER_DECODER(AURA, aura); REGISTER_DECODER(AURA2, aura2); REGISTER_DECODER(AVS, avs); REGISTER_DECODER(BETHSOFTVID, bethsoftvid); REGISTER_DECODER(BFI, bfi); REGISTER_DECODER(BINK, bink); REGISTER_ENCDEC (BMP, bmp); REGISTER_DECODER(BMV_VIDEO, bmv_video); REGISTER_DECODER(BRENDER_PIX, brender_pix); REGISTER_DECODER(C93, c93); REGISTER_DECODER(CAVS, cavs); REGISTER_DECODER(CDGRAPHICS, cdgraphics); REGISTER_DECODER(CDXL, cdxl); REGISTER_DECODER(CFHD, cfhd); REGISTER_DECODER(CINEPAK, cinepak); REGISTER_ENCDEC (CLJR, cljr); REGISTER_DECODER(CLLC, cllc); REGISTER_ENCDEC (COMFORTNOISE, comfortnoise); REGISTER_DECODER(CSCD, cscd); REGISTER_DECODER(CYUV, cyuv); REGISTER_DECODER(DDS, dds); REGISTER_DECODER(DFA, dfa); REGISTER_ENCDEC (DNXHD, dnxhd); REGISTER_ENCDEC (DPX, dpx); REGISTER_DECODER(DSICINVIDEO, dsicinvideo); REGISTER_ENCDEC (DVVIDEO, dvvideo); REGISTER_DECODER(DXA, dxa); REGISTER_DECODER(DXTORY, dxtory); REGISTER_DECODER(DXV, dxv); REGISTER_DECODER(EACMV, eacmv); REGISTER_DECODER(EAMAD, eamad); REGISTER_DECODER(EATGQ, eatgq); REGISTER_DECODER(EATGV, eatgv); REGISTER_DECODER(EATQI, eatqi); REGISTER_DECODER(EIGHTBPS, eightbps); REGISTER_DECODER(EIGHTSVX_EXP, eightsvx_exp); REGISTER_DECODER(EIGHTSVX_FIB, eightsvx_fib); REGISTER_DECODER(ESCAPE124, escape124); REGISTER_DECODER(ESCAPE130, escape130); REGISTER_DECODER(EXR, exr); REGISTER_ENCDEC (FFV1, ffv1); REGISTER_ENCDEC (FFVHUFF, ffvhuff); REGISTER_DECODER(FIC, fic); REGISTER_ENCDEC (FLASHSV, flashsv); REGISTER_DECODER(FLASHSV2, flashsv2); REGISTER_DECODER(FLIC, flic); REGISTER_ENCDEC (FLV, flv); REGISTER_DECODER(FOURXM, fourxm); REGISTER_DECODER(FRAPS, fraps); REGISTER_DECODER(FRWU, frwu); REGISTER_DECODER(G2M, g2m); REGISTER_ENCDEC (GIF, gif); REGISTER_ENCDEC (H261, h261); REGISTER_ENCDEC (H263, h263); REGISTER_DECODER(H263I, h263i); REGISTER_ENCODER(H263P, h263p); REGISTER_DECODER(H264, h264); REGISTER_DECODER(H264_MMAL, h264_mmal); REGISTER_DECODER(H264_QSV, h264_qsv); REGISTER_ENCDEC (HAP, hap); REGISTER_DECODER(HEVC, hevc); REGISTER_DECODER(HEVC_QSV, hevc_qsv); REGISTER_DECODER(HNM4_VIDEO, hnm4_video); REGISTER_DECODER(HQ_HQA, hq_hqa); REGISTER_DECODER(HQX, hqx); REGISTER_ENCDEC (HUFFYUV, huffyuv); REGISTER_DECODER(IDCIN, idcin); REGISTER_DECODER(IFF_BYTERUN1, iff_byterun1); REGISTER_DECODER(IFF_ILBM, iff_ilbm); REGISTER_DECODER(INDEO2, indeo2); REGISTER_DECODER(INDEO3, indeo3); REGISTER_DECODER(INDEO4, indeo4); REGISTER_DECODER(INDEO5, indeo5); REGISTER_DECODER(INTERPLAY_VIDEO, interplay_video); REGISTER_DECODER(JPEG2000, jpeg2000); REGISTER_ENCDEC (JPEGLS, jpegls); REGISTER_DECODER(JV, jv); REGISTER_DECODER(KGV1, kgv1); REGISTER_DECODER(KMVC, kmvc); REGISTER_DECODER(LAGARITH, lagarith); REGISTER_ENCODER(LJPEG, ljpeg); REGISTER_DECODER(LOCO, loco); REGISTER_DECODER(MAGICYUV, magicyuv); REGISTER_DECODER(MDEC, mdec); REGISTER_DECODER(MIMIC, mimic); REGISTER_ENCDEC (MJPEG, mjpeg); REGISTER_DECODER(MJPEGB, mjpegb); REGISTER_DECODER(MMVIDEO, mmvideo); REGISTER_DECODER(MOTIONPIXELS, motionpixels); #if FF_API_XVMC REGISTER_DECODER(MPEG_XVMC, mpeg_xvmc); #endif /* FF_API_XVMC */ REGISTER_ENCDEC (MPEG1VIDEO, mpeg1video); REGISTER_ENCDEC (MPEG2VIDEO, mpeg2video); REGISTER_DECODER(MPEG2_MMAL, mpeg2_mmal); REGISTER_DECODER(MPEG2_QSV, mpeg2_qsv); REGISTER_ENCDEC (MPEG4, mpeg4); REGISTER_DECODER(MSA1, msa1); REGISTER_DECODER(MSMPEG4V1, msmpeg4v1); REGISTER_ENCDEC (MSMPEG4V2, msmpeg4v2); REGISTER_ENCDEC (MSMPEG4V3, msmpeg4v3); REGISTER_DECODER(MSRLE, msrle); REGISTER_DECODER(MSS1, mss1); REGISTER_DECODER(MSS2, mss2); REGISTER_DECODER(MSVIDEO1, msvideo1); REGISTER_DECODER(MSZH, mszh); REGISTER_DECODER(MTS2, mts2); REGISTER_DECODER(MVC1, mvc1); REGISTER_DECODER(MVC2, mvc2); REGISTER_DECODER(MXPEG, mxpeg); REGISTER_DECODER(NUV, nuv); REGISTER_DECODER(PAF_VIDEO, paf_video); REGISTER_ENCDEC (PAM, pam); REGISTER_ENCDEC (PBM, pbm); REGISTER_ENCDEC (PCX, pcx); REGISTER_ENCDEC (PGM, pgm); REGISTER_ENCDEC (PGMYUV, pgmyuv); REGISTER_DECODER(PICTOR, pictor); REGISTER_DECODER(PIXLET, pixlet); REGISTER_ENCDEC (PNG, png); REGISTER_ENCDEC (PPM, ppm); REGISTER_ENCDEC (PRORES, prores); REGISTER_DECODER(PTX, ptx); REGISTER_DECODER(QDRAW, qdraw); REGISTER_DECODER(QPEG, qpeg); REGISTER_ENCDEC (QTRLE, qtrle); REGISTER_DECODER(R10K, r10k); REGISTER_DECODER(R210, r210); REGISTER_ENCDEC (RAWVIDEO, rawvideo); REGISTER_DECODER(RL2, rl2); REGISTER_ENCDEC (ROQ, roq); REGISTER_DECODER(RPZA, rpza); REGISTER_DECODER(RSCC, rscc); REGISTER_ENCDEC (RV10, rv10); REGISTER_ENCDEC (RV20, rv20); REGISTER_DECODER(RV30, rv30); REGISTER_DECODER(RV40, rv40); REGISTER_DECODER(S302M, s302m); REGISTER_DECODER(SANM, sanm); REGISTER_DECODER(SCREENPRESSO, screenpresso); REGISTER_ENCDEC (SGI, sgi); REGISTER_DECODER(SGIRLE, sgirle); REGISTER_DECODER(SMACKER, smacker); REGISTER_DECODER(SMC, smc); REGISTER_DECODER(SP5X, sp5x); REGISTER_ENCDEC (SUNRAST, sunrast); REGISTER_ENCDEC (SVQ1, svq1); REGISTER_DECODER(SVQ3, svq3); REGISTER_ENCDEC (TARGA, targa); REGISTER_DECODER(TDSC, tdsc); REGISTER_DECODER(THEORA, theora); REGISTER_DECODER(THP, thp); REGISTER_DECODER(TIERTEXSEQVIDEO, tiertexseqvideo); REGISTER_ENCDEC (TIFF, tiff); REGISTER_DECODER(TMV, tmv); REGISTER_DECODER(TRUEMOTION1, truemotion1); REGISTER_DECODER(TRUEMOTION2, truemotion2); REGISTER_DECODER(TRUEMOTION2RT, truemotion2rt); REGISTER_DECODER(TSCC, tscc); REGISTER_DECODER(TSCC2, tscc2); REGISTER_DECODER(TXD, txd); REGISTER_DECODER(ULTI, ulti); REGISTER_ENCDEC (UTVIDEO, utvideo); REGISTER_ENCDEC (V210, v210); REGISTER_DECODER(V210X, v210x); REGISTER_ENCDEC (V410, v410); REGISTER_DECODER(VB, vb); REGISTER_DECODER(VBLE, vble); REGISTER_DECODER(VC1, vc1); REGISTER_DECODER(VC1IMAGE, vc1image); REGISTER_DECODER(VC1_MMAL, vc1_mmal); REGISTER_DECODER(VC1_QSV, vc1_qsv); REGISTER_DECODER(VCR1, vcr1); REGISTER_DECODER(VMDVIDEO, vmdvideo); REGISTER_DECODER(VMNC, vmnc); REGISTER_DECODER(VP3, vp3); REGISTER_DECODER(VP5, vp5); REGISTER_DECODER(VP6, vp6); REGISTER_DECODER(VP6A, vp6a); REGISTER_DECODER(VP6F, vp6f); REGISTER_DECODER(VP7, vp7); REGISTER_DECODER(VP8, vp8); REGISTER_DECODER(VP8_QSV, vp8_qsv); REGISTER_DECODER(VP9, vp9); REGISTER_DECODER(VQA, vqa); REGISTER_DECODER(WEBP, webp); REGISTER_ENCODER(WRAPPED_AVFRAME, wrapped_avframe); REGISTER_ENCDEC (WMV1, wmv1); REGISTER_ENCDEC (WMV2, wmv2); REGISTER_DECODER(WMV3, wmv3); REGISTER_DECODER(WMV3IMAGE, wmv3image); REGISTER_DECODER(WNV1, wnv1); REGISTER_DECODER(XAN_WC3, xan_wc3); REGISTER_DECODER(XAN_WC4, xan_wc4); REGISTER_ENCDEC (XBM, xbm); REGISTER_DECODER(XL, xl); REGISTER_ENCDEC (XWD, xwd); REGISTER_DECODER(YOP, yop); REGISTER_DECODER(ZEROCODEC, zerocodec); REGISTER_ENCDEC (ZLIB, zlib); REGISTER_ENCDEC (ZMBV, zmbv); /* audio codecs */ REGISTER_ENCDEC (AAC, aac); REGISTER_DECODER(AAC_LATM, aac_latm); REGISTER_ENCDEC (AC3, ac3); REGISTER_ENCODER(AC3_FIXED, ac3_fixed); REGISTER_ENCDEC (ALAC, alac); REGISTER_DECODER(ALS, als); REGISTER_DECODER(AMRNB, amrnb); REGISTER_DECODER(AMRWB, amrwb); REGISTER_DECODER(APE, ape); REGISTER_DECODER(ATRAC1, atrac1); REGISTER_DECODER(ATRAC3, atrac3); REGISTER_DECODER(ATRAC3P, atrac3p); REGISTER_DECODER(BINKAUDIO_DCT, binkaudio_dct); REGISTER_DECODER(BINKAUDIO_RDFT, binkaudio_rdft); REGISTER_DECODER(BMV_AUDIO, bmv_audio); REGISTER_DECODER(COOK, cook); REGISTER_DECODER(DCA, dca); REGISTER_DECODER(DSICINAUDIO, dsicinaudio); REGISTER_DECODER(DSS_SP, dss_sp); REGISTER_ENCDEC (EAC3, eac3); REGISTER_ENCDEC (FLAC, flac); REGISTER_ENCDEC (G723_1, g723_1); REGISTER_DECODER(GSM, gsm); REGISTER_DECODER(GSM_MS, gsm_ms); REGISTER_DECODER(IAC, iac); REGISTER_DECODER(IMC, imc); REGISTER_DECODER(MACE3, mace3); REGISTER_DECODER(MACE6, mace6); REGISTER_DECODER(METASOUND, metasound); REGISTER_DECODER(MLP, mlp); REGISTER_DECODER(MP1, mp1); REGISTER_DECODER(MP1FLOAT, mp1float); REGISTER_ENCDEC (MP2, mp2); REGISTER_DECODER(MP2FLOAT, mp2float); REGISTER_DECODER(MP3, mp3); REGISTER_DECODER(MP3FLOAT, mp3float); REGISTER_DECODER(MP3ADU, mp3adu); REGISTER_DECODER(MP3ADUFLOAT, mp3adufloat); REGISTER_DECODER(MP3ON4, mp3on4); REGISTER_DECODER(MP3ON4FLOAT, mp3on4float); REGISTER_DECODER(MPC7, mpc7); REGISTER_DECODER(MPC8, mpc8); REGISTER_ENCDEC (NELLYMOSER, nellymoser); REGISTER_DECODER(ON2AVC, on2avc); REGISTER_DECODER(OPUS, opus); REGISTER_DECODER(PAF_AUDIO, paf_audio); REGISTER_DECODER(QCELP, qcelp); REGISTER_DECODER(QDM2, qdm2); REGISTER_ENCDEC (RA_144, ra_144); REGISTER_DECODER(RA_288, ra_288); REGISTER_DECODER(RALF, ralf); REGISTER_DECODER(SHORTEN, shorten); REGISTER_DECODER(SIPR, sipr); REGISTER_DECODER(SMACKAUD, smackaud); REGISTER_DECODER(TAK, tak); REGISTER_DECODER(TRUEHD, truehd); REGISTER_DECODER(TRUESPEECH, truespeech); REGISTER_DECODER(TTA, tta); REGISTER_DECODER(TWINVQ, twinvq); REGISTER_DECODER(VMDAUDIO, vmdaudio); REGISTER_ENCDEC (VORBIS, vorbis); REGISTER_DECODER(WAVPACK, wavpack); REGISTER_DECODER(WMALOSSLESS, wmalossless); REGISTER_DECODER(WMAPRO, wmapro); REGISTER_ENCDEC (WMAV1, wmav1); REGISTER_ENCDEC (WMAV2, wmav2); REGISTER_DECODER(WMAVOICE, wmavoice); REGISTER_DECODER(WS_SND1, ws_snd1); /* PCM codecs */ REGISTER_ENCDEC (PCM_ALAW, pcm_alaw); REGISTER_DECODER(PCM_BLURAY, pcm_bluray); REGISTER_DECODER(PCM_DVD, pcm_dvd); REGISTER_ENCDEC (PCM_F32BE, pcm_f32be); REGISTER_ENCDEC (PCM_F32LE, pcm_f32le); REGISTER_ENCDEC (PCM_F64BE, pcm_f64be); REGISTER_ENCDEC (PCM_F64LE, pcm_f64le); REGISTER_DECODER(PCM_LXF, pcm_lxf); REGISTER_ENCDEC (PCM_MULAW, pcm_mulaw); REGISTER_ENCDEC (PCM_S8, pcm_s8); REGISTER_DECODER(PCM_S8_PLANAR, pcm_s8_planar); REGISTER_ENCDEC (PCM_S16BE, pcm_s16be); REGISTER_DECODER(PCM_S16BE_PLANAR, pcm_s16be_planar); REGISTER_ENCDEC (PCM_S16LE, pcm_s16le); REGISTER_DECODER(PCM_S16LE_PLANAR, pcm_s16le_planar); REGISTER_ENCDEC (PCM_S24BE, pcm_s24be); REGISTER_ENCDEC (PCM_S24DAUD, pcm_s24daud); REGISTER_ENCDEC (PCM_S24LE, pcm_s24le); REGISTER_DECODER(PCM_S24LE_PLANAR, pcm_s24le_planar); REGISTER_ENCDEC (PCM_S32BE, pcm_s32be); REGISTER_ENCDEC (PCM_S32LE, pcm_s32le); REGISTER_DECODER(PCM_S32LE_PLANAR, pcm_s32le_planar); REGISTER_ENCDEC (PCM_U8, pcm_u8); REGISTER_ENCDEC (PCM_U16BE, pcm_u16be); REGISTER_ENCDEC (PCM_U16LE, pcm_u16le); REGISTER_ENCDEC (PCM_U24BE, pcm_u24be); REGISTER_ENCDEC (PCM_U24LE, pcm_u24le); REGISTER_ENCDEC (PCM_U32BE, pcm_u32be); REGISTER_ENCDEC (PCM_U32LE, pcm_u32le); REGISTER_DECODER(PCM_ZORK , pcm_zork); /* DPCM codecs */ REGISTER_DECODER(INTERPLAY_DPCM, interplay_dpcm); REGISTER_ENCDEC (ROQ_DPCM, roq_dpcm); REGISTER_DECODER(SOL_DPCM, sol_dpcm); REGISTER_DECODER(XAN_DPCM, xan_dpcm); /* ADPCM codecs */ REGISTER_DECODER(ADPCM_4XM, adpcm_4xm); REGISTER_ENCDEC (ADPCM_ADX, adpcm_adx); REGISTER_DECODER(ADPCM_CT, adpcm_ct); REGISTER_DECODER(ADPCM_EA, adpcm_ea); REGISTER_DECODER(ADPCM_EA_MAXIS_XA, adpcm_ea_maxis_xa); REGISTER_DECODER(ADPCM_EA_R1, adpcm_ea_r1); REGISTER_DECODER(ADPCM_EA_R2, adpcm_ea_r2); REGISTER_DECODER(ADPCM_EA_R3, adpcm_ea_r3); REGISTER_DECODER(ADPCM_EA_XAS, adpcm_ea_xas); REGISTER_ENCDEC (ADPCM_G722, adpcm_g722); REGISTER_ENCDEC (ADPCM_G726, adpcm_g726); REGISTER_DECODER(ADPCM_IMA_AMV, adpcm_ima_amv); REGISTER_DECODER(ADPCM_IMA_APC, adpcm_ima_apc); REGISTER_DECODER(ADPCM_IMA_DK3, adpcm_ima_dk3); REGISTER_DECODER(ADPCM_IMA_DK4, adpcm_ima_dk4); REGISTER_DECODER(ADPCM_IMA_EA_EACS, adpcm_ima_ea_eacs); REGISTER_DECODER(ADPCM_IMA_EA_SEAD, adpcm_ima_ea_sead); REGISTER_DECODER(ADPCM_IMA_ISS, adpcm_ima_iss); REGISTER_ENCDEC (ADPCM_IMA_QT, adpcm_ima_qt); REGISTER_DECODER(ADPCM_IMA_SMJPEG, adpcm_ima_smjpeg); REGISTER_ENCDEC (ADPCM_IMA_WAV, adpcm_ima_wav); REGISTER_DECODER(ADPCM_IMA_WS, adpcm_ima_ws); REGISTER_ENCDEC (ADPCM_MS, adpcm_ms); REGISTER_DECODER(ADPCM_SBPRO_2, adpcm_sbpro_2); REGISTER_DECODER(ADPCM_SBPRO_3, adpcm_sbpro_3); REGISTER_DECODER(ADPCM_SBPRO_4, adpcm_sbpro_4); REGISTER_ENCDEC (ADPCM_SWF, adpcm_swf); REGISTER_DECODER(ADPCM_THP, adpcm_thp); REGISTER_DECODER(ADPCM_VIMA, adpcm_vima); REGISTER_DECODER(ADPCM_XA, adpcm_xa); REGISTER_ENCDEC (ADPCM_YAMAHA, adpcm_yamaha); /* subtitles */ REGISTER_ENCDEC (ASS, ass); REGISTER_ENCDEC (DVBSUB, dvbsub); REGISTER_ENCDEC (DVDSUB, dvdsub); REGISTER_DECODER(PGSSUB, pgssub); REGISTER_DECODER(SRT, srt); REGISTER_ENCDEC (XSUB, xsub); /* external libraries */ REGISTER_DECODER(LIBDCADEC, libdcadec) REGISTER_ENCODER(LIBFAAC, libfaac); REGISTER_ENCDEC (LIBFDK_AAC, libfdk_aac); REGISTER_ENCDEC (LIBGSM, libgsm); REGISTER_ENCDEC (LIBGSM_MS, libgsm_ms); REGISTER_ENCDEC (LIBILBC, libilbc); REGISTER_ENCODER(LIBMP3LAME, libmp3lame); REGISTER_ENCDEC (LIBOPENCORE_AMRNB, libopencore_amrnb); REGISTER_DECODER(LIBOPENCORE_AMRWB, libopencore_amrwb); REGISTER_ENCDEC (LIBOPENJPEG, libopenjpeg); REGISTER_ENCDEC (LIBOPUS, libopus); REGISTER_ENCDEC (LIBSCHROEDINGER, libschroedinger); REGISTER_ENCDEC (LIBSPEEX, libspeex); REGISTER_ENCODER(LIBTHEORA, libtheora); REGISTER_ENCODER(LIBTWOLAME, libtwolame); REGISTER_ENCODER(LIBVO_AACENC, libvo_aacenc); REGISTER_ENCODER(LIBVO_AMRWBENC, libvo_amrwbenc); REGISTER_ENCODER(LIBVORBIS, libvorbis); REGISTER_ENCDEC (LIBVPX_VP8, libvpx_vp8); REGISTER_ENCDEC (LIBVPX_VP9, libvpx_vp9); REGISTER_ENCODER(LIBWAVPACK, libwavpack); REGISTER_ENCODER(LIBWEBP, libwebp); REGISTER_ENCODER(LIBX262, libx262); REGISTER_ENCODER(LIBX264, libx264); REGISTER_ENCODER(LIBX265, libx265); REGISTER_ENCODER(LIBXAVS, libxavs); REGISTER_ENCODER(LIBXVID, libxvid); /* external libraries, that shouldn't be used by default if one of the * above is available */ REGISTER_ENCDEC (LIBOPENH264, libopenh264); REGISTER_ENCODER(H264_NVENC, h264_nvenc); REGISTER_ENCODER(H264_OMX, h264_omx); REGISTER_ENCODER(H264_QSV, h264_qsv); REGISTER_ENCODER(H264_VAAPI, h264_vaapi); REGISTER_ENCODER(LIBKVAZAAR, libkvazaar); REGISTER_ENCODER(HEVC_NVENC, hevc_nvenc); REGISTER_ENCODER(HEVC_QSV, hevc_qsv); REGISTER_ENCODER(HEVC_VAAPI, hevc_vaapi); REGISTER_ENCODER(MJPEG_VAAPI, mjpeg_vaapi); REGISTER_ENCODER(MPEG2_QSV, mpeg2_qsv); REGISTER_ENCODER(MPEG2_VAAPI, mpeg2_vaapi); REGISTER_ENCODER(MPEG4_OMX, mpeg4_omx); #if FF_API_NVENC_OLD_NAME REGISTER_ENCODER(NVENC_H264, nvenc_h264); REGISTER_ENCODER(NVENC_HEVC, nvenc_hevc); #endif REGISTER_ENCODER(VP8_VAAPI, vp8_vaapi); /* parsers */ REGISTER_PARSER(AAC, aac); REGISTER_PARSER(AAC_LATM, aac_latm); REGISTER_PARSER(AC3, ac3); REGISTER_PARSER(ADX, adx); REGISTER_PARSER(BMP, bmp); REGISTER_PARSER(CAVSVIDEO, cavsvideo); REGISTER_PARSER(COOK, cook); REGISTER_PARSER(DCA, dca); REGISTER_PARSER(DIRAC, dirac); REGISTER_PARSER(DNXHD, dnxhd); REGISTER_PARSER(DPX, dpx); REGISTER_PARSER(DVBSUB, dvbsub); REGISTER_PARSER(DVDSUB, dvdsub); REGISTER_PARSER(FLAC, flac); REGISTER_PARSER(GSM, gsm); REGISTER_PARSER(H261, h261); REGISTER_PARSER(H263, h263); REGISTER_PARSER(H264, h264); REGISTER_PARSER(HEVC, hevc); REGISTER_PARSER(MJPEG, mjpeg); REGISTER_PARSER(MLP, mlp); REGISTER_PARSER(MPEG4VIDEO, mpeg4video); REGISTER_PARSER(MPEGAUDIO, mpegaudio); REGISTER_PARSER(MPEGVIDEO, mpegvideo); REGISTER_PARSER(OPUS, opus); REGISTER_PARSER(PNG, png); REGISTER_PARSER(PNM, pnm); REGISTER_PARSER(RV30, rv30); REGISTER_PARSER(RV40, rv40); REGISTER_PARSER(TAK, tak); REGISTER_PARSER(VC1, vc1); REGISTER_PARSER(VORBIS, vorbis); REGISTER_PARSER(VP3, vp3); REGISTER_PARSER(VP8, vp8); }","No, it is non-vulnerable."188186,"int ff_audio_convert(AudioConvert *ac, AudioData *out, AudioData *in) { int use_generic = 1; int len = in->nb_samples; int p; if (ac->dc) { /* dithered conversion */ av_dlog(ac->avr, ""%d samples - audio_convert: %s to %s (dithered)\n"", len, av_get_sample_fmt_name(ac->in_fmt), av_get_sample_fmt_name(ac->out_fmt)); return ff_convert_dither(ac->dc, out, in); } /* determine whether to use the optimized function based on pointer and samples alignment in both the input and output */ if (ac->has_optimized_func) { int ptr_align = FFMIN(in->ptr_align, out->ptr_align); int samples_align = FFMIN(in->samples_align, out->samples_align); int aligned_len = FFALIGN(len, ac->samples_align); if (!(ptr_align % ac->ptr_align) && samples_align >= aligned_len) { len = aligned_len; use_generic = 0; } } av_dlog(ac->avr, ""%d samples - audio_convert: %s to %s (%s)\n"", len, av_get_sample_fmt_name(ac->in_fmt), av_get_sample_fmt_name(ac->out_fmt), use_generic ? ac->func_descr_generic : ac->func_descr); if (ac->apply_map) { ChannelMapInfo *map = &ac->avr->ch_map_info; if (!av_sample_fmt_is_planar(ac->out_fmt)) { av_log(ac->avr, AV_LOG_ERROR, ""cannot remap packed format during conversion\n""); return AVERROR(EINVAL); } if (map->do_remap) { if (av_sample_fmt_is_planar(ac->in_fmt)) { conv_func_flat *convert = use_generic ? ac->conv_flat_generic : ac->conv_flat; for (p = 0; p < ac->planes; p++) if (map->channel_map[p] >= 0) convert(out->data[p], in->data[map->channel_map[p]], len); } else { uint8_t *data[AVRESAMPLE_MAX_CHANNELS]; conv_func_deinterleave *convert = use_generic ? ac->conv_deinterleave_generic : ac->conv_deinterleave; for (p = 0; p < ac->channels; p++) data[map->input_map[p]] = out->data[p]; convert(data, in->data[0], len, ac->channels); } } if (map->do_copy || map->do_zero) { for (p = 0; p < ac->planes; p++) { if (map->channel_copy[p]) memcpy(out->data[p], out->data[map->channel_copy[p]], len * out->stride); else if (map->channel_zero[p]) av_samples_set_silence(&out->data[p], 0, len, 1, ac->out_fmt); } } } else { switch (ac->func_type) { case CONV_FUNC_TYPE_FLAT: { if (!in->is_planar) len *= in->channels; if (use_generic) { for (p = 0; p < ac->planes; p++) ac->conv_flat_generic(out->data[p], in->data[p], len); } else { for (p = 0; p < ac->planes; p++) ac->conv_flat(out->data[p], in->data[p], len); } break; } case CONV_FUNC_TYPE_INTERLEAVE: if (use_generic) ac->conv_interleave_generic(out->data[0], in->data, len, ac->channels); else ac->conv_interleave(out->data[0], in->data, len, ac->channels); break; case CONV_FUNC_TYPE_DEINTERLEAVE: if (use_generic) ac->conv_deinterleave_generic(out->data, in->data[0], len, ac->channels); else ac->conv_deinterleave(out->data, in->data[0], len, ac->channels); break; } } out->nb_samples = in->nb_samples; return 0; }","No, it is non-vulnerable."189187,"static int qcow2_set_up_encryption(BlockDriverState *bs, const char *encryptfmt, QemuOpts *opts, Error **errp) { BDRVQcow2State *s = bs->opaque; QCryptoBlockCreateOptions *cryptoopts = NULL; QCryptoBlock *crypto = NULL; int ret = -EINVAL; QDict *options, *encryptopts; options = qemu_opts_to_qdict(opts, NULL); qdict_extract_subqdict(options, &encryptopts, ""encrypt.""); QDECREF(options); if (!g_str_equal(encryptfmt, ""aes"")) { error_setg(errp, ""Unknown encryption format '%s', expected 'aes'"", encryptfmt); ret = -EINVAL; goto out; } cryptoopts = block_crypto_create_opts_init( Q_CRYPTO_BLOCK_FORMAT_QCOW, encryptopts, errp); if (!cryptoopts) { ret = -EINVAL; goto out; } s->crypt_method_header = QCOW_CRYPT_AES; crypto = qcrypto_block_create(cryptoopts, NULL, NULL, bs, errp); if (!crypto) { ret = -EINVAL; goto out; } ret = qcow2_update_header(bs); if (ret < 0) { error_setg_errno(errp, -ret, ""Could not write encryption header""); goto out; } out: QDECREF(encryptopts); qcrypto_block_free(crypto); qapi_free_QCryptoBlockCreateOptions(cryptoopts); return ret; }","Yes, it is vulnerable."190188,"static void tilegx_cpu_class_init(ObjectClass *oc, void *data) { DeviceClass *dc = DEVICE_CLASS(oc); CPUClass *cc = CPU_CLASS(oc); TileGXCPUClass *tcc = TILEGX_CPU_CLASS(oc); tcc->parent_realize = dc->realize; dc->realize = tilegx_cpu_realizefn; tcc->parent_reset = cc->reset; cc->reset = tilegx_cpu_reset; cc->has_work = tilegx_cpu_has_work; cc->do_interrupt = tilegx_cpu_do_interrupt; cc->cpu_exec_interrupt = tilegx_cpu_exec_interrupt; cc->dump_state = tilegx_cpu_dump_state; cc->set_pc = tilegx_cpu_set_pc; cc->handle_mmu_fault = tilegx_cpu_handle_mmu_fault; cc->gdb_num_core_regs = 0; }","Yes, it is vulnerable."191189,static inline void downmix_2f_1r_to_stereo(float *samples) { int i; for (i = 0; i < 256; i++) { samples[i] += samples[i + 512]; samples[i + 256] += samples[i + 512]; samples[i + 512] = 0; } },"No, it is non-vulnerable."192190,static PayloadContext *h264_new_extradata(void) { PayloadContext *data = av_mallocz(sizeof(PayloadContext) + FF_INPUT_BUFFER_PADDING_SIZE); if (data) { data->cookie = MAGIC_COOKIE; } return data; },"No, it is non-vulnerable."193191,"static void dma_complete(DMAAIOCB *dbs, int ret) { trace_dma_complete(dbs, ret, dbs->common.cb); dma_bdrv_unmap(dbs); if (dbs->common.cb) { dbs->common.cb(dbs->common.opaque, ret); } qemu_iovec_destroy(&dbs->iov); if (dbs->bh) { qemu_bh_delete(dbs->bh); dbs->bh = NULL; } qemu_aio_unref(dbs); }","No, it is non-vulnerable."194192,"static int proxy_mkdir(FsContext *fs_ctx, V9fsPath *dir_path, const char *name, FsCred *credp) { int retval; V9fsString fullname; v9fs_string_init(&fullname); v9fs_string_sprintf(&fullname, ""%s/%s"", dir_path->data, name); retval = v9fs_request(fs_ctx->private, T_MKDIR, NULL, &fullname, credp->fc_mode, credp->fc_uid, credp->fc_gid); v9fs_string_free(&fullname); if (retval < 0) { errno = -retval; retval = -1; } v9fs_string_free(&fullname); return retval; }","Yes, it is vulnerable."195193,"static int decode_init_thread_copy(AVCodecContext *avctx) { H264Context *h = avctx->priv_data; if (!avctx->internal->is_copy) return 0; memset(h->sps_buffers, 0, sizeof(h->sps_buffers)); memset(h->pps_buffers, 0, sizeof(h->pps_buffers)); h->rbsp_buffer[0] = NULL; h->rbsp_buffer[1] = NULL; h->rbsp_buffer_size[0] = 0; h->rbsp_buffer_size[1] = 0; h->context_initialized = 0; return 0; }","Yes, it is vulnerable."196194,"static int dvvideo_decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8_t *buf, int buf_size) { DVVideoContext *s = avctx->priv_data; s->sys = dv_frame_profile(buf); if (!s->sys || buf_size < s->sys->frame_size) return -1; /* NOTE: we only accept several full frames */ if(s->picture.data[0]) avctx->release_buffer(avctx, &s->picture); s->picture.reference = 0; s->picture.key_frame = 1; s->picture.pict_type = FF_I_TYPE; avctx->pix_fmt = s->sys->pix_fmt; avcodec_set_dimensions(avctx, s->sys->width, s->sys->height); if(avctx->get_buffer(avctx, &s->picture) < 0) { av_log(avctx, AV_LOG_ERROR, ""get_buffer() failed\n""); return -1; } s->picture.interlaced_frame = 1; s->picture.top_field_first = 0; s->buf = buf; avctx->execute(avctx, dv_decode_mt, (void**)&dv_anchor[0], NULL, s->sys->difseg_size * 27); emms_c(); /* return image */ *data_size = sizeof(AVFrame); *(AVFrame*)data= s->picture; return s->sys->frame_size; }","Yes, it is vulnerable."197195,"static uint32_t eepro100_read4(EEPRO100State * s, uint32_t addr) { uint32_t val; if (addr <= sizeof(s->mem) - sizeof(val)) { memcpy(&val, &s->mem[addr], sizeof(val)); } switch (addr) { case SCBStatus: TRACE(OTHER, logout(""addr=%s val=0x%08x\n"", regname(addr), val)); break; case SCBPointer: #if 0 val = eepro100_read_pointer(s); #endif TRACE(OTHER, logout(""addr=%s val=0x%08x\n"", regname(addr), val)); break; case SCBPort: val = eepro100_read_port(s); TRACE(OTHER, logout(""addr=%s val=0x%08x\n"", regname(addr), val)); break; case SCBCtrlMDI: val = eepro100_read_mdi(s); break; default: logout(""addr=%s val=0x%08x\n"", regname(addr), val); missing(""unknown longword read""); } return val; }","Yes, it is vulnerable."198196,"static void mpeg_er_decode_mb(void *opaque, int ref, int mv_dir, int mv_type, int (*mv)[2][4][2], int mb_x, int mb_y, int mb_intra, int mb_skipped) { MpegEncContext *s = opaque; s->mv_dir = mv_dir; s->mv_type = mv_type; s->mb_intra = mb_intra; s->mb_skipped = mb_skipped; s->mb_x = mb_x; s->mb_y = mb_y; memcpy(s->mv, mv, sizeof(*mv)); ff_init_block_index(s); ff_update_block_index(s); s->dsp.clear_blocks(s->block[0]); s->dest[0] = s->current_picture.f.data[0] + (s->mb_y * 16 * s->linesize) + s->mb_x * 16; s->dest[1] = s->current_picture.f.data[1] + (s->mb_y * (16 >> s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16 >> s->chroma_x_shift); s->dest[2] = s->current_picture.f.data[2] + (s->mb_y * (16 >> s->chroma_y_shift) * s->uvlinesize) + s->mb_x * (16 >> s->chroma_x_shift); assert(ref == 0); ff_MPV_decode_mb(s, s->block); }","Yes, it is vulnerable."199197,"static abi_long do_setsockopt(int sockfd, int level, int optname, abi_ulong optval_addr, socklen_t optlen) { abi_long ret; int val; struct ip_mreqn *ip_mreq; struct ip_mreq_source *ip_mreq_source; switch(level) { case SOL_TCP: /* TCP options all take an 'int' value. */ if (optlen < sizeof(uint32_t)) return -TARGET_EINVAL; if (get_user_u32(val, optval_addr)) return -TARGET_EFAULT; ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val))); break; case SOL_IP: switch(optname) { case IP_TOS: case IP_TTL: case IP_HDRINCL: case IP_ROUTER_ALERT: case IP_RECVOPTS: case IP_RETOPTS: case IP_PKTINFO: case IP_MTU_DISCOVER: case IP_RECVERR: case IP_RECVTOS: #ifdef IP_FREEBIND case IP_FREEBIND: #endif case IP_MULTICAST_TTL: case IP_MULTICAST_LOOP: val = 0; if (optlen >= sizeof(uint32_t)) { if (get_user_u32(val, optval_addr)) return -TARGET_EFAULT; } else if (optlen >= 1) { if (get_user_u8(val, optval_addr)) return -TARGET_EFAULT; } ret = get_errno(setsockopt(sockfd, level, optname, &val, sizeof(val))); break; case IP_ADD_MEMBERSHIP: case IP_DROP_MEMBERSHIP: if (optlen < sizeof (struct target_ip_mreq) || optlen > sizeof (struct target_ip_mreqn)) return -TARGET_EINVAL; ip_mreq = (struct ip_mreqn *) alloca(optlen); target_to_host_ip_mreq(ip_mreq, optval_addr, optlen); ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq, optlen)); break; case IP_BLOCK_SOURCE: case IP_UNBLOCK_SOURCE: case IP_ADD_SOURCE_MEMBERSHIP: case IP_DROP_SOURCE_MEMBERSHIP: if (optlen != sizeof (struct target_ip_mreq_source)) return -TARGET_EINVAL; ip_mreq_source = lock_user(VERIFY_READ, optval_addr, optlen, 1); ret = get_errno(setsockopt(sockfd, level, optname, ip_mreq_source, optlen)); unlock_user (ip_mreq_source, optval_addr, 0); break; default: goto unimplemented; } break; case TARGET_SOL_SOCKET: switch (optname) { /* Options with 'int' argument. */ case TARGET_SO_DEBUG: optname = SO_DEBUG; break; case TARGET_SO_REUSEADDR: optname = SO_REUSEADDR; break; case TARGET_SO_TYPE: optname = SO_TYPE; break; case TARGET_SO_ERROR: optname = SO_ERROR; break; case TARGET_SO_DONTROUTE: optname = SO_DONTROUTE; break; case TARGET_SO_BROADCAST: optname = SO_BROADCAST; break; case TARGET_SO_SNDBUF: optname = SO_SNDBUF; break; case TARGET_SO_RCVBUF: optname = SO_RCVBUF; break; case TARGET_SO_KEEPALIVE: optname = SO_KEEPALIVE; break; case TARGET_SO_OOBINLINE: optname = SO_OOBINLINE; break; case TARGET_SO_NO_CHECK: optname = SO_NO_CHECK; break; case TARGET_SO_PRIORITY: optname = SO_PRIORITY; break; #ifdef SO_BSDCOMPAT case TARGET_SO_BSDCOMPAT: optname = SO_BSDCOMPAT; break; #endif case TARGET_SO_PASSCRED: optname = SO_PASSCRED; break; case TARGET_SO_TIMESTAMP: optname = SO_TIMESTAMP; break; case TARGET_SO_RCVLOWAT: optname = SO_RCVLOWAT; break; case TARGET_SO_RCVTIMEO: optname = SO_RCVTIMEO; break; case TARGET_SO_SNDTIMEO: optname = SO_SNDTIMEO; break; break; default: goto unimplemented; } if (optlen < sizeof(uint32_t)) return -TARGET_EINVAL; if (get_user_u32(val, optval_addr)) return -TARGET_EFAULT; ret = get_errno(setsockopt(sockfd, SOL_SOCKET, optname, &val, sizeof(val))); break; default: unimplemented: gemu_log(""Unsupported setsockopt level=%d optname=%d \n"", level, optname); ret = -TARGET_ENOPROTOOPT; } return ret; }","No, it is non-vulnerable."200198,"void vty_putchars(VIOsPAPRDevice *sdev, uint8_t *buf, int len) { VIOsPAPRVTYDevice *dev = VIO_SPAPR_VTY_DEVICE(sdev); /* FIXME: should check the qemu_chr_fe_write() return value */ qemu_chr_fe_write(dev->chardev, buf, len); }","Yes, it is vulnerable."201199,"static inline int cris_addc_m(int a, const int *b) { asm volatile (""addc [%1], %0\n"" : ""+r"" (a) : ""r"" (b)); return a; }","Yes, it is vulnerable."202200,"int av_find_stream_info(AVFormatContext *ic) { int i, count, ret, read_size, j; AVStream *st; AVPacket pkt1, *pkt; AVPacketList *pktl=NULL, **ppktl; int64_t last_dts[MAX_STREAMS]; int duration_count[MAX_STREAMS]={0}; double duration_error[MAX_STREAMS][MAX_STD_TIMEBASES]={{0}}; //FIXME malloc()? offset_t old_offset = url_ftell(&ic->pb); for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if(st->codec->codec_type == CODEC_TYPE_VIDEO){ /* if(!st->time_base.num) st->time_base= */ if(!st->codec->time_base.num) st->codec->time_base= st->time_base; } //only for the split stuff if (!st->parser) { st->parser = av_parser_init(st->codec->codec_id); if(st->need_parsing == 2 && st->parser){ st->parser->flags |= PARSER_FLAG_COMPLETE_FRAMES; } } } for(i=0;i<MAX_STREAMS;i++){ last_dts[i]= AV_NOPTS_VALUE; } count = 0; read_size = 0; ppktl = &ic->packet_buffer; for(;;) { /* check if one codec still needs to be handled */ for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if (!has_codec_parameters(st->codec)) break; /* variable fps and no guess at the real fps */ if( st->codec->time_base.den >= 101LL*st->codec->time_base.num && duration_count[i]<20 && st->codec->codec_type == CODEC_TYPE_VIDEO) break; if(st->parser && st->parser->parser->split && !st->codec->extradata) break; } if (i == ic->nb_streams) { /* NOTE: if the format has no header, then we need to read some packets to get most of the streams, so we cannot stop here */ if (!(ic->ctx_flags & AVFMTCTX_NOHEADER)) { /* if we found the info for all the codecs, we can stop */ ret = count; break; } } /* we did not get all the codec info, but we read too much data */ if (read_size >= MAX_READ_SIZE) { ret = count; break; } /* NOTE: a new stream can be added there if no header in file (AVFMTCTX_NOHEADER) */ ret = av_read_frame_internal(ic, &pkt1); if (ret < 0) { /* EOF or error */ ret = -1; /* we could not have all the codec parameters before EOF */ for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if (!has_codec_parameters(st->codec)){ char buf[256]; avcodec_string(buf, sizeof(buf), st->codec, 0); av_log(ic, AV_LOG_INFO, ""Could not find codec parameters (%s)\n"", buf); } else { ret = 0; } } break; } pktl = av_mallocz(sizeof(AVPacketList)); if (!pktl) { ret = AVERROR_NOMEM; break; } /* add the packet in the buffered packet list */ *ppktl = pktl; ppktl = &pktl->next; pkt = &pktl->pkt; *pkt = pkt1; /* duplicate the packet */ if (av_dup_packet(pkt) < 0) { ret = AVERROR_NOMEM; break; } read_size += pkt->size; st = ic->streams[pkt->stream_index]; if(st->codec_info_nb_frames>1) //FIXME move codec_info_nb_frames and codec_info_duration from AVStream into this func st->codec_info_duration += pkt->duration; if (pkt->duration != 0) st->codec_info_nb_frames++; { int index= pkt->stream_index; int64_t last= last_dts[index]; int64_t duration= pkt->dts - last; if(pkt->dts != AV_NOPTS_VALUE && last != AV_NOPTS_VALUE && duration>0){ double dur= duration * av_q2d(st->time_base); // if(st->codec->codec_type == CODEC_TYPE_VIDEO) // av_log(NULL, AV_LOG_ERROR, ""%f\n"", dur); if(duration_count[index] < 2) memset(duration_error, 0, sizeof(duration_error)); for(i=1; i<MAX_STD_TIMEBASES; i++){ int framerate= get_std_framerate(i); int ticks= lrintf(dur*framerate/(1001*12)); double error= dur - ticks*1001*12/(double)framerate; duration_error[index][i] += error*error; } duration_count[index]++; if(st->codec_info_nb_frames == 0 && 0) st->codec_info_duration += duration; } if(last == AV_NOPTS_VALUE || duration_count[index]<=1) last_dts[pkt->stream_index]= pkt->dts; } if(st->parser && st->parser->parser->split && !st->codec->extradata){ int i= st->parser->parser->split(st->codec, pkt->data, pkt->size); if(i){ st->codec->extradata_size= i; st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(st->codec->extradata, pkt->data, st->codec->extradata_size); memset(st->codec->extradata + i, 0, FF_INPUT_BUFFER_PADDING_SIZE); } } /* if still no information, we try to open the codec and to decompress the frame. We try to avoid that in most cases as it takes longer and uses more memory. For MPEG4, we need to decompress for Quicktime. */ if (!has_codec_parameters(st->codec) /*&& (st->codec->codec_id == CODEC_ID_FLV1 || st->codec->codec_id == CODEC_ID_H264 || st->codec->codec_id == CODEC_ID_H263 || st->codec->codec_id == CODEC_ID_H261 || st->codec->codec_id == CODEC_ID_VORBIS || st->codec->codec_id == CODEC_ID_MJPEG || st->codec->codec_id == CODEC_ID_PNG || st->codec->codec_id == CODEC_ID_PAM || st->codec->codec_id == CODEC_ID_PGM || st->codec->codec_id == CODEC_ID_PGMYUV || st->codec->codec_id == CODEC_ID_PBM || st->codec->codec_id == CODEC_ID_PPM || st->codec->codec_id == CODEC_ID_SHORTEN || (st->codec->codec_id == CODEC_ID_MPEG4 && !st->need_parsing))*/) try_decode_frame(st, pkt->data, pkt->size); if (av_rescale_q(st->codec_info_duration, st->time_base, AV_TIME_BASE_Q) >= ic->max_analyze_duration) { break; } count++; } // close codecs which where opened in try_decode_frame() for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if(st->codec->codec) avcodec_close(st->codec); } for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if (st->codec->codec_type == CODEC_TYPE_VIDEO) { if(st->codec->codec_id == CODEC_ID_RAWVIDEO && !st->codec->codec_tag && !st->codec->bits_per_sample) st->codec->codec_tag= avcodec_pix_fmt_to_codec_tag(st->codec->pix_fmt); if(duration_count[i] && (st->codec->time_base.num*101LL <= st->codec->time_base.den || st->codec->codec_id == CODEC_ID_MPEG2VIDEO) /*&& //FIXME we should not special case mpeg2, but this needs testing with non mpeg2 ... st->time_base.num*duration_sum[i]/duration_count[i]*101LL > st->time_base.den*/){ double best_error= 2*av_q2d(st->time_base); best_error= best_error*best_error*duration_count[i]*1000*12*30; for(j=1; j<MAX_STD_TIMEBASES; j++){ double error= duration_error[i][j] * get_std_framerate(j); // if(st->codec->codec_type == CODEC_TYPE_VIDEO) // av_log(NULL, AV_LOG_ERROR, ""%f %f\n"", get_std_framerate(j) / 12.0/1001, error); if(error < best_error){ best_error= error; av_reduce(&st->r_frame_rate.num, &st->r_frame_rate.den, get_std_framerate(j), 12*1001, INT_MAX); } } } if (!st->r_frame_rate.num){ if( st->codec->time_base.den * (int64_t)st->time_base.num <= st->codec->time_base.num * (int64_t)st->time_base.den){ st->r_frame_rate.num = st->codec->time_base.den; st->r_frame_rate.den = st->codec->time_base.num; }else{ st->r_frame_rate.num = st->time_base.den; st->r_frame_rate.den = st->time_base.num; } } }else if(st->codec->codec_type == CODEC_TYPE_AUDIO) { if(!st->codec->bits_per_sample) st->codec->bits_per_sample= av_get_bits_per_sample(st->codec->codec_id); } } av_estimate_timings(ic, old_offset); #if 0 /* correct DTS for b frame streams with no timestamps */ for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if (st->codec->codec_type == CODEC_TYPE_VIDEO) { if(b-frames){ ppktl = &ic->packet_buffer; while(ppkt1){ if(ppkt1->stream_index != i) continue; if(ppkt1->pkt->dts < 0) break; if(ppkt1->pkt->pts != AV_NOPTS_VALUE) break; ppkt1->pkt->dts -= delta; ppkt1= ppkt1->next; } if(ppkt1) continue; st->cur_dts -= delta; } } } #endif return ret; }","Yes, it is vulnerable."203201,"static void create_vorbis_context(vorbis_enc_context *venc, AVCodecContext *avccontext) { vorbis_enc_floor *fc; vorbis_enc_residue *rc; vorbis_enc_mapping *mc; int i, book; venc->channels = avccontext->channels; venc->sample_rate = avccontext->sample_rate; venc->log2_blocksize[0] = venc->log2_blocksize[1] = 11; venc->ncodebooks = FF_ARRAY_ELEMS(cvectors); venc->codebooks = av_malloc(sizeof(vorbis_enc_codebook) * venc->ncodebooks); // codebook 0..14 - floor1 book, values 0..255 // codebook 15 residue masterbook // codebook 16..29 residue for (book = 0; book < venc->ncodebooks; book++) { vorbis_enc_codebook *cb = &venc->codebooks[book]; int vals; cb->ndimentions = cvectors[book].dim; cb->nentries = cvectors[book].real_len; cb->min = cvectors[book].min; cb->delta = cvectors[book].delta; cb->lookup = cvectors[book].lookup; cb->seq_p = 0; cb->lens = av_malloc(sizeof(uint8_t) * cb->nentries); cb->codewords = av_malloc(sizeof(uint32_t) * cb->nentries); memcpy(cb->lens, cvectors[book].clens, cvectors[book].len); memset(cb->lens + cvectors[book].len, 0, cb->nentries - cvectors[book].len); if (cb->lookup) { vals = cb_lookup_vals(cb->lookup, cb->ndimentions, cb->nentries); cb->quantlist = av_malloc(sizeof(int) * vals); for (i = 0; i < vals; i++) cb->quantlist[i] = cvectors[book].quant[i]; } else { cb->quantlist = NULL; } ready_codebook(cb); } venc->nfloors = 1; venc->floors = av_malloc(sizeof(vorbis_enc_floor) * venc->nfloors); // just 1 floor fc = &venc->floors[0]; fc->partitions = NUM_FLOOR_PARTITIONS; fc->partition_to_class = av_malloc(sizeof(int) * fc->partitions); fc->nclasses = 0; for (i = 0; i < fc->partitions; i++) { static const int a[] = {0, 1, 2, 2, 3, 3, 4, 4}; fc->partition_to_class[i] = a[i]; fc->nclasses = FFMAX(fc->nclasses, fc->partition_to_class[i]); } fc->nclasses++; fc->classes = av_malloc(sizeof(vorbis_enc_floor_class) * fc->nclasses); for (i = 0; i < fc->nclasses; i++) { vorbis_enc_floor_class * c = &fc->classes[i]; int j, books; c->dim = floor_classes[i].dim; c->subclass = floor_classes[i].subclass; c->masterbook = floor_classes[i].masterbook; books = (1 << c->subclass); c->books = av_malloc(sizeof(int) * books); for (j = 0; j < books; j++) c->books[j] = floor_classes[i].nbooks[j]; } fc->multiplier = 2; fc->rangebits = venc->log2_blocksize[0] - 1; fc->values = 2; for (i = 0; i < fc->partitions; i++) fc->values += fc->classes[fc->partition_to_class[i]].dim; fc->list = av_malloc(sizeof(vorbis_floor1_entry) * fc->values); fc->list[0].x = 0; fc->list[1].x = 1 << fc->rangebits; for (i = 2; i < fc->values; i++) { static const int a[] = { 93, 23,372, 6, 46,186,750, 14, 33, 65, 130,260,556, 3, 10, 18, 28, 39, 55, 79, 111,158,220,312,464,650,850 }; fc->list[i].x = a[i - 2]; } ff_vorbis_ready_floor1_list(fc->list, fc->values); venc->nresidues = 1; venc->residues = av_malloc(sizeof(vorbis_enc_residue) * venc->nresidues); // single residue rc = &venc->residues[0]; rc->type = 2; rc->begin = 0; rc->end = 1600; rc->partition_size = 32; rc->classifications = 10; rc->classbook = 15; rc->books = av_malloc(sizeof(*rc->books) * rc->classifications); { static const int8_t a[10][8] = { { -1, -1, -1, -1, -1, -1, -1, -1, }, { -1, -1, 16, -1, -1, -1, -1, -1, }, { -1, -1, 17, -1, -1, -1, -1, -1, }, { -1, -1, 18, -1, -1, -1, -1, -1, }, { -1, -1, 19, -1, -1, -1, -1, -1, }, { -1, -1, 20, -1, -1, -1, -1, -1, }, { -1, -1, 21, -1, -1, -1, -1, -1, }, { 22, 23, -1, -1, -1, -1, -1, -1, }, { 24, 25, -1, -1, -1, -1, -1, -1, }, { 26, 27, 28, -1, -1, -1, -1, -1, }, }; memcpy(rc->books, a, sizeof a); } ready_residue(rc, venc); venc->nmappings = 1; venc->mappings = av_malloc(sizeof(vorbis_enc_mapping) * venc->nmappings); // single mapping mc = &venc->mappings[0]; mc->submaps = 1; mc->mux = av_malloc(sizeof(int) * venc->channels); for (i = 0; i < venc->channels; i++) mc->mux[i] = 0; mc->floor = av_malloc(sizeof(int) * mc->submaps); mc->residue = av_malloc(sizeof(int) * mc->submaps); for (i = 0; i < mc->submaps; i++) { mc->floor[i] = 0; mc->residue[i] = 0; } mc->coupling_steps = venc->channels == 2 ? 1 : 0; mc->magnitude = av_malloc(sizeof(int) * mc->coupling_steps); mc->angle = av_malloc(sizeof(int) * mc->coupling_steps); if (mc->coupling_steps) { mc->magnitude[0] = 0; mc->angle[0] = 1; } venc->nmodes = 1; venc->modes = av_malloc(sizeof(vorbis_enc_mode) * venc->nmodes); // single mode venc->modes[0].blockflag = 0; venc->modes[0].mapping = 0; venc->have_saved = 0; venc->saved = av_malloc(sizeof(float) * venc->channels * (1 << venc->log2_blocksize[1]) / 2); venc->samples = av_malloc(sizeof(float) * venc->channels * (1 << venc->log2_blocksize[1])); venc->floor = av_malloc(sizeof(float) * venc->channels * (1 << venc->log2_blocksize[1]) / 2); venc->coeffs = av_malloc(sizeof(float) * venc->channels * (1 << venc->log2_blocksize[1]) / 2); venc->win[0] = ff_vorbis_vwin[venc->log2_blocksize[0] - 6]; venc->win[1] = ff_vorbis_vwin[venc->log2_blocksize[1] - 6]; ff_mdct_init(&venc->mdct[0], venc->log2_blocksize[0], 0, 1.0); ff_mdct_init(&venc->mdct[1], venc->log2_blocksize[1], 0, 1.0); }","Yes, it is vulnerable."204202,"QEMUOptionParameter *append_option_parameters(QEMUOptionParameter *dest, QEMUOptionParameter *list) { size_t num_options, num_dest_options; num_options = count_option_parameters(dest); num_dest_options = num_options; num_options += count_option_parameters(list); dest = qemu_realloc(dest, (num_options + 1) * sizeof(QEMUOptionParameter)); while (list && list->name) { if (get_option_parameter(dest, list->name) == NULL) { dest[num_dest_options++] = *list; } list++; } return dest; }","Yes, it is vulnerable."205203,"void stream_start(const char *job_id, BlockDriverState *bs, BlockDriverState *base, const char *backing_file_str, int64_t speed, BlockdevOnError on_error, Error **errp) { StreamBlockJob *s; BlockDriverState *iter; int orig_bs_flags; /* Make sure that the image is opened in read-write mode */ orig_bs_flags = bdrv_get_flags(bs); if (!(orig_bs_flags & BDRV_O_RDWR)) { if (bdrv_reopen(bs, orig_bs_flags | BDRV_O_RDWR, errp) != 0) { return; } } /* Prevent concurrent jobs trying to modify the graph structure here, we * already have our own plans. Also don't allow resize as the image size is * queried only at the job start and then cached. */ s = block_job_create(job_id, &stream_job_driver, bs, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED | BLK_PERM_GRAPH_MOD, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE, speed, BLOCK_JOB_DEFAULT, NULL, NULL, errp); if (!s) { goto fail; } /* Block all intermediate nodes between bs and base, because they will * disappear from the chain after this operation. The streaming job reads * every block only once, assuming that it doesn't change, so block writes * and resizes. */ for (iter = backing_bs(bs); iter && iter != base; iter = backing_bs(iter)) { block_job_add_bdrv(&s->common, ""intermediate node"", iter, 0, BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED, &error_abort); } s->base = base; s->backing_file_str = g_strdup(backing_file_str); s->bs_flags = orig_bs_flags; s->on_error = on_error; trace_stream_start(bs, base, s); block_job_start(&s->common); return; fail: if (orig_bs_flags != bdrv_get_flags(bs)) { bdrv_reopen(bs, s->bs_flags, NULL); } }","Yes, it is vulnerable."206204,"static void tcg_target_qemu_prologue(TCGContext *s) { int i, frame_size; /* reserve some stack space */ frame_size = ARRAY_SIZE(tcg_target_callee_save_regs) * 4 + TCG_STATIC_CALL_ARGS_SIZE; frame_size = (frame_size + TCG_TARGET_STACK_ALIGN - 1) & ~(TCG_TARGET_STACK_ALIGN - 1); /* TB prologue */ tcg_out_addi(s, TCG_REG_SP, -frame_size); for(i = 0 ; i < ARRAY_SIZE(tcg_target_callee_save_regs) ; i++) { tcg_out_st(s, TCG_TYPE_I32, tcg_target_callee_save_regs[i], TCG_REG_SP, TCG_STATIC_CALL_ARGS_SIZE + i * 4); } /* Call generated code */ tcg_out_opc_reg(s, OPC_JR, 0, tcg_target_call_iarg_regs[1]), 0); tcg_out_mov(s, TCG_TYPE_PTR, TCG_AREG0, tcg_target_call_iarg_regs[0]); tb_ret_addr = s->code_ptr; /* TB epilogue */ for(i = 0 ; i < ARRAY_SIZE(tcg_target_callee_save_regs) ; i++) { tcg_out_ld(s, TCG_TYPE_I32, tcg_target_callee_save_regs[i], TCG_REG_SP, TCG_STATIC_CALL_ARGS_SIZE + i * 4); } tcg_out_opc_reg(s, OPC_JR, 0, TCG_REG_RA, 0); tcg_out_addi(s, TCG_REG_SP, frame_size); }","Yes, it is vulnerable."207205,"static void virtio_scsi_vring_teardown(VirtIOSCSI *s) { VirtIODevice *vdev = VIRTIO_DEVICE(s); VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(s); int i; if (s->ctrl_vring) { vring_teardown(&s->ctrl_vring->vring, vdev, 0); } if (s->event_vring) { vring_teardown(&s->event_vring->vring, vdev, 1); } if (s->cmd_vrings) { for (i = 0; i < vs->conf.num_queues && s->cmd_vrings[i]; i++) { vring_teardown(&s->cmd_vrings[i]->vring, vdev, 2 + i); } free(s->cmd_vrings); s->cmd_vrings = NULL; } }","Yes, it is vulnerable."208206,"static void opt_frame_pix_fmt(const char *arg) { if (strcmp(arg, ""list"")) frame_pix_fmt = avcodec_get_pix_fmt(arg); else { list_fmts(avcodec_pix_fmt_string, PIX_FMT_NB); av_exit(0); } }","Yes, it is vulnerable."209207,"static int scan_mmco_reset(AVCodecParserContext *s) { H264ParseContext *p = s->priv_data; H264Context *h = &p->h; H264SliceContext *sl = &h->slice_ctx[0]; sl->slice_type_nos = s->pict_type & 3; if (h->pps.redundant_pic_cnt_present) get_ue_golomb(&sl->gb); // redundant_pic_count if (ff_set_ref_count(h, sl) < 0) return AVERROR_INVALIDDATA; if (sl->slice_type_nos != AV_PICTURE_TYPE_I) { int list; for (list = 0; list < sl->list_count; list++) { if (get_bits1(&sl->gb)) { int index; for (index = 0; ; index++) { unsigned int reordering_of_pic_nums_idc = get_ue_golomb_31(&sl->gb); if (reordering_of_pic_nums_idc < 3) get_ue_golomb(&sl->gb); else if (reordering_of_pic_nums_idc > 3) { av_log(h->avctx, AV_LOG_ERROR, ""illegal reordering_of_pic_nums_idc %d\n"", reordering_of_pic_nums_idc); return AVERROR_INVALIDDATA; } else break; if (index >= sl->ref_count[list]) { av_log(h->avctx, AV_LOG_ERROR, ""reference count %d overflow\n"", index); return AVERROR_INVALIDDATA; } } } } } if ((h->pps.weighted_pred && sl->slice_type_nos == AV_PICTURE_TYPE_P) || (h->pps.weighted_bipred_idc == 1 && sl->slice_type_nos == AV_PICTURE_TYPE_B)) ff_pred_weight_table(h, sl); if (get_bits1(&sl->gb)) { // adaptive_ref_pic_marking_mode_flag int i; for (i = 0; i < MAX_MMCO_COUNT; i++) { MMCOOpcode opcode = get_ue_golomb_31(&sl->gb); if (opcode > (unsigned) MMCO_LONG) { av_log(h->avctx, AV_LOG_ERROR, ""illegal memory management control operation %d\n"", opcode); return AVERROR_INVALIDDATA; } if (opcode == MMCO_END) return 0; else if (opcode == MMCO_RESET) return 1; if (opcode == MMCO_SHORT2UNUSED || opcode == MMCO_SHORT2LONG) get_ue_golomb(&sl->gb); if (opcode == MMCO_SHORT2LONG || opcode == MMCO_LONG2UNUSED || opcode == MMCO_LONG || opcode == MMCO_SET_MAX_LONG) get_ue_golomb_31(&sl->gb); } } return 0; }","No, it is non-vulnerable."210208,"static int qdm2_decode_init(AVCodecContext *avctx) { QDM2Context *s = avctx->priv_data; uint8_t *extradata; int extradata_size; int tmp_val, tmp, size; int i; float alpha; /* extradata parsing Structure: wave { frma (QDM2) QDCA QDCP } 32 size (including this field) 32 tag (=frma) 32 type (=QDM2 or QDMC) 32 size (including this field, in bytes) 32 tag (=QDCA) // maybe mandatory parameters 32 unknown (=1) 32 channels (=2) 32 samplerate (=44100) 32 bitrate (=96000) 32 block size (=4096) 32 frame size (=256) (for one channel) 32 packet size (=1300) 32 size (including this field, in bytes) 32 tag (=QDCP) // maybe some tuneable parameters 32 float1 (=1.0) 32 zero ? 32 float2 (=1.0) 32 float3 (=1.0) 32 unknown (27) 32 unknown (8) 32 zero ? */ if (!avctx->extradata || (avctx->extradata_size < 48)) { av_log(avctx, AV_LOG_ERROR, ""extradata missing or truncated\n""); return -1; } extradata = avctx->extradata; extradata_size = avctx->extradata_size; while (extradata_size > 7) { if (!memcmp(extradata, ""frmaQDM"", 7)) break; extradata++; extradata_size--; } if (extradata_size < 12) { av_log(avctx, AV_LOG_ERROR, ""not enough extradata (%i)\n"", extradata_size); return -1; } if (memcmp(extradata, ""frmaQDM"", 7)) { av_log(avctx, AV_LOG_ERROR, ""invalid headers, QDM? not found\n""); return -1; } if (extradata[7] == 'C') { // s->is_qdmc = 1; av_log(avctx, AV_LOG_ERROR, ""stream is QDMC version 1, which is not supported\n""); return -1; } extradata += 8; extradata_size -= 8; size = BE_32(extradata); if(size > extradata_size){ av_log(avctx, AV_LOG_ERROR, ""extradata size too small, %i < %i\n"", extradata_size, size); return -1; } extradata += 4; av_log(avctx, AV_LOG_DEBUG, ""size: %d\n"", size); if (BE_32(extradata) != MKBETAG('Q','D','C','A')) { av_log(avctx, AV_LOG_ERROR, ""invalid extradata, expecting QDCA\n""); return -1; } extradata += 8; avctx->channels = s->nb_channels = s->channels = BE_32(extradata); extradata += 4; avctx->sample_rate = BE_32(extradata); extradata += 4; avctx->bit_rate = BE_32(extradata); extradata += 4; s->group_size = BE_32(extradata); extradata += 4; s->fft_size = BE_32(extradata); extradata += 4; s->checksum_size = BE_32(extradata); extradata += 4; s->fft_order = av_log2(s->fft_size) + 1; s->fft_frame_size = 2 * s->fft_size; // complex has two floats // something like max decodable tones s->group_order = av_log2(s->group_size) + 1; s->frame_size = s->group_size / 16; // 16 iterations per super block if (s->fft_order == 8) s->sub_sampling = 1; else s->sub_sampling = 2; s->frequency_range = 255 / (1 << (2 - s->sub_sampling)); switch ((s->sub_sampling * 2 + s->channels - 1)) { case 0: tmp = 40; break; case 1: tmp = 48; break; case 2: tmp = 56; break; case 3: tmp = 72; break; case 4: tmp = 80; break; case 5: tmp = 100;break; default: tmp=s->sub_sampling; break; } tmp_val = 0; if ((tmp * 1000) < avctx->bit_rate) tmp_val = 1; if ((tmp * 1440) < avctx->bit_rate) tmp_val = 2; if ((tmp * 1760) < avctx->bit_rate) tmp_val = 3; if ((tmp * 2240) < avctx->bit_rate) tmp_val = 4; s->cm_table_select = tmp_val; if (s->sub_sampling == 0) tmp = 16000; else tmp = ((-(s->sub_sampling -1)) & 8000) + 20000; /* 0: 16000 -> 1 1: 20000 -> 2 2: 28000 -> 2 */ if (tmp < 8000) s->coeff_per_sb_select = 0; else if (tmp <= 16000) s->coeff_per_sb_select = 1; else s->coeff_per_sb_select = 2; if (s->fft_order != 8 && s->fft_order != 9) av_log(avctx, AV_LOG_ERROR, ""Unknown FFT order (%d), contact the developers!\n"", s->fft_order); ff_fft_init(&s->fft_ctx, s->fft_order - 1, 1); for (i = 1; i < (1 << (s->fft_order - 2)); i++) { alpha = 2 * M_PI * (float)i / (float)(1 << (s->fft_order - 1)); s->exptab[i].re = cos(alpha); s->exptab[i].im = sin(alpha); } qdm2_init(s); // dump_context(s); return 0; }","Yes, it is vulnerable."211209,"static void new_audio_stream(AVFormatContext *oc) { AVStream *st; AVCodec *codec= NULL; AVCodecContext *audio_enc; enum CodecID codec_id; st = av_new_stream(oc, oc->nb_streams < nb_streamid_map ? streamid_map[oc->nb_streams] : 0); if (!st) { fprintf(stderr, ""Could not alloc stream\n""); ffmpeg_exit(1); } output_codecs = grow_array(output_codecs, sizeof(*output_codecs), &nb_output_codecs, nb_output_codecs + 1); if(!audio_stream_copy){ if (audio_codec_name) { codec_id = find_codec_or_die(audio_codec_name, AVMEDIA_TYPE_AUDIO, 1, avcodec_opts[AVMEDIA_TYPE_AUDIO]->strict_std_compliance); codec = avcodec_find_encoder_by_name(audio_codec_name); output_codecs[nb_output_codecs-1] = codec; } else { codec_id = av_guess_codec(oc->oformat, NULL, oc->filename, NULL, AVMEDIA_TYPE_AUDIO); codec = avcodec_find_encoder(codec_id); } } avcodec_get_context_defaults3(st->codec, codec); bitstream_filters[nb_output_files] = grow_array(bitstream_filters[nb_output_files], sizeof(*bitstream_filters[nb_output_files]), &nb_bitstream_filters[nb_output_files], oc->nb_streams); bitstream_filters[nb_output_files][oc->nb_streams - 1]= audio_bitstream_filters; audio_bitstream_filters= NULL; avcodec_thread_init(st->codec, thread_count); audio_enc = st->codec; audio_enc->codec_type = AVMEDIA_TYPE_AUDIO; if(audio_codec_tag) audio_enc->codec_tag= audio_codec_tag; if (oc->oformat->flags & AVFMT_GLOBALHEADER) { audio_enc->flags |= CODEC_FLAG_GLOBAL_HEADER; avcodec_opts[AVMEDIA_TYPE_AUDIO]->flags|= CODEC_FLAG_GLOBAL_HEADER; } if (audio_stream_copy) { st->stream_copy = 1; audio_enc->channels = audio_channels; audio_enc->sample_rate = audio_sample_rate; } else { audio_enc->codec_id = codec_id; set_context_opts(audio_enc, avcodec_opts[AVMEDIA_TYPE_AUDIO], AV_OPT_FLAG_AUDIO_PARAM | AV_OPT_FLAG_ENCODING_PARAM, codec); if (audio_qscale > QSCALE_NONE) { audio_enc->flags |= CODEC_FLAG_QSCALE; audio_enc->global_quality = st->quality = FF_QP2LAMBDA * audio_qscale; } audio_enc->channels = audio_channels; audio_enc->sample_fmt = audio_sample_fmt; audio_enc->sample_rate = audio_sample_rate; audio_enc->channel_layout = channel_layout; if (avcodec_channel_layout_num_channels(channel_layout) != audio_channels) audio_enc->channel_layout = 0; choose_sample_fmt(st, codec); choose_sample_rate(st, codec); } audio_enc->time_base= (AVRational){1, audio_sample_rate}; if (audio_language) { av_metadata_set2(&st->metadata, ""language"", audio_language, 0); av_freep(&audio_language); } /* reset some key parameters */ audio_disable = 0; av_freep(&audio_codec_name); audio_stream_copy = 0; }","Yes, it is vulnerable."212210,"static void frame_erasure(EVRCContext *e, float *samples) { float ilspf[FILTER_ORDER], ilpc[FILTER_ORDER], idelay[NB_SUBFRAMES], tmp[SUBFRAME_SIZE + 6], f; int i, j; for (i = 0; i < FILTER_ORDER; i++) { if (e->bitrate != RATE_QUANT) e->lspf[i] = e->prev_lspf[i] * 0.875 + 0.125 * (i + 1) * 0.048; else e->lspf[i] = e->prev_lspf[i]; } if (e->prev_error_flag) e->avg_acb_gain *= 0.75; if (e->bitrate == RATE_FULL) memcpy(e->pitch_back, e->pitch, ACB_SIZE * sizeof(float)); if (e->last_valid_bitrate == RATE_QUANT) e->bitrate = RATE_QUANT; else e->bitrate = RATE_FULL; if (e->bitrate == RATE_FULL || e->bitrate == RATE_HALF) { e->pitch_delay = e->prev_pitch_delay; } else { float sum = 0; idelay[0] = idelay[1] = idelay[2] = MIN_DELAY; for (i = 0; i < NB_SUBFRAMES; i++) sum += evrc_energy_quant[e->prev_energy_gain][i]; sum /= (float) NB_SUBFRAMES; sum = pow(10, sum); for (i = 0; i < NB_SUBFRAMES; i++) e->energy_vector[i] = sum; } if (fabs(e->pitch_delay - e->prev_pitch_delay) > 15) e->prev_pitch_delay = e->pitch_delay; for (i = 0; i < NB_SUBFRAMES; i++) { int subframe_size = subframe_sizes[i]; int pitch_lag; interpolate_lsp(ilspf, e->lspf, e->prev_lspf, i); if (e->bitrate != RATE_QUANT) { if (e->avg_acb_gain < 0.3) { idelay[0] = estimation_delay[i]; idelay[1] = estimation_delay[i + 1]; idelay[2] = estimation_delay[i + 2]; } else { interpolate_delay(idelay, e->pitch_delay, e->prev_pitch_delay, i); } } pitch_lag = lrintf((idelay[1] + idelay[0]) / 2.0); decode_predictor_coeffs(ilspf, ilpc); if (e->bitrate != RATE_QUANT) { acb_excitation(e, e->pitch + ACB_SIZE, e->avg_acb_gain, idelay, subframe_size); for (j = 0; j < subframe_size; j++) e->pitch[ACB_SIZE + j] *= e->fade_scale; e->fade_scale = FFMAX(e->fade_scale - 0.05, 0.0); } else { for (j = 0; j < subframe_size; j++) e->pitch[ACB_SIZE + j] = e->energy_vector[i]; } memcpy(e->pitch, e->pitch + subframe_size, ACB_SIZE * sizeof(float)); if (e->bitrate != RATE_QUANT && e->avg_acb_gain < 0.4) { f = 0.1 * e->avg_fcb_gain; for (j = 0; j < subframe_size; j++) e->pitch[ACB_SIZE + j] += f; } else if (e->bitrate == RATE_QUANT) { for (j = 0; j < subframe_size; j++) e->pitch[ACB_SIZE + j] = e->energy_vector[i]; } synthesis_filter(e->pitch + ACB_SIZE, ilpc, e->synthesis, subframe_size, tmp); postfilter(e, tmp, ilpc, samples, pitch_lag, &postfilter_coeffs[e->bitrate], subframe_size); samples += subframe_size; } }","No, it is non-vulnerable."213211,"void ff_mdct_calcw_c(FFTContext *s, FFTDouble *out, const FFTSample *input) { int i, j, n, n8, n4, n2, n3; FFTDouble re, im; const uint16_t *revtab = s->revtab; const FFTSample *tcos = s->tcos; const FFTSample *tsin = s->tsin; FFTComplex *x = s->tmp_buf; FFTDComplex *o = (FFTDComplex *)out; n = 1 << s->mdct_bits; n2 = n >> 1; n4 = n >> 2; n8 = n >> 3; n3 = 3 * n4; /* pre rotation */ for(i=0;i<n8;i++) { re = RSCALE(-input[2*i+n3] - input[n3-1-2*i]); im = RSCALE(-input[n4+2*i] + input[n4-1-2*i]); j = revtab[i]; CMUL(x[j].re, x[j].im, re, im, -tcos[i], tsin[i]); re = RSCALE( input[2*i] - input[n2-1-2*i]); im = RSCALE(-input[n2+2*i] - input[ n-1-2*i]); j = revtab[n8 + i]; CMUL(x[j].re, x[j].im, re, im, -tcos[n8 + i], tsin[n8 + i]); } s->fft_calc(s, x); /* post rotation */ for(i=0;i<n8;i++) { FFTDouble r0, i0, r1, i1; CMULL(i1, r0, x[n8-i-1].re, x[n8-i-1].im, -tsin[n8-i-1], -tcos[n8-i-1]); CMULL(i0, r1, x[n8+i ].re, x[n8+i ].im, -tsin[n8+i ], -tcos[n8+i ]); o[n8-i-1].re = r0; o[n8-i-1].im = i0; o[n8+i ].re = r1; o[n8+i ].im = i1; } }","Yes, it is vulnerable."214212,"set_rdt(E1000State *s, int index, uint32_t val) { s->check_rxov = 0; s->mac_reg[index] = val & 0xffff; if (e1000_has_rxbufs(s, 1)) { qemu_flush_queued_packets(&s->nic->nc); } }","No, it is non-vulnerable."215213,"unsigned int s390_cpu_set_state(uint8_t cpu_state, S390CPU *cpu) { trace_cpu_set_state(CPU(cpu)->cpu_index, cpu_state); switch (cpu_state) { case CPU_STATE_STOPPED: case CPU_STATE_CHECK_STOP: /* halt the cpu for common infrastructure */ s390_cpu_halt(cpu); break; case CPU_STATE_OPERATING: case CPU_STATE_LOAD: /* unhalt the cpu for common infrastructure */ s390_cpu_unhalt(cpu); break; default: error_report(""Requested CPU state is not a valid S390 CPU state: %u"", cpu_state); exit(1); cpu->env.cpu_state = cpu_state; return s390_count_running_cpus();","Yes, it is vulnerable."216214,"static int mmap_read_frame(struct video_data *s, void *frame, int64_t *ts) { struct v4l2_buffer buf; int res; memset(&buf, 0, sizeof(struct v4l2_buffer)); buf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; buf.memory = V4L2_MEMORY_MMAP; /* FIXME: Some special treatment might be needed in case of loss of signal... */ while ((res = ioctl(s->fd, VIDIOC_DQBUF, &buf)) < 0 && ((errno == EAGAIN) || (errno == EINTR))); if (res < 0) { av_log(NULL, AV_LOG_ERROR, ""ioctl(VIDIOC_DQBUF): %s\n"", strerror(errno)); return -1; } assert (buf.index < s->buffers); assert(buf.bytesused == s->frame_size); /* Image is at s->buff_start[buf.index] */ memcpy(frame, s->buf_start[buf.index], buf.bytesused); *ts = buf.timestamp.tv_sec * int64_t_C(1000000) + buf.timestamp.tv_usec; res = ioctl (s->fd, VIDIOC_QBUF, &buf); if (res < 0) { av_log(NULL, AV_LOG_ERROR, ""ioctl(VIDIOC_QBUF)\n""); return -1; } return s->buf_len[buf.index]; }","Yes, it is vulnerable."217215,"static void avc_luma_midh_qrt_4w_msa(const uint8_t *src, int32_t src_stride, uint8_t *dst, int32_t dst_stride, int32_t height, uint8_t horiz_offset) { uint32_t row; v16i8 src0, src1, src2, src3, src4, src5, src6; v8i16 vt_res0, vt_res1, vt_res2, vt_res3; v4i32 hz_res0, hz_res1; v8i16 dst0, dst1; v8i16 shf_vec0, shf_vec1, shf_vec2, shf_vec3, shf_vec4, shf_vec5; v8i16 mask0 = { 0, 5, 1, 6, 2, 7, 3, 8 }; v8i16 mask1 = { 1, 4, 2, 5, 3, 6, 4, 7 }; v8i16 mask2 = { 2, 3, 3, 4, 4, 5, 5, 6 }; v8i16 minus5h = __msa_ldi_h(-5); v8i16 plus20h = __msa_ldi_h(20); v8i16 zeros = { 0 }; v16u8 out; LD_SB5(src, src_stride, src0, src1, src2, src3, src4); src += (5 * src_stride); XORI_B5_128_SB(src0, src1, src2, src3, src4); for (row = (height >> 1); row--;) { LD_SB2(src, src_stride, src5, src6); src += (2 * src_stride); XORI_B2_128_SB(src5, src6); AVC_CALC_DPADD_B_6PIX_2COEFF_SH(src0, src1, src2, src3, src4, src5, vt_res0, vt_res1); AVC_CALC_DPADD_B_6PIX_2COEFF_SH(src1, src2, src3, src4, src5, src6, vt_res2, vt_res3); VSHF_H3_SH(vt_res0, vt_res1, vt_res0, vt_res1, vt_res0, vt_res1, mask0, mask1, mask2, shf_vec0, shf_vec1, shf_vec2); VSHF_H3_SH(vt_res2, vt_res3, vt_res2, vt_res3, vt_res2, vt_res3, mask0, mask1, mask2, shf_vec3, shf_vec4, shf_vec5); hz_res0 = __msa_hadd_s_w(shf_vec0, shf_vec0); DPADD_SH2_SW(shf_vec1, shf_vec2, minus5h, plus20h, hz_res0, hz_res0); hz_res1 = __msa_hadd_s_w(shf_vec3, shf_vec3); DPADD_SH2_SW(shf_vec4, shf_vec5, minus5h, plus20h, hz_res1, hz_res1); SRARI_W2_SW(hz_res0, hz_res1, 10); SAT_SW2_SW(hz_res0, hz_res1, 7); dst0 = __msa_srari_h(shf_vec2, 5); dst1 = __msa_srari_h(shf_vec5, 5); SAT_SH2_SH(dst0, dst1, 7); if (horiz_offset) { dst0 = __msa_ilvod_h(zeros, dst0); dst1 = __msa_ilvod_h(zeros, dst1); } else { ILVEV_H2_SH(dst0, zeros, dst1, zeros, dst0, dst1); } hz_res0 = __msa_aver_s_w(hz_res0, (v4i32) dst0); hz_res1 = __msa_aver_s_w(hz_res1, (v4i32) dst1); dst0 = __msa_pckev_h((v8i16) hz_res1, (v8i16) hz_res0); out = PCKEV_XORI128_UB(dst0, dst0); ST4x2_UB(out, dst, dst_stride); dst += (2 * dst_stride); src0 = src2; src1 = src3; src2 = src4; src3 = src5; src4 = src6; } }","No, it is non-vulnerable."218216,"static void e1000_io_write(void *opaque, target_phys_addr_t addr, uint64_t val, unsigned size) { E1000State *s = opaque; (void)s; }","No, it is non-vulnerable."219217,"static void omap_clkm_init(MemoryRegion *memory, target_phys_addr_t mpu_base, target_phys_addr_t dsp_base, struct omap_mpu_state_s *s) { memory_region_init_io(&s->clkm_iomem, &omap_clkm_ops, s, ""omap-clkm"", 0x100); memory_region_init_io(&s->clkdsp_iomem, &omap_clkdsp_ops, s, ""omap-clkdsp"", 0x1000); s->clkm.arm_idlect1 = 0x03ff; s->clkm.arm_idlect2 = 0x0100; s->clkm.dsp_idlect1 = 0x0002; omap_clkm_reset(s); s->clkm.cold_start = 0x3a; memory_region_add_subregion(memory, mpu_base, &s->clkm_iomem); memory_region_add_subregion(memory, dsp_base, &s->clkdsp_iomem); }","No, it is non-vulnerable."220218,"static uint64_t bonito_pciconf_readl(void *opaque, target_phys_addr_t addr, unsigned size) { PCIBonitoState *s = opaque; PCIDevice *d = PCI_DEVICE(s); DPRINTF(""bonito_pciconf_readl ""TARGET_FMT_plx""\n"", addr); return d->config_read(d, addr, 4); }","No, it is non-vulnerable."221219,static void vdi_close(BlockDriverState *bs) { BDRVVdiState *s = bs->opaque; g_free(s->bmap); migrate_del_blocker(s->migration_blocker); error_free(s->migration_blocker); },"Yes, it is vulnerable."222220,"static int handle_instruction(S390CPU *cpu, struct kvm_run *run) { unsigned int ipa0 = (run->s390_sieic.ipa & 0xff00); uint8_t ipa1 = run->s390_sieic.ipa & 0x00ff; int r = -1; DPRINTF(""handle_instruction 0x%x 0x%x\n"", run->s390_sieic.ipa, run->s390_sieic.ipb); switch (ipa0) { case IPA0_B2: r = handle_b2(cpu, run, ipa1); break; case IPA0_B9: r = handle_b9(cpu, run, ipa1); break; case IPA0_EB: r = handle_eb(cpu, run, run->s390_sieic.ipb & 0xff); break; case IPA0_E3: r = handle_e3(cpu, run, run->s390_sieic.ipb & 0xff); break; case IPA0_DIAG: r = handle_diag(cpu, run, run->s390_sieic.ipb); break; case IPA0_SIGP: r = handle_sigp(cpu, ipa1, run->s390_sieic.ipb); break; } if (r < 0) { r = 0; kvm_s390_program_interrupt(cpu, PGM_OPERATION); } return r; }","No, it is non-vulnerable."223221,"static int v9fs_synth_fstat(FsContext *fs_ctx, int fid_type, V9fsFidOpenState *fs, struct stat *stbuf) { V9fsSynthOpenState *synth_open = fs->private; v9fs_synth_fill_statbuf(synth_open->node, stbuf); return 0; }","No, it is non-vulnerable."224222,static uint32_t virtio_balloon_get_features(VirtIODevice *vdev) { return 0; },"No, it is non-vulnerable."225223,"BlockDriverAIOCB *bdrv_aio_write(BlockDriverState *bs, int64_t sector_num, const uint8_t *buf, int nb_sectors, BlockDriverCompletionFunc *cb, void *opaque) { BlockDriver *drv = bs->drv; BlockDriverAIOCB *ret; if (!drv) return NULL; if (bs->read_only) return NULL; if (sector_num == 0 && bs->boot_sector_enabled && nb_sectors > 0) { memcpy(bs->boot_sector_data, buf, 512); } ret = drv->bdrv_aio_write(bs, sector_num, buf, nb_sectors, cb, opaque); if (ret) { /* Update stats even though technically transfer has not happened. */ bs->wr_bytes += (unsigned) nb_sectors * SECTOR_SIZE; bs->wr_ops ++; } return ret; }","No, it is non-vulnerable."226224,"static uint64_t icp_pic_read(void *opaque, target_phys_addr_t offset, unsigned size) { icp_pic_state *s = (icp_pic_state *)opaque; switch (offset >> 2) { case 0: /* IRQ_STATUS */ return s->level & s->irq_enabled; case 1: /* IRQ_RAWSTAT */ return s->level; case 2: /* IRQ_ENABLESET */ return s->irq_enabled; case 4: /* INT_SOFTSET */ return s->level & 1; case 8: /* FRQ_STATUS */ return s->level & s->fiq_enabled; case 9: /* FRQ_RAWSTAT */ return s->level; case 10: /* FRQ_ENABLESET */ return s->fiq_enabled; case 3: /* IRQ_ENABLECLR */ case 5: /* INT_SOFTCLR */ case 11: /* FRQ_ENABLECLR */ default: printf (""icp_pic_read: Bad register offset 0x%x\n"", (int)offset); return 0; } }","No, it is non-vulnerable."227225,"static int vmsvga_post_load(void *opaque, int version_id) { struct vmsvga_state_s *s = opaque; s->invalidated = 1; if (s->config) s->fifo = (uint32_t *) s->fifo_ptr; return 0; }","No, it is non-vulnerable."228226,"static inline void check_alignment(CPUS390XState *env, uint64_t v, int wordsize, uintptr_t ra) { if (v % wordsize) { CPUState *cs = CPU(s390_env_get_cpu(env)); cpu_restore_state(cs, ra); program_interrupt(env, PGM_SPECIFICATION, 6); } }","No, it is non-vulnerable."229227,"static void print_codec(const AVCodec *c) { int encoder = av_codec_is_encoder(c); printf(""%s %s [%s]:\n"", encoder ? ""Encoder"" : ""Decoder"", c->name, c->long_name ? c->long_name : """"); printf("" General capabilities: ""); if (c->capabilities & AV_CODEC_CAP_DRAW_HORIZ_BAND) printf(""horizband ""); if (c->capabilities & AV_CODEC_CAP_DR1) printf(""dr1 ""); if (c->capabilities & AV_CODEC_CAP_TRUNCATED) printf(""trunc ""); if (c->capabilities & AV_CODEC_CAP_DELAY) printf(""delay ""); if (c->capabilities & AV_CODEC_CAP_SMALL_LAST_FRAME) printf(""small ""); if (c->capabilities & AV_CODEC_CAP_SUBFRAMES) printf(""subframes ""); if (c->capabilities & AV_CODEC_CAP_EXPERIMENTAL) printf(""exp ""); if (c->capabilities & AV_CODEC_CAP_CHANNEL_CONF) printf(""chconf ""); if (c->capabilities & AV_CODEC_CAP_PARAM_CHANGE) printf(""small ""); if (c->capabilities & AV_CODEC_CAP_PARAM_CHANGE) printf(""variable ""); if (c->capabilities & (AV_CODEC_CAP_FRAME_THREADS | AV_CODEC_CAP_SLICE_THREADS | AV_CODEC_CAP_AUTO_THREADS)) printf(""threads ""); if (!c->capabilities) printf(""none""); printf(""\n""); if (c->type == AVMEDIA_TYPE_VIDEO) { printf("" Threading capabilities: ""); switch (c->capabilities & (AV_CODEC_CAP_FRAME_THREADS | AV_CODEC_CAP_SLICE_THREADS | AV_CODEC_CAP_AUTO_THREADS)) { case AV_CODEC_CAP_FRAME_THREADS | AV_CODEC_CAP_SLICE_THREADS: printf(""frame and slice""); break; case AV_CODEC_CAP_FRAME_THREADS: printf(""frame""); break; case AV_CODEC_CAP_SLICE_THREADS: printf(""slice""); break; case AV_CODEC_CAP_AUTO_THREADS : printf(""auto""); break; default: printf(""none""); break; } printf(""\n""); } if (c->supported_framerates) { const AVRational *fps = c->supported_framerates; printf("" Supported framerates:""); while (fps->num) { printf("" %d/%d"", fps->num, fps->den); fps++; } printf(""\n""); } PRINT_CODEC_SUPPORTED(c, pix_fmts, enum AVPixelFormat, ""pixel formats"", AV_PIX_FMT_NONE, GET_PIX_FMT_NAME); PRINT_CODEC_SUPPORTED(c, supported_samplerates, int, ""sample rates"", 0, GET_SAMPLE_RATE_NAME); PRINT_CODEC_SUPPORTED(c, sample_fmts, enum AVSampleFormat, ""sample formats"", AV_SAMPLE_FMT_NONE, GET_SAMPLE_FMT_NAME); PRINT_CODEC_SUPPORTED(c, channel_layouts, uint64_t, ""channel layouts"", 0, GET_CH_LAYOUT_DESC); if (c->priv_class) { show_help_children(c->priv_class, AV_OPT_FLAG_ENCODING_PARAM | AV_OPT_FLAG_DECODING_PARAM); } }","No, it is non-vulnerable."230228,"static int mm_start_timer(struct qemu_alarm_timer *t) { TIMECAPS tc; memset(&tc, 0, sizeof(tc)); timeGetDevCaps(&tc, sizeof(tc)); mm_period = tc.wPeriodMin; timeBeginPeriod(mm_period); mm_timer = timeSetEvent(1, /* interval (ms) */ mm_period, /* resolution */ mm_alarm_handler, /* function */ (DWORD_PTR)t, /* parameter */ TIME_ONESHOT | TIME_CALLBACK_FUNCTION); if (!mm_timer) { fprintf(stderr, ""Failed to initialize win32 alarm timer: %ld\n"", GetLastError()); timeEndPeriod(mm_period); return -1; } return 0; }","Yes, it is vulnerable."231229,"static void test_validate_fail_union_native_list(TestInputVisitorData *data, const void *unused) { UserDefNativeListUnion *tmp = NULL; Error *err = NULL; Visitor *v; v = validate_test_init(data, ""{ 'type': 'integer', 'data' : [ 'string' ] }""); visit_type_UserDefNativeListUnion(v, &tmp, NULL, &err); g_assert(err); qapi_free_UserDefNativeListUnion(tmp); }","Yes, it is vulnerable."232230,"static int init_processing_chain(AVFilterContext *ctx, int in_width, int in_height, int out_width, int out_height) { NPPScaleContext *s = ctx->priv; AVHWFramesContext *in_frames_ctx; enum AVPixelFormat in_format; enum AVPixelFormat out_format; enum AVPixelFormat in_deinterleaved_format; enum AVPixelFormat out_deinterleaved_format; int i, ret, last_stage = -1; /* check that we have a hw context */ if (!ctx->inputs[0]->hw_frames_ctx) { av_log(ctx, AV_LOG_ERROR, ""No hw context provided on input\n""); return AVERROR(EINVAL); } in_frames_ctx = (AVHWFramesContext*)ctx->inputs[0]->hw_frames_ctx->data; in_format = in_frames_ctx->sw_format; out_format = (s->format == AV_PIX_FMT_NONE) ? in_format : s->format; if (!format_is_supported(in_format)) { av_log(ctx, AV_LOG_ERROR, ""Unsupported input format: %s\n"", av_get_pix_fmt_name(in_format)); return AVERROR(ENOSYS); } if (!format_is_supported(out_format)) { av_log(ctx, AV_LOG_ERROR, ""Unsupported output format: %s\n"", av_get_pix_fmt_name(out_format)); return AVERROR(ENOSYS); } in_deinterleaved_format = get_deinterleaved_format(in_format); out_deinterleaved_format = get_deinterleaved_format(out_format); if (in_deinterleaved_format == AV_PIX_FMT_NONE || out_deinterleaved_format == AV_PIX_FMT_NONE) return AVERROR_BUG; /* figure out which stages need to be done */ if (in_width != out_width || in_height != out_height || in_deinterleaved_format != out_deinterleaved_format) { s->stages[STAGE_RESIZE].stage_needed = 1; if (s->interp_algo == NPPI_INTER_SUPER && (out_width > in_width && out_height > in_height)) { s->interp_algo = NPPI_INTER_LANCZOS; av_log(ctx, AV_LOG_WARNING, ""super-sampling not supported for output dimensions, using lanczos instead.\n""); } if (s->interp_algo == NPPI_INTER_SUPER && !(out_width < in_width && out_height < in_height)) { s->interp_algo = NPPI_INTER_CUBIC; av_log(ctx, AV_LOG_WARNING, ""super-sampling not supported for output dimensions, using cubic instead.\n""); } } if (!s->stages[STAGE_RESIZE].stage_needed && in_format == out_format) s->passthrough = 1; if (!s->passthrough) { if (in_format != in_deinterleaved_format) s->stages[STAGE_DEINTERLEAVE].stage_needed = 1; if (out_format != out_deinterleaved_format) s->stages[STAGE_INTERLEAVE].stage_needed = 1; } s->stages[STAGE_DEINTERLEAVE].in_fmt = in_format; s->stages[STAGE_DEINTERLEAVE].out_fmt = in_deinterleaved_format; s->stages[STAGE_DEINTERLEAVE].planes_in[0].width = in_width; s->stages[STAGE_DEINTERLEAVE].planes_in[0].height = in_height; s->stages[STAGE_RESIZE].in_fmt = in_deinterleaved_format; s->stages[STAGE_RESIZE].out_fmt = out_deinterleaved_format; s->stages[STAGE_RESIZE].planes_in[0].width = in_width; s->stages[STAGE_RESIZE].planes_in[0].height = in_height; s->stages[STAGE_RESIZE].planes_out[0].width = out_width; s->stages[STAGE_RESIZE].planes_out[0].height = out_height; s->stages[STAGE_INTERLEAVE].in_fmt = out_deinterleaved_format; s->stages[STAGE_INTERLEAVE].out_fmt = out_format; s->stages[STAGE_INTERLEAVE].planes_in[0].width = out_width; s->stages[STAGE_INTERLEAVE].planes_in[0].height = out_height; /* init the hardware contexts */ for (i = 0; i < FF_ARRAY_ELEMS(s->stages); i++) { if (!s->stages[i].stage_needed) continue; ret = init_stage(&s->stages[i], in_frames_ctx->device_ref); if (ret < 0) return ret; last_stage = i; } if (last_stage < 0) { ctx->outputs[0]->hw_frames_ctx = av_buffer_ref(ctx->inputs[0]->hw_frames_ctx); return 0; } ctx->outputs[0]->hw_frames_ctx = av_buffer_ref(s->stages[last_stage].frames_ctx); if (!ctx->outputs[0]->hw_frames_ctx) return AVERROR(ENOMEM); return 0; }","Yes, it is vulnerable."233231,"static int read_uncompressed_sgi(unsigned char* out_buf, uint8_t* out_end, const uint8_t *in_buf, const uint8_t *in_end, SgiState* s) { int x, y, z; const uint8_t *ptr; unsigned int offset = s->height * s->width * s->bytes_per_channel; /* Test buffer size. */ if (offset * s->depth > in_end - in_buf) { return -1; } for (y = s->height - 1; y >= 0; y--) { out_end = out_buf + (y * s->linesize); for (x = s->width; x > 0; x--) { ptr = in_buf += s->bytes_per_channel; for(z = 0; z < s->depth; z ++) { memcpy(out_end, ptr, s->bytes_per_channel); out_end += s->bytes_per_channel; ptr += offset; } } } return 0; }","Yes, it is vulnerable."234232,"int ff_mov_write_packet(AVFormatContext *s, AVPacket *pkt) { MOVMuxContext *mov = s->priv_data; AVIOContext *pb = s->pb; MOVTrack *trk = &mov->tracks[pkt->stream_index]; AVCodecContext *enc = trk->enc; unsigned int samples_in_chunk = 0; int size = pkt->size; uint8_t *reformatted_data = NULL; if (mov->flags & FF_MOV_FLAG_FRAGMENT) { int ret; if (mov->fragments > 0) { if (!trk->mdat_buf) { if ((ret = avio_open_dyn_buf(&trk->mdat_buf)) < 0) return ret; } pb = trk->mdat_buf; } else { if (!mov->mdat_buf) { if ((ret = avio_open_dyn_buf(&mov->mdat_buf)) < 0) return ret; } pb = mov->mdat_buf; } } if (enc->codec_id == AV_CODEC_ID_AMR_NB) { /* We must find out how many AMR blocks there are in one packet */ static uint16_t packed_size[16] = {13, 14, 16, 18, 20, 21, 27, 32, 6, 0, 0, 0, 0, 0, 0, 1}; int len = 0; while (len < size && samples_in_chunk < 100) { len += packed_size[(pkt->data[len] >> 3) & 0x0F]; samples_in_chunk++; } if (samples_in_chunk > 1) { av_log(s, AV_LOG_ERROR, ""fatal error, input is not a single packet, implement a AVParser for it\n""); return -1; } } else if (trk->sample_size) samples_in_chunk = size / trk->sample_size; else samples_in_chunk = 1; /* copy extradata if it exists */ if (trk->vos_len == 0 && enc->extradata_size > 0) { trk->vos_len = enc->extradata_size; trk->vos_data = av_malloc(trk->vos_len); memcpy(trk->vos_data, enc->extradata, trk->vos_len); } if (enc->codec_id == AV_CODEC_ID_H264 && trk->vos_len > 0 && *(uint8_t *)trk->vos_data != 1) { /* from x264 or from bytestream h264 */ /* nal reformating needed */ if (trk->hint_track >= 0 && trk->hint_track < mov->nb_streams) { ff_avc_parse_nal_units_buf(pkt->data, &reformatted_data, &size); avio_write(pb, reformatted_data, size); } else { size = ff_avc_parse_nal_units(pb, pkt->data, pkt->size); } } else if (enc->codec_id == AV_CODEC_ID_HEVC && trk->vos_len > 6 && (AV_RB24(trk->vos_data) == 1 || AV_RB32(trk->vos_data) == 1)) { /* extradata is Annex B, assume the bitstream is too and convert it */ if (trk->hint_track >= 0 && trk->hint_track < mov->nb_streams) { ff_hevc_annexb2mp4_buf(pkt->data, &reformatted_data, &size, 0, NULL); avio_write(pb, reformatted_data, size); } else { size = ff_hevc_annexb2mp4(pb, pkt->data, pkt->size, 0, NULL); } } else { avio_write(pb, pkt->data, size); } if ((enc->codec_id == AV_CODEC_ID_DNXHD || enc->codec_id == AV_CODEC_ID_AC3) && !trk->vos_len) { /* copy frame to create needed atoms */ trk->vos_len = size; trk->vos_data = av_malloc(size); if (!trk->vos_data) return AVERROR(ENOMEM); memcpy(trk->vos_data, pkt->data, size); } if (trk->entry >= trk->cluster_capacity) { unsigned new_capacity = 2 * (trk->entry + MOV_INDEX_CLUSTER_SIZE); if (av_reallocp_array(&trk->cluster, new_capacity, sizeof(*trk->cluster))) return AVERROR(ENOMEM); trk->cluster_capacity = new_capacity; } trk->cluster[trk->entry].pos = avio_tell(pb) - size; trk->cluster[trk->entry].samples_in_chunk = samples_in_chunk; trk->cluster[trk->entry].size = size; trk->cluster[trk->entry].entries = samples_in_chunk; trk->cluster[trk->entry].dts = pkt->dts; if (!trk->entry && trk->start_dts != AV_NOPTS_VALUE) { /* First packet of a new fragment. We already wrote the duration * of the last packet of the previous fragment based on track_duration, * which might not exactly match our dts. Therefore adjust the dts * of this packet to be what the previous packets duration implies. */ trk->cluster[trk->entry].dts = trk->start_dts + trk->track_duration; } if (!trk->entry && trk->start_dts == AV_NOPTS_VALUE && !mov->use_editlist && s->avoid_negative_ts == AVFMT_AVOID_NEG_TS_MAKE_ZERO) { /* Not using edit lists and shifting the first track to start from zero. * If the other streams start from a later timestamp, we won't be able * to signal the difference in starting time without an edit list. * Thus move the timestamp for this first sample to 0, increasing * its duration instead. */ trk->cluster[trk->entry].dts = trk->start_dts = 0; } if (trk->start_dts == AV_NOPTS_VALUE) { trk->start_dts = pkt->dts; if (pkt->dts && mov->flags & FF_MOV_FLAG_EMPTY_MOOV) av_log(s, AV_LOG_WARNING, ""Track %d starts with a nonzero dts %""PRId64"". This "" ""currently isn't handled correctly in combination with "" ""empty_moov.\n"", pkt->stream_index, pkt->dts); } trk->track_duration = pkt->dts - trk->start_dts + pkt->duration; if (pkt->pts == AV_NOPTS_VALUE) { av_log(s, AV_LOG_WARNING, ""pts has no value\n""); pkt->pts = pkt->dts; } if (pkt->dts != pkt->pts) trk->flags |= MOV_TRACK_CTTS; trk->cluster[trk->entry].cts = pkt->pts - pkt->dts; trk->cluster[trk->entry].flags = 0; if (enc->codec_id == AV_CODEC_ID_VC1) { mov_parse_vc1_frame(pkt, trk, mov->fragments); } else if (pkt->flags & AV_PKT_FLAG_KEY) { if (mov->mode == MODE_MOV && enc->codec_id == AV_CODEC_ID_MPEG2VIDEO && trk->entry > 0) { // force sync sample for the first key frame mov_parse_mpeg2_frame(pkt, &trk->cluster[trk->entry].flags); if (trk->cluster[trk->entry].flags & MOV_PARTIAL_SYNC_SAMPLE) trk->flags |= MOV_TRACK_STPS; } else { trk->cluster[trk->entry].flags = MOV_SYNC_SAMPLE; } if (trk->cluster[trk->entry].flags & MOV_SYNC_SAMPLE) trk->has_keyframes++; } trk->entry++; trk->sample_count += samples_in_chunk; mov->mdat_size += size; if (trk->hint_track >= 0 && trk->hint_track < mov->nb_streams) ff_mov_add_hinted_packet(s, pkt, trk->hint_track, trk->entry, reformatted_data, size); av_free(reformatted_data); return 0; }","Yes, it is vulnerable."235233,"static CURLState *curl_init_state(BDRVCURLState *s) { CURLState *state = NULL; int i, j; do { for (i=0; i<CURL_NUM_STATES; i++) { for (j=0; j<CURL_NUM_ACB; j++) if (s->states[i].acb[j]) continue; if (s->states[i].in_use) continue; state = &s->states[i]; state->in_use = 1; break; } if (!state) { g_usleep(100); curl_multi_do(s); } } while(!state); if (state->curl) goto has_curl; state->curl = curl_easy_init(); if (!state->curl) return NULL; curl_easy_setopt(state->curl, CURLOPT_URL, s->url); curl_easy_setopt(state->curl, CURLOPT_TIMEOUT, 5); curl_easy_setopt(state->curl, CURLOPT_WRITEFUNCTION, (void *)curl_read_cb); curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state); curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state); curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1); curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1); curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1); curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg); curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1); /* Restrict supported protocols to avoid security issues in the more * obscure protocols. For example, do not allow POP3/SMTP/IMAP see * CVE-2013-0249. */ curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS); curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS); #ifdef DEBUG_VERBOSE curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1); has_curl: state->s = s; return state; }","Yes, it is vulnerable."236234,"static int send_mono_rect(VncState *vs, int w, int h, uint32_t bg, uint32_t fg) { size_t bytes; int stream = 1; int level = tight_conf[vs->tight_compression].mono_zlib_level; bytes = ((w + 7) / 8) * h; vnc_write_u8(vs, (stream | VNC_TIGHT_EXPLICIT_FILTER) << 4); vnc_write_u8(vs, VNC_TIGHT_FILTER_PALETTE); vnc_write_u8(vs, 1); switch(vs->clientds.pf.bytes_per_pixel) { case 4: { uint32_t buf[2] = {bg, fg}; size_t ret = sizeof (buf); if (vs->tight_pixel24) { tight_pack24(vs, (unsigned char*)buf, 2, &ret); } vnc_write(vs, buf, ret); tight_encode_mono_rect32(vs->tight.buffer, w, h, bg, fg); break; } case 2: vnc_write(vs, &bg, 2); vnc_write(vs, &fg, 2); tight_encode_mono_rect16(vs->tight.buffer, w, h, bg, fg); break; default: vnc_write_u8(vs, bg); vnc_write_u8(vs, fg); tight_encode_mono_rect8(vs->tight.buffer, w, h, bg, fg); break; } vs->tight.offset = bytes; bytes = tight_compress_data(vs, stream, bytes, level, Z_DEFAULT_STRATEGY); return (bytes >= 0); }","No, it is non-vulnerable."237235,"static void do_video_out(AVFormatContext *s, OutputStream *ost, AVFrame *in_picture, int *frame_size) { int ret, format_video_sync; AVPacket pkt; AVCodecContext *enc = ost->enc_ctx; *frame_size = 0; format_video_sync = video_sync_method; if (format_video_sync == VSYNC_AUTO) format_video_sync = (s->oformat->flags & AVFMT_NOTIMESTAMPS) ? VSYNC_PASSTHROUGH : (s->oformat->flags & AVFMT_VARIABLE_FPS) ? VSYNC_VFR : VSYNC_CFR; if (format_video_sync != VSYNC_PASSTHROUGH && ost->frame_number && in_picture->pts != AV_NOPTS_VALUE && in_picture->pts < ost->sync_opts) { nb_frames_drop++; av_log(NULL, AV_LOG_WARNING, ""*** dropping frame %d from stream %d at ts %""PRId64""\n"", ost->frame_number, ost->st->index, in_picture->pts); return; } if (in_picture->pts == AV_NOPTS_VALUE) in_picture->pts = ost->sync_opts; ost->sync_opts = in_picture->pts; if (!ost->frame_number) ost->first_pts = in_picture->pts; av_init_packet(&pkt); pkt.data = NULL; pkt.size = 0; if (ost->frame_number >= ost->max_frames) return; if (enc->flags & (AV_CODEC_FLAG_INTERLACED_DCT | AV_CODEC_FLAG_INTERLACED_ME) && ost->top_field_first >= 0) in_picture->top_field_first = !!ost->top_field_first; in_picture->quality = enc->global_quality; in_picture->pict_type = 0; if (ost->forced_kf_index < ost->forced_kf_count && in_picture->pts >= ost->forced_kf_pts[ost->forced_kf_index]) { in_picture->pict_type = AV_PICTURE_TYPE_I; ost->forced_kf_index++; } ost->frames_encoded++; ret = avcodec_send_frame(enc, in_picture); if (ret < 0) goto error; /* * For video, there may be reordering, so we can't throw away frames on * encoder flush, we need to limit them here, before they go into encoder. */ ost->frame_number++; while (1) { ret = avcodec_receive_packet(enc, &pkt); if (ret == AVERROR(EAGAIN)) break; if (ret < 0) goto error; av_packet_rescale_ts(&pkt, enc->time_base, ost->st->time_base); output_packet(s, &pkt, ost); *frame_size = pkt.size; /* if two pass, output log */ if (ost->logfile && enc->stats_out) { fprintf(ost->logfile, ""%s"", enc->stats_out); } ost->sync_opts++; } return; error: av_assert0(ret != AVERROR(EAGAIN) && ret != AVERROR_EOF); av_log(NULL, AV_LOG_FATAL, ""Video encoding failed\n""); exit_program(1); }","No, it is non-vulnerable."238236,"void qmp_screendump(const char *filename, Error **errp) { QemuConsole *previous_active_console; bool cswitch; previous_active_console = active_console; cswitch = previous_active_console && previous_active_console->index != 0; /* There is currently no way of specifying which screen we want to dump, so always dump the first one. */ if (cswitch) { console_select(0); } if (consoles[0] && consoles[0]->hw_screen_dump) { consoles[0]->hw_screen_dump(consoles[0]->hw, filename, cswitch, errp); } else { error_setg(errp, ""device doesn't support screendump""); } if (cswitch) { console_select(previous_active_console->index); } }","No, it is non-vulnerable."239237,"static int decode_frame_mp3on4(AVCodecContext * avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; MP3On4DecodeContext *s = avctx->priv_data; MPADecodeContext *m; int fsize, len = buf_size, out_size = 0; uint32_t header; OUT_INT *out_samples = data; OUT_INT *outptr, *bp; int fr, j, n; if(*data_size < MPA_FRAME_SIZE * MPA_MAX_CHANNELS * s->frames * sizeof(OUT_INT)) return -1; *data_size = 0; // Discard too short frames if (buf_size < HEADER_SIZE) return -1; // If only one decoder interleave is not needed outptr = s->frames == 1 ? out_samples : s->decoded_buf; avctx->bit_rate = 0; for (fr = 0; fr < s->frames; fr++) { fsize = AV_RB16(buf) >> 4; fsize = FFMIN3(fsize, len, MPA_MAX_CODED_FRAME_SIZE); m = s->mp3decctx[fr]; assert (m != NULL); header = (AV_RB32(buf) & 0x000fffff) | s->syncword; // patch header if (ff_mpa_check_header(header) < 0) // Bad header, discard block break; avpriv_mpegaudio_decode_header((MPADecodeHeader *)m, header); out_size += mp_decode_frame(m, outptr, buf, fsize); buf += fsize; len -= fsize; if(s->frames > 1) { n = m->avctx->frame_size*m->nb_channels; /* interleave output data */ bp = out_samples + s->coff[fr]; if(m->nb_channels == 1) { for(j = 0; j < n; j++) { *bp = s->decoded_buf[j]; bp += avctx->channels; } } else { for(j = 0; j < n; j++) { bp[0] = s->decoded_buf[j++]; bp[1] = s->decoded_buf[j]; bp += avctx->channels; } } } avctx->bit_rate += m->bit_rate; } /* update codec info */ avctx->sample_rate = s->mp3decctx[0]->sample_rate; *data_size = out_size; return buf_size; }","No, it is non-vulnerable."240238,"DISAS_INSN(cas2l) { uint16_t ext1, ext2; TCGv addr1, addr2, regs; /* cas2 Dc1:Dc2,Du1:Du2,(Rn1):(Rn2) */ ext1 = read_im16(env, s); if (ext1 & 0x8000) { /* Address Register */ addr1 = AREG(ext1, 12); } else { /* Data Register */ addr1 = DREG(ext1, 12); } ext2 = read_im16(env, s); if (ext2 & 0x8000) { /* Address Register */ addr2 = AREG(ext2, 12); } else { /* Data Register */ addr2 = DREG(ext2, 12); } /* if (R1) == Dc1 && (R2) == Dc2 then * (R1) = Du1 * (R2) = Du2 * else * Dc1 = (R1) * Dc2 = (R2) */ regs = tcg_const_i32(REG(ext2, 6) | (REG(ext1, 6) << 3) | (REG(ext2, 0) << 6) | (REG(ext1, 0) << 9)); gen_helper_cas2l(cpu_env, regs, addr1, addr2); tcg_temp_free(regs); /* Note that cas2l also assigned to env->cc_op. */ s->cc_op = CC_OP_CMPL; s->cc_op_synced = 1; }","No, it is non-vulnerable."241239,"static void cirrus_bitblt_rop_nop(CirrusVGAState *s, uint8_t *dst,const uint8_t *src, int dstpitch,int srcpitch, int bltwidth,int bltheight) { }","No, it is non-vulnerable."242240,"static void page_flush_tb(void) { int i; for (i = 0; i < V_L1_SIZE; i++) { page_flush_tb_1(V_L1_SHIFT / L2_BITS - 1, l1_map + i); } }","No, it is non-vulnerable."243241,"static void tcg_out_tlb_read(TCGContext *s, TCGReg addr_reg, TCGMemOp opc, tcg_insn_unit **label_ptr, int mem_index, bool is_read) { int tlb_offset = is_read ? offsetof(CPUArchState, tlb_table[mem_index][0].addr_read) : offsetof(CPUArchState, tlb_table[mem_index][0].addr_write); int s_mask = (1 << (opc & MO_SIZE)) - 1; TCGReg base = TCG_AREG0, x3; uint64_t tlb_mask; /* For aligned accesses, we check the first byte and include the alignment bits within the address. For unaligned access, we check that we don't cross pages using the address of the last byte of the access. */ if ((opc & MO_AMASK) == MO_ALIGN || s_mask == 0) { tlb_mask = TARGET_PAGE_MASK | s_mask; x3 = addr_reg; } else { tcg_out_insn(s, 3401, ADDI, TARGET_LONG_BITS == 64, TCG_REG_X3, addr_reg, s_mask); tlb_mask = TARGET_PAGE_MASK; x3 = TCG_REG_X3; } /* Extract the TLB index from the address into X0. X0<CPU_TLB_BITS:0> = addr_reg<TARGET_PAGE_BITS+CPU_TLB_BITS:TARGET_PAGE_BITS> */ tcg_out_ubfm(s, TARGET_LONG_BITS == 64, TCG_REG_X0, addr_reg, TARGET_PAGE_BITS, TARGET_PAGE_BITS + CPU_TLB_BITS); /* Store the page mask part of the address into X3. */ tcg_out_logicali(s, I3404_ANDI, TARGET_LONG_BITS == 64, TCG_REG_X3, x3, tlb_mask); /* Add any ""high bits"" from the tlb offset to the env address into X2, to take advantage of the LSL12 form of the ADDI instruction. X2 = env + (tlb_offset & 0xfff000) */ if (tlb_offset & 0xfff000) { tcg_out_insn(s, 3401, ADDI, TCG_TYPE_I64, TCG_REG_X2, base, tlb_offset & 0xfff000); base = TCG_REG_X2; } /* Merge the tlb index contribution into X2. X2 = X2 + (X0 << CPU_TLB_ENTRY_BITS) */ tcg_out_insn(s, 3502S, ADD_LSL, TCG_TYPE_I64, TCG_REG_X2, base, TCG_REG_X0, CPU_TLB_ENTRY_BITS); /* Merge ""low bits"" from tlb offset, load the tlb comparator into X0. X0 = load [X2 + (tlb_offset & 0x000fff)] */ tcg_out_ldst(s, TARGET_LONG_BITS == 32 ? I3312_LDRW : I3312_LDRX, TCG_REG_X0, TCG_REG_X2, tlb_offset & 0xfff); /* Load the tlb addend. Do that early to avoid stalling. X1 = load [X2 + (tlb_offset & 0xfff) + offsetof(addend)] */ tcg_out_ldst(s, I3312_LDRX, TCG_REG_X1, TCG_REG_X2, (tlb_offset & 0xfff) + (offsetof(CPUTLBEntry, addend)) - (is_read ? offsetof(CPUTLBEntry, addr_read) : offsetof(CPUTLBEntry, addr_write))); /* Perform the address comparison. */ tcg_out_cmp(s, (TARGET_LONG_BITS == 64), TCG_REG_X0, TCG_REG_X3, 0); /* If not equal, we jump to the slow path. */ *label_ptr = s->code_ptr; tcg_out_goto_cond_noaddr(s, TCG_COND_NE); }","No, it is non-vulnerable."244242,"static int usb_host_scan_sys(void *opaque, USBScanFunc *func) { DIR *dir = 0; char line[1024]; int bus_num, addr, speed, class_id, product_id, vendor_id; int ret = 0; char product_name[512]; struct dirent *de; dir = opendir(USBSYSBUS_PATH ""/devices""); if (!dir) { perror(""husb: cannot open devices directory""); goto the_end; } while ((de = readdir(dir))) { if (de->d_name[0] != '.' && !strchr(de->d_name, ':')) { char *tmpstr = de->d_name; if (!strncmp(de->d_name, ""usb"", 3)) tmpstr += 3; bus_num = atoi(tmpstr); if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/devnum"", de->d_name)) goto the_end; if (sscanf(line, ""%d"", &addr) != 1) goto the_end; if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/bDeviceClass"", de->d_name)) goto the_end; if (sscanf(line, ""%x"", &class_id) != 1) goto the_end; if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/idVendor"", de->d_name)) goto the_end; if (sscanf(line, ""%x"", &vendor_id) != 1) goto the_end; if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/idProduct"", de->d_name)) goto the_end; if (sscanf(line, ""%x"", &product_id) != 1) goto the_end; if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/product"", de->d_name)) { *product_name = 0; } else { if (strlen(line) > 0) line[strlen(line) - 1] = '\0'; pstrcpy(product_name, sizeof(product_name), line); } if (!usb_host_read_file(line, sizeof(line), USBSYSBUS_PATH ""/devices/%s/speed"", de->d_name)) goto the_end; if (!strcmp(line, ""480\n"")) speed = USB_SPEED_HIGH; else if (!strcmp(line, ""1.5\n"")) speed = USB_SPEED_LOW; else speed = USB_SPEED_FULL; ret = func(opaque, bus_num, addr, class_id, vendor_id, product_id, product_name, speed); if (ret) goto the_end; } } the_end: if (dir) closedir(dir); return ret; }","No, it is non-vulnerable."245243,"int svm_check_intercept_param(uint32_t type, uint64_t param) { switch(type) { case SVM_EXIT_READ_CR0 ... SVM_EXIT_READ_CR0 + 8: if (INTERCEPTEDw(_cr_read, (1 << (type - SVM_EXIT_READ_CR0)))) { vmexit(type, param); return 1; } break; case SVM_EXIT_READ_DR0 ... SVM_EXIT_READ_DR0 + 8: if (INTERCEPTEDw(_dr_read, (1 << (type - SVM_EXIT_READ_DR0)))) { vmexit(type, param); return 1; } break; case SVM_EXIT_WRITE_CR0 ... SVM_EXIT_WRITE_CR0 + 8: if (INTERCEPTEDw(_cr_write, (1 << (type - SVM_EXIT_WRITE_CR0)))) { vmexit(type, param); return 1; } break; case SVM_EXIT_WRITE_DR0 ... SVM_EXIT_WRITE_DR0 + 8: if (INTERCEPTEDw(_dr_write, (1 << (type - SVM_EXIT_WRITE_DR0)))) { vmexit(type, param); return 1; } break; case SVM_EXIT_EXCP_BASE ... SVM_EXIT_EXCP_BASE + 16: if (INTERCEPTEDl(_exceptions, (1 << (type - SVM_EXIT_EXCP_BASE)))) { vmexit(type, param); return 1; } break; case SVM_EXIT_IOIO: if (INTERCEPTED(1ULL << INTERCEPT_IOIO_PROT)) { /* FIXME: this should be read in at vmrun (faster this way?) */ uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.iopm_base_pa)); uint16_t port = (uint16_t) (param >> 16); if(ldub_phys(addr + port / 8) & (1 << (port % 8))) vmexit(type, param); } break; case SVM_EXIT_MSR: if (INTERCEPTED(1ULL << INTERCEPT_MSR_PROT)) { /* FIXME: this should be read in at vmrun (faster this way?) */ uint64_t addr = ldq_phys(env->vm_vmcb + offsetof(struct vmcb, control.msrpm_base_pa)); switch((uint32_t)ECX) { case 0 ... 0x1fff: T0 = (ECX * 2) % 8; T1 = ECX / 8; break; case 0xc0000000 ... 0xc0001fff: T0 = (8192 + ECX - 0xc0000000) * 2; T1 = (T0 / 8); T0 %= 8; break; case 0xc0010000 ... 0xc0011fff: T0 = (16384 + ECX - 0xc0010000) * 2; T1 = (T0 / 8); T0 %= 8; break; default: vmexit(type, param); return 1; } if (ldub_phys(addr + T1) & ((1 << param) << T0)) vmexit(type, param); return 1; } break; default: if (INTERCEPTED((1ULL << ((type - SVM_EXIT_INTR) + INTERCEPT_INTR)))) { vmexit(type, param); return 1; } break; } return 0; }","No, it is non-vulnerable."246244,"int kvm_arch_get_registers(CPUState *env) { struct kvm_regs regs; struct kvm_sregs sregs; int i, ret; ret = kvm_vcpu_ioctl(env, KVM_GET_REGS, &regs); if (ret < 0) return ret; ret = kvm_vcpu_ioctl(env, KVM_GET_SREGS, &sregs); if (ret < 0) return ret; env->ctr = regs.ctr; env->lr = regs.lr; env->xer = regs.xer; env->msr = regs.msr; env->nip = regs.pc; env->spr[SPR_SRR0] = regs.srr0; env->spr[SPR_SRR1] = regs.srr1; env->spr[SPR_SPRG0] = regs.sprg0; env->spr[SPR_SPRG1] = regs.sprg1; env->spr[SPR_SPRG2] = regs.sprg2; env->spr[SPR_SPRG3] = regs.sprg3; env->spr[SPR_SPRG4] = regs.sprg4; env->spr[SPR_SPRG5] = regs.sprg5; env->spr[SPR_SPRG6] = regs.sprg6; env->spr[SPR_SPRG7] = regs.sprg7; for (i = 0;i < 32; i++) env->gpr[i] = regs.gpr[i]; #ifdef KVM_CAP_PPC_SEGSTATE if (kvm_check_extension(env->kvm_state, KVM_CAP_PPC_SEGSTATE)) { env->sdr1 = sregs.u.s.sdr1; /* Sync SLB */ #ifdef TARGET_PPC64 for (i = 0; i < 64; i++) { ppc_store_slb(env, sregs.u.s.ppc64.slb[i].slbe, sregs.u.s.ppc64.slb[i].slbv); } #endif /* Sync SRs */ for (i = 0; i < 16; i++) { env->sr[i] = sregs.u.s.ppc32.sr[i]; } /* Sync BATs */ for (i = 0; i < 8; i++) { env->DBAT[0][i] = sregs.u.s.ppc32.dbat[i] & 0xffffffff; env->DBAT[1][i] = sregs.u.s.ppc32.dbat[i] >> 32; env->IBAT[0][i] = sregs.u.s.ppc32.ibat[i] & 0xffffffff; env->IBAT[1][i] = sregs.u.s.ppc32.ibat[i] >> 32; } } #endif return 0; }","No, it is non-vulnerable."247245,"void qemu_cond_wait(QemuCond *cond, QemuMutex *mutex) { /* * This access is protected under the mutex. */ cond->waiters++; /* * Unlock external mutex and wait for signal. * NOTE: we've held mutex locked long enough to increment * waiters count above, so there's no problem with * leaving mutex unlocked before we wait on semaphore. */ qemu_mutex_unlock(mutex); WaitForSingleObject(cond->sema, INFINITE); /* Now waiters must rendez-vous with the signaling thread and * let it continue. For cond_broadcast this has heavy contention * and triggers thundering herd. So goes life. * * Decrease waiters count. The mutex is not taken, so we have * to do this atomically. * * All waiters contend for the mutex at the end of this function * until the signaling thread relinquishes it. To ensure * each waiter consumes exactly one slice of the semaphore, * the signaling thread stops until it is told by the last * waiter that it can go on. */ if (InterlockedDecrement(&cond->waiters) == cond->target) { SetEvent(cond->continue_event); } qemu_mutex_lock(mutex); }","Yes, it is vulnerable."248246,"static void gen_wsr(DisasContext *dc, uint32_t sr, TCGv_i32 s) { static void (* const wsr_handler[256])(DisasContext *dc, uint32_t sr, TCGv_i32 v) = { [LBEG] = gen_wsr_lbeg, [LEND] = gen_wsr_lend, [SAR] = gen_wsr_sar, [BR] = gen_wsr_br, [LITBASE] = gen_wsr_litbase, [ACCHI] = gen_wsr_acchi, [WINDOW_BASE] = gen_wsr_windowbase, [WINDOW_START] = gen_wsr_windowstart, [PTEVADDR] = gen_wsr_ptevaddr, [RASID] = gen_wsr_rasid, [ITLBCFG] = gen_wsr_tlbcfg, [DTLBCFG] = gen_wsr_tlbcfg, [IBREAKENABLE] = gen_wsr_ibreakenable, [ATOMCTL] = gen_wsr_atomctl, [IBREAKA] = gen_wsr_ibreaka, [IBREAKA + 1] = gen_wsr_ibreaka, [DBREAKA] = gen_wsr_dbreaka, [DBREAKA + 1] = gen_wsr_dbreaka, [DBREAKC] = gen_wsr_dbreakc, [DBREAKC + 1] = gen_wsr_dbreakc, [CPENABLE] = gen_wsr_cpenable, [INTSET] = gen_wsr_intset, [INTCLEAR] = gen_wsr_intclear, [INTENABLE] = gen_wsr_intenable, [PS] = gen_wsr_ps, [DEBUGCAUSE] = gen_wsr_debugcause, [PRID] = gen_wsr_prid, [ICOUNT] = gen_wsr_icount, [ICOUNTLEVEL] = gen_wsr_icountlevel, [CCOMPARE] = gen_wsr_ccompare, [CCOMPARE + 1] = gen_wsr_ccompare, [CCOMPARE + 2] = gen_wsr_ccompare, }; if (sregnames[sr]) { if (wsr_handler[sr]) { wsr_handler[sr](dc, sr, s); } else { tcg_gen_mov_i32(cpu_SR[sr], s); } } else { qemu_log(""WSR %d not implemented, "", sr); } }","Yes, it is vulnerable."249247,"static int connect_namedsocket(const char *path) { int sockfd, size; struct sockaddr_un helper; if (strlen(path) >= sizeof(helper.sun_path)) { fprintf(stderr, ""Socket name too large\n""); return -1; } sockfd = socket(AF_UNIX, SOCK_STREAM, 0); if (sockfd < 0) { fprintf(stderr, ""failed to create socket: %s\n"", strerror(errno)); return -1; } strcpy(helper.sun_path, path); helper.sun_family = AF_UNIX; size = strlen(helper.sun_path) + sizeof(helper.sun_family); if (connect(sockfd, (struct sockaddr *)&helper, size) < 0) { fprintf(stderr, ""failed to connect to %s: %s\n"", path, strerror(errno)); close(sockfd); return -1; } /* remove the socket for security reasons */ unlink(path); return sockfd; }","No, it is non-vulnerable."250248,static void guest_file_init(void) { QTAILQ_INIT(&guest_file_state.filehandles); },"No, it is non-vulnerable."251249,"static void pchip_write(void *opaque, target_phys_addr_t addr, uint64_t v32, unsigned size) { TyphoonState *s = opaque; uint64_t val, oldval; if (addr & 4) { val = v32 << 32 | s->latch_tmp; addr ^= 4; } else { s->latch_tmp = v32; return; } switch (addr) { case 0x0000: /* WSBA0: Window Space Base Address Register. */ s->pchip.win[0].base_addr = val; break; case 0x0040: /* WSBA1 */ s->pchip.win[1].base_addr = val; break; case 0x0080: /* WSBA2 */ s->pchip.win[2].base_addr = val; break; case 0x00c0: /* WSBA3 */ s->pchip.win[3].base_addr = val; break; case 0x0100: /* WSM0: Window Space Mask Register. */ s->pchip.win[0].mask = val; break; case 0x0140: /* WSM1 */ s->pchip.win[1].mask = val; break; case 0x0180: /* WSM2 */ s->pchip.win[2].mask = val; break; case 0x01c0: /* WSM3 */ s->pchip.win[3].mask = val; break; case 0x0200: /* TBA0: Translated Base Address Register. */ s->pchip.win[0].translated_base_pfn = val >> 10; break; case 0x0240: /* TBA1 */ s->pchip.win[1].translated_base_pfn = val >> 10; break; case 0x0280: /* TBA2 */ s->pchip.win[2].translated_base_pfn = val >> 10; break; case 0x02c0: /* TBA3 */ s->pchip.win[3].translated_base_pfn = val >> 10; break; case 0x0300: /* PCTL: Pchip Control Register. */ oldval = s->pchip.ctl; oldval &= ~0x00001cff0fc7ffull; /* RW fields */ oldval |= val & 0x00001cff0fc7ffull; s->pchip.ctl = oldval; break; case 0x0340: /* PLAT: Pchip Master Latency Register. */ break; case 0x03c0: /* PERROR: Pchip Error Register. */ break; case 0x0400: /* PERRMASK: Pchip Error Mask Register. */ break; case 0x0440: /* PERRSET: Pchip Error Set Register. */ break; case 0x0480: /* TLBIV: Translation Buffer Invalidate Virtual Register. */ break; case 0x04c0: /* TLBIA: Translation Buffer Invalidate All Register (WO). */ break; case 0x0500: /* PMONCTL */ case 0x0540: /* PMONCNT */ case 0x0800: /* SPRST */ break; default: cpu_unassigned_access(cpu_single_env, addr, 1, 0, 0, size); return; } }","No, it is non-vulnerable."252250,"static int usb_host_handle_data(USBDevice *dev, USBPacket *p) { USBHostDevice *s = (USBHostDevice *)dev; int ret, fd, mode; int one = 1, shortpacket = 0, timeout = 50; sigset_t new_mask, old_mask; uint8_t devep = p->devep; /* protect data transfers from SIGALRM signal */ sigemptyset(&new_mask); sigaddset(&new_mask, SIGALRM); sigprocmask(SIG_BLOCK, &new_mask, &old_mask); if (p->pid == USB_TOKEN_IN) { devep |= 0x80; mode = O_RDONLY; shortpacket = 1; } else { mode = O_WRONLY; } fd = ensure_ep_open(s, devep, mode); if (fd < 0) { sigprocmask(SIG_SETMASK, &old_mask, NULL); return USB_RET_NODEV; } if (ioctl(fd, USB_SET_TIMEOUT, &timeout) < 0) { #ifdef DEBUG printf(""handle_data: failed to set timeout - %s\n"", strerror(errno)); #endif } if (shortpacket) { if (ioctl(fd, USB_SET_SHORT_XFER, &one) < 0) { #ifdef DEBUG printf(""handle_data: failed to set short xfer mode - %s\n"", strerror(errno)); #endif sigprocmask(SIG_SETMASK, &old_mask, NULL); } } if (p->pid == USB_TOKEN_IN) ret = read(fd, p->data, p->len); else ret = write(fd, p->data, p->len); sigprocmask(SIG_SETMASK, &old_mask, NULL); if (ret < 0) { #ifdef DEBUG printf(""handle_data: error after %s data - %s\n"", pid == USB_TOKEN_IN ? ""reading"" : ""writing"", strerror(errno)); #endif switch(errno) { case ETIMEDOUT: case EINTR: return USB_RET_NAK; default: return USB_RET_STALL; } } else { return ret; } }","Yes, it is vulnerable."253251,"int ff_mpv_common_frame_size_change(MpegEncContext *s) { int i, err = 0; if (!s->context_initialized) return AVERROR(EINVAL); if (s->slice_context_count > 1) { for (i = 0; i < s->slice_context_count; i++) { free_duplicate_context(s->thread_context[i]); } for (i = 1; i < s->slice_context_count; i++) { av_freep(&s->thread_context[i]); } } else free_duplicate_context(s); free_context_frame(s); if (s->picture) for (i = 0; i < MAX_PICTURE_COUNT; i++) { s->picture[i].needs_realloc = 1; } s->last_picture_ptr = s->next_picture_ptr = s->current_picture_ptr = NULL; // init if (s->codec_id == AV_CODEC_ID_MPEG2VIDEO && !s->progressive_sequence) s->mb_height = (s->height + 31) / 32 * 2; else s->mb_height = (s->height + 15) / 16; if ((s->width || s->height) && (err = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0) goto fail; if ((err = init_context_frame(s))) goto fail; memset(s->thread_context, 0, sizeof(s->thread_context)); s->thread_context[0] = s; if (s->width && s->height) { int nb_slices = s->slice_context_count; if (nb_slices > 1) { for (i = 0; i < nb_slices; i++) { if (i) { s->thread_context[i] = av_malloc(sizeof(MpegEncContext)); memcpy(s->thread_context[i], s, sizeof(MpegEncContext)); } if ((err = init_duplicate_context(s->thread_context[i])) < 0) goto fail; s->thread_context[i]->start_mb_y = (s->mb_height * (i) + nb_slices / 2) / nb_slices; s->thread_context[i]->end_mb_y = (s->mb_height * (i + 1) + nb_slices / 2) / nb_slices; } } else { err = init_duplicate_context(s); if (err < 0) goto fail; s->start_mb_y = 0; s->end_mb_y = s->mb_height; } s->slice_context_count = nb_slices; } return 0; fail: ff_mpv_common_end(s); return err; }","Yes, it is vulnerable."254252,"static uint32_t virtio_ioport_read(VirtIOPCIProxy *proxy, uint32_t addr) { VirtIODevice *vdev = proxy->vdev; uint32_t ret = 0xFFFFFFFF; switch (addr) { case VIRTIO_PCI_HOST_FEATURES: ret = vdev->get_features(vdev); ret |= (1 << VIRTIO_F_NOTIFY_ON_EMPTY); ret |= (1 << VIRTIO_RING_F_INDIRECT_DESC); ret |= (1 << VIRTIO_F_BAD_FEATURE); break; case VIRTIO_PCI_GUEST_FEATURES: ret = vdev->features; break; case VIRTIO_PCI_QUEUE_PFN: ret = virtio_queue_get_addr(vdev, vdev->queue_sel) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT; break; case VIRTIO_PCI_QUEUE_NUM: ret = virtio_queue_get_num(vdev, vdev->queue_sel); break; case VIRTIO_PCI_QUEUE_SEL: ret = vdev->queue_sel; break; case VIRTIO_PCI_STATUS: ret = vdev->status; break; case VIRTIO_PCI_ISR: /* reading from the ISR also clears it. */ ret = vdev->isr; vdev->isr = 0; qemu_set_irq(proxy->pci_dev.irq[0], 0); break; case VIRTIO_MSI_CONFIG_VECTOR: ret = vdev->config_vector; break; case VIRTIO_MSI_QUEUE_VECTOR: ret = virtio_queue_vector(vdev, vdev->queue_sel); break; default: break; } return ret; }","Yes, it is vulnerable."255253,"static int dvbsub_parse_display_definition_segment(AVCodecContext *avctx, const uint8_t *buf, int buf_size) { DVBSubContext *ctx = avctx->priv_data; DVBSubDisplayDefinition *display_def = ctx->display_definition; int dds_version, info_byte; if (buf_size < 5) return AVERROR_INVALIDDATA; info_byte = bytestream_get_byte(&buf); dds_version = info_byte >> 4; if (display_def && display_def->version == dds_version) return 0; // already have this display definition version if (!display_def) { display_def = av_mallocz(sizeof(*display_def)); if (!display_def) return AVERROR(ENOMEM); ctx->display_definition = display_def; } display_def->version = dds_version; display_def->x = 0; display_def->y = 0; display_def->width = bytestream_get_be16(&buf) + 1; display_def->height = bytestream_get_be16(&buf) + 1; if (!avctx->width || !avctx->height) { avctx->width = display_def->width; avctx->height = display_def->height; } if (buf_size < 13) return AVERROR_INVALIDDATA; if (info_byte & 1<<3) { // display_window_flag display_def->x = bytestream_get_be16(&buf); display_def->width = bytestream_get_be16(&buf) - display_def->x + 1; display_def->y = bytestream_get_be16(&buf); display_def->height = bytestream_get_be16(&buf) - display_def->y + 1; } return 0; }","No, it is non-vulnerable."256254,"static void gen_st (DisasContext *ctx, uint32_t opc, int rt, int base, int16_t offset) { TCGv t0 = tcg_temp_new(); TCGv t1 = tcg_temp_new(); int mem_idx = ctx->mem_idx; gen_base_offset_addr(ctx, t0, base, offset); gen_load_gpr(t1, rt); switch (opc) { #if defined(TARGET_MIPS64) case OPC_SD: tcg_gen_qemu_st_tl(t1, t0, mem_idx, MO_TEQ | ctx->default_tcg_memop_mask); break; case OPC_SDL: gen_helper_0e2i(sdl, t1, t0, mem_idx); break; case OPC_SDR: gen_helper_0e2i(sdr, t1, t0, mem_idx); break; #endif case OPC_SW: tcg_gen_qemu_st_tl(t1, t0, mem_idx, MO_TEUL | ctx->default_tcg_memop_mask); break; case OPC_SH: tcg_gen_qemu_st_tl(t1, t0, mem_idx, MO_TEUW | ctx->default_tcg_memop_mask); break; case OPC_SB: tcg_gen_qemu_st_tl(t1, t0, mem_idx, MO_8); break; case OPC_SWL: gen_helper_0e2i(swl, t1, t0, mem_idx); break; case OPC_SWR: gen_helper_0e2i(swr, t1, t0, mem_idx); break; } tcg_temp_free(t0); tcg_temp_free(t1); }","Yes, it is vulnerable."257255,static void *qpa_audio_init (void) { return &conf; },"Yes, it is vulnerable."258256,void timer_deinit(QEMUTimer *ts) { assert(ts->expire_time == -1); ts->timer_list = NULL; },"No, it is non-vulnerable."259257,"int ide_init_drive(IDEState *s, BlockDriverState *bs, IDEDriveKind kind, const char *version, const char *serial, const char *model, uint64_t wwn) { int cylinders, heads, secs; uint64_t nb_sectors; s->bs = bs; s->drive_kind = kind; bdrv_get_geometry(bs, &nb_sectors); bdrv_guess_geometry(bs, &cylinders, &heads, &secs); if (cylinders < 1 || cylinders > 16383) { error_report(""cyls must be between 1 and 16383""); return -1; } if (heads < 1 || heads > 16) { error_report(""heads must be between 1 and 16""); return -1; } if (secs < 1 || secs > 63) { error_report(""secs must be between 1 and 63""); return -1; } s->cylinders = cylinders; s->heads = heads; s->sectors = secs; s->nb_sectors = nb_sectors; s->wwn = wwn; /* The SMART values should be preserved across power cycles but they aren't. */ s->smart_enabled = 1; s->smart_autosave = 1; s->smart_errors = 0; s->smart_selftest_count = 0; if (kind == IDE_CD) { bdrv_set_dev_ops(bs, &ide_cd_block_ops, s); bdrv_set_buffer_alignment(bs, 2048); } else { if (!bdrv_is_inserted(s->bs)) { error_report(""Device needs media, but drive is empty""); return -1; } if (bdrv_is_read_only(bs)) { error_report(""Can't use a read-only drive""); return -1; } } if (serial) { pstrcpy(s->drive_serial_str, sizeof(s->drive_serial_str), serial); } else { snprintf(s->drive_serial_str, sizeof(s->drive_serial_str), ""QM%05d"", s->drive_serial); } if (model) { pstrcpy(s->drive_model_str, sizeof(s->drive_model_str), model); } else { switch (kind) { case IDE_CD: strcpy(s->drive_model_str, ""QEMU DVD-ROM""); break; case IDE_CFATA: strcpy(s->drive_model_str, ""QEMU MICRODRIVE""); break; default: strcpy(s->drive_model_str, ""QEMU HARDDISK""); break; } } if (version) { pstrcpy(s->version, sizeof(s->version), version); } else { pstrcpy(s->version, sizeof(s->version), qemu_get_version()); } ide_reset(s); bdrv_iostatus_enable(bs); return 0; }","No, it is non-vulnerable."260258,"static QDict *qmp_check_input_obj(QObject *input_obj, Error **errp) { const QDictEntry *ent; int has_exec_key = 0; QDict *input_dict; if (qobject_type(input_obj) != QTYPE_QDICT) { error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT, ""object""); return NULL; } input_dict = qobject_to_qdict(input_obj); for (ent = qdict_first(input_dict); ent; ent = qdict_next(input_dict, ent)){ const char *arg_name = qdict_entry_key(ent); const QObject *arg_obj = qdict_entry_value(ent); if (!strcmp(arg_name, ""execute"")) { if (qobject_type(arg_obj) != QTYPE_QSTRING) { error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT_MEMBER, ""execute"", ""string""); return NULL; } has_exec_key = 1; } else if (!strcmp(arg_name, ""arguments"")) { if (qobject_type(arg_obj) != QTYPE_QDICT) { error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT_MEMBER, ""arguments"", ""object""); return NULL; } } else if (!strcmp(arg_name, ""id"")) { /* Any string is acceptable as ""id"", so nothing to check */ } else { error_setg(errp, QERR_QMP_EXTRA_MEMBER, arg_name); return NULL; } } if (!has_exec_key) { error_setg(errp, QERR_QMP_BAD_INPUT_OBJECT, ""execute""); return NULL; } return input_dict; }","No, it is non-vulnerable."261259,"static void term_read(void *opaque, const uint8_t *buf, int size) { int i; for(i = 0; i < size; i++) term_handle_byte(buf[i]); }","No, it is non-vulnerable."262260,"static void test_validate_fail_struct_missing(TestInputVisitorData *data, const void *unused) { Error *err = NULL; Visitor *v; QObject *any; GenericAlternate *alt; bool present; int en; int64_t i64; uint32_t u32; int8_t i8; char *str; double dbl; v = validate_test_init(data, ""{}""); visit_start_struct(v, NULL, NULL, 0, &error_abort); visit_start_struct(v, ""struct"", NULL, 0, &err); error_free_or_abort(&err); visit_start_list(v, ""list"", NULL, 0, &err); error_free_or_abort(&err); visit_start_alternate(v, ""alternate"", &alt, sizeof(*alt), false, &err); error_free_or_abort(&err); visit_optional(v, ""optional"", &present); g_assert(!present); visit_type_enum(v, ""enum"", &en, EnumOne_lookup, &err); error_free_or_abort(&err); visit_type_int(v, ""i64"", &i64, &err); error_free_or_abort(&err); visit_type_uint32(v, ""u32"", &u32, &err); error_free_or_abort(&err); visit_type_int8(v, ""i8"", &i8, &err); error_free_or_abort(&err); visit_type_str(v, ""i8"", &str, &err); error_free_or_abort(&err); visit_type_number(v, ""dbl"", &dbl, &err); error_free_or_abort(&err); visit_type_any(v, ""any"", &any, &err); error_free_or_abort(&err); visit_type_null(v, ""null"", &err); error_free_or_abort(&err); visit_end_struct(v, NULL); }","No, it is non-vulnerable."263261,"void dma_acct_start(BlockDriverState *bs, BlockAcctCookie *cookie, QEMUSGList *sg, enum BlockAcctType type) { block_acct_start(bdrv_get_stats(bs), cookie, sg->size, type); }","No, it is non-vulnerable."264262,"xilinx_axienet_data_stream_push(StreamSlave *obj, uint8_t *buf, size_t size, uint32_t *hdr) { XilinxAXIEnetStreamSlave *ds = XILINX_AXI_ENET_DATA_STREAM(obj); XilinxAXIEnet *s = ds->enet; /* TX enable ? */ if (!(s->tc & TC_TX)) { return size; } /* Jumbo or vlan sizes ? */ if (!(s->tc & TC_JUM)) { if (size > 1518 && size <= 1522 && !(s->tc & TC_VLAN)) { return size; } } if (hdr[0] & 1) { unsigned int start_off = hdr[1] >> 16; unsigned int write_off = hdr[1] & 0xffff; uint32_t tmp_csum; uint16_t csum; tmp_csum = net_checksum_add(size - start_off, (uint8_t *)buf + start_off); /* Accumulate the seed. */ tmp_csum += hdr[2] & 0xffff; /* Fold the 32bit partial checksum. */ csum = net_checksum_finish(tmp_csum); /* Writeback. */ buf[write_off] = csum >> 8; buf[write_off + 1] = csum & 0xff; } qemu_send_packet(qemu_get_queue(s->nic), buf, size); s->stats.tx_bytes += size; s->regs[R_IS] |= IS_TX_COMPLETE; enet_update_irq(s); return size; }","No, it is non-vulnerable."265263,"void cpu_x86_set_a20(CPUX86State *env, int a20_state) { a20_state = (a20_state != 0); if (a20_state != a20_enabled) { #if defined(DEBUG_MMU) printf(""A20 update: a20=%d\n"", a20_state); #endif /* if the cpu is currently executing code, we must unlink it and all the potentially executing TB */ cpu_interrupt(env, 0); /* when a20 is changed, all the MMU mappings are invalid, so we must flush everything */ tlb_flush(env); a20_enabled = a20_state; if (a20_enabled) a20_mask = 0xffffffff; else a20_mask = 0xffefffff; } }","No, it is non-vulnerable."266264,uint64_t HELPER(cvd)(int32_t bin) { /* positive 0 */ uint64_t dec = 0x0c; int shift = 4; if (bin < 0) { bin = -bin; dec = 0x0d; } for (shift = 4; (shift < 64) && bin; shift += 4) { int current_number = bin % 10; dec |= (current_number) << shift; bin /= 10; } return dec; },"No, it is non-vulnerable."267265,"static void tcg_target_qemu_prologue(TCGContext *s) { int frame_size, i; /* Allocate space for the fixed frame marker. */ frame_size = -TCG_TARGET_CALL_STACK_OFFSET; frame_size += TCG_TARGET_STATIC_CALL_ARGS_SIZE; /* Allocate space for the saved registers. */ frame_size += ARRAY_SIZE(tcg_target_callee_save_regs) * 4; /* Align the allocated space. */ frame_size = ((frame_size + TCG_TARGET_STACK_ALIGN - 1) & -TCG_TARGET_STACK_ALIGN); /* The return address is stored in the caller's frame. */ tcg_out_st(s, TCG_TYPE_PTR, TCG_REG_RP, TCG_REG_SP, -20); /* Allocate stack frame, saving the first register at the same time. */ tcg_out_ldst(s, tcg_target_callee_save_regs[0], TCG_REG_SP, frame_size, INSN_STWM); /* Save all callee saved registers. */ for (i = 1; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) { tcg_out_st(s, TCG_TYPE_PTR, tcg_target_callee_save_regs[i], TCG_REG_SP, -frame_size + i * 4); } #ifdef CONFIG_USE_GUEST_BASE if (GUEST_BASE != 0) { tcg_out_movi(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG, GUEST_BASE); tcg_regset_set_reg(s->reserved_regs, TCG_GUEST_BASE_REG); } #endif /* Jump to TB, and adjust R18 to be the return address. */ tcg_out32(s, INSN_BLE_SR4 | INSN_R2(TCG_REG_R26)); tcg_out_mov(s, TCG_TYPE_I32, TCG_REG_R18, TCG_REG_R31); /* Restore callee saved registers. */ tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_RP, TCG_REG_SP, -frame_size - 20); for (i = 1; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) { tcg_out_ld(s, TCG_TYPE_PTR, tcg_target_callee_save_regs[i], TCG_REG_SP, -frame_size + i * 4); } /* Deallocate stack frame and return. */ tcg_out32(s, INSN_BV | INSN_R2(TCG_REG_RP)); tcg_out_ldst(s, tcg_target_callee_save_regs[0], TCG_REG_SP, -frame_size, INSN_LDWM); }","No, it is non-vulnerable."268266,"bool io_mem_read(MemoryRegion *mr, hwaddr addr, uint64_t *pval, unsigned size) { return memory_region_dispatch_read(mr, addr, pval, size); }","Yes, it is vulnerable."269267,static void init_scan_tables(H264Context *h) { int i; for (i = 0; i < 16; i++) { #define TRANSPOSE(x) (x >> 2) | ((x << 2) & 0xF) h->zigzag_scan[i] = TRANSPOSE(ff_zigzag_scan[i]); h->field_scan[i] = TRANSPOSE(field_scan[i]); #undef TRANSPOSE } for (i = 0; i < 64; i++) { #define TRANSPOSE(x) (x >> 3) | ((x & 7) << 3) h->zigzag_scan8x8[i] = TRANSPOSE(ff_zigzag_direct[i]); h->zigzag_scan8x8_cavlc[i] = TRANSPOSE(zigzag_scan8x8_cavlc[i]); h->field_scan8x8[i] = TRANSPOSE(field_scan8x8[i]); h->field_scan8x8_cavlc[i] = TRANSPOSE(field_scan8x8_cavlc[i]); #undef TRANSPOSE } if (h->sps.transform_bypass) { // FIXME same ugly h->zigzag_scan_q0 = ff_zigzag_scan; h->zigzag_scan8x8_q0 = ff_zigzag_direct; h->zigzag_scan8x8_cavlc_q0 = zigzag_scan8x8_cavlc; h->field_scan_q0 = field_scan; h->field_scan8x8_q0 = field_scan8x8; h->field_scan8x8_cavlc_q0 = field_scan8x8_cavlc; } else { h->zigzag_scan_q0 = h->zigzag_scan; h->zigzag_scan8x8_q0 = h->zigzag_scan8x8; h->zigzag_scan8x8_cavlc_q0 = h->zigzag_scan8x8_cavlc; h->field_scan_q0 = h->field_scan; h->field_scan8x8_q0 = h->field_scan8x8; h->field_scan8x8_cavlc_q0 = h->field_scan8x8_cavlc; } },"No, it is non-vulnerable."270268,"void avg_pixels8_altivec(uint8_t * block, const uint8_t * pixels, int line_size, int h) { POWERPC_TBL_DECLARE(altivec_avg_pixels8_num, 1); #ifdef ALTIVEC_USE_REFERENCE_C_CODE int i; POWERPC_TBL_START_COUNT(altivec_avg_pixels8_num, 1); for (i = 0; i < h; i++) { *((uint32_t *) (block)) = (((*((uint32_t *) (block))) | ((((const struct unaligned_32 *) (pixels))->l))) - ((((*((uint32_t *) (block))) ^ ((((const struct unaligned_32 *) (pixels))-> l))) & 0xFEFEFEFEUL) >> 1)); *((uint32_t *) (block + 4)) = (((*((uint32_t *) (block + 4))) | ((((const struct unaligned_32 *) (pixels + 4))->l))) - ((((*((uint32_t *) (block + 4))) ^ ((((const struct unaligned_32 *) (pixels + 4))-> l))) & 0xFEFEFEFEUL) >> 1)); pixels += line_size; block += line_size; } POWERPC_TBL_STOP_COUNT(altivec_avg_pixels8_num, 1); #else /* ALTIVEC_USE_REFERENCE_C_CODE */ register vector unsigned char pixelsv1, pixelsv2, pixelsv, blockv; int i; POWERPC_TBL_START_COUNT(altivec_avg_pixels8_num, 1); for (i = 0; i < h; i++) { /* block is 8 bytes-aligned, so we're either in the left block (16 bytes-aligned) or in the right block (not) */ int rightside = ((unsigned long)block & 0x0000000F); blockv = vec_ld(0, block); pixelsv1 = vec_ld(0, (unsigned char*)pixels); pixelsv2 = vec_ld(16, (unsigned char*)pixels); pixelsv = vec_perm(pixelsv1, pixelsv2, vec_lvsl(0, pixels)); if (rightside) { pixelsv = vec_perm(blockv, pixelsv, vcprm(0,1,s0,s1)); } else { pixelsv = vec_perm(blockv, pixelsv, vcprm(s0,s1,2,3)); } blockv = vec_avg(blockv, pixelsv); vec_st(blockv, 0, block); pixels += line_size; block += line_size; } POWERPC_TBL_STOP_COUNT(altivec_avg_pixels8_num, 1); #endif /* ALTIVEC_USE_REFERENCE_C_CODE */ }","No, it is non-vulnerable."271269,"int avformat_open_input(AVFormatContext **ps, const char *filename, AVInputFormat *fmt, AVDictionary **options) { AVFormatContext *s = *ps; int ret = 0; AVDictionary *tmp = NULL; ID3v2ExtraMeta *id3v2_extra_meta = NULL; if (!s && !(s = avformat_alloc_context())) return AVERROR(ENOMEM); if (!s->av_class) { av_log(NULL, AV_LOG_ERROR, ""Input context has not been properly allocated by avformat_alloc_context() and is not NULL either\n""); return AVERROR(EINVAL); } if (fmt) s->iformat = fmt; if (options) av_dict_copy(&tmp, *options, 0); if ((ret = av_opt_set_dict(s, &tmp)) < 0) goto fail; if ((ret = init_input(s, filename, &tmp)) < 0) goto fail; s->probe_score = ret; avio_skip(s->pb, s->skip_initial_bytes); /* Check filename in case an image number is expected. */ if (s->iformat->flags & AVFMT_NEEDNUMBER) { if (!av_filename_number_test(filename)) { ret = AVERROR(EINVAL); goto fail; } } s->duration = s->start_time = AV_NOPTS_VALUE; av_strlcpy(s->filename, filename ? filename : """", sizeof(s->filename)); /* Allocate private data. */ if (s->iformat->priv_data_size > 0) { if (!(s->priv_data = av_mallocz(s->iformat->priv_data_size))) { ret = AVERROR(ENOMEM); goto fail; } if (s->iformat->priv_class) { *(const AVClass **) s->priv_data = s->iformat->priv_class; av_opt_set_defaults(s->priv_data); if ((ret = av_opt_set_dict(s->priv_data, &tmp)) < 0) goto fail; } } /* e.g. AVFMT_NOFILE formats will not have a AVIOContext */ if (s->pb) ff_id3v2_read(s, ID3v2_DEFAULT_MAGIC, &id3v2_extra_meta); if (!(s->flags&AVFMT_FLAG_PRIV_OPT) && s->iformat->read_header) if ((ret = s->iformat->read_header(s)) < 0) goto fail; if (id3v2_extra_meta) { if (!strcmp(s->iformat->name, ""mp3"") || !strcmp(s->iformat->name, ""aac"") || !strcmp(s->iformat->name, ""tta"")) { if ((ret = ff_id3v2_parse_apic(s, &id3v2_extra_meta)) < 0) goto fail; } else av_log(s, AV_LOG_DEBUG, ""demuxer does not support additional id3 data, skipping\n""); } ff_id3v2_free_extra_meta(&id3v2_extra_meta); if ((ret = avformat_queue_attached_pictures(s)) < 0) goto fail; if (!(s->flags&AVFMT_FLAG_PRIV_OPT) && s->pb && !s->data_offset) s->data_offset = avio_tell(s->pb); s->raw_packet_buffer_remaining_size = RAW_PACKET_BUFFER_SIZE; if (options) { av_dict_free(options); *options = tmp; } *ps = s; return 0; fail: ff_id3v2_free_extra_meta(&id3v2_extra_meta); av_dict_free(&tmp); if (s->pb && !(s->flags & AVFMT_FLAG_CUSTOM_IO)) avio_close(s->pb); avformat_free_context(s); *ps = NULL; return ret; }","No, it is non-vulnerable."272270,"static av_always_inline void hl_decode_mb_predict_luma(const H264Context *h, H264SliceContext *sl, int mb_type, int simple, int transform_bypass, int pixel_shift, const int *block_offset, int linesize, uint8_t *dest_y, int p) { void (*idct_add)(uint8_t *dst, int16_t *block, int stride); void (*idct_dc_add)(uint8_t *dst, int16_t *block, int stride); int i; int qscale = p == 0 ? sl->qscale : sl->chroma_qp[p - 1]; block_offset += 16 * p; if (IS_INTRA4x4(mb_type)) { if (IS_8x8DCT(mb_type)) { if (transform_bypass) { idct_dc_add = idct_add = h->h264dsp.h264_add_pixels8_clear; } else { idct_dc_add = h->h264dsp.h264_idct8_dc_add; idct_add = h->h264dsp.h264_idct8_add; } for (i = 0; i < 16; i += 4) { uint8_t *const ptr = dest_y + block_offset[i]; const int dir = sl->intra4x4_pred_mode_cache[scan8[i]]; if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) { h->hpc.pred8x8l_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); } else { const int nnz = sl->non_zero_count_cache[scan8[i + p * 16]]; h->hpc.pred8x8l[dir](ptr, (sl->topleft_samples_available << i) & 0x8000, (sl->topright_samples_available << i) & 0x4000, linesize); if (nnz) { if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256)) idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); else idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); } } } } else { if (transform_bypass) { idct_dc_add = idct_add = h->h264dsp.h264_add_pixels4_clear; } else { idct_dc_add = h->h264dsp.h264_idct_dc_add; idct_add = h->h264dsp.h264_idct_add; } for (i = 0; i < 16; i++) { uint8_t *const ptr = dest_y + block_offset[i]; const int dir = sl->intra4x4_pred_mode_cache[scan8[i]]; if (transform_bypass && h->sps.profile_idc == 244 && dir <= 1) { h->hpc.pred4x4_add[dir](ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); } else { uint8_t *topright; int nnz, tr; uint64_t tr_high; if (dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED) { const int topright_avail = (sl->topright_samples_available << i) & 0x8000; assert(sl->mb_y || linesize <= block_offset[i]); if (!topright_avail) { if (pixel_shift) { tr_high = ((uint16_t *)ptr)[3 - linesize / 2] * 0x0001000100010001ULL; topright = (uint8_t *)&tr_high; } else { tr = ptr[3 - linesize] * 0x01010101u; topright = (uint8_t *)&tr; } } else topright = ptr + (4 << pixel_shift) - linesize; } else topright = NULL; h->hpc.pred4x4[dir](ptr, topright, linesize); nnz = sl->non_zero_count_cache[scan8[i + p * 16]]; if (nnz) { if (nnz == 1 && dctcoef_get(sl->mb, pixel_shift, i * 16 + p * 256)) idct_dc_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); else idct_add(ptr, sl->mb + (i * 16 + p * 256 << pixel_shift), linesize); } } } } } else { h->hpc.pred16x16[sl->intra16x16_pred_mode](dest_y, linesize); if (sl->non_zero_count_cache[scan8[LUMA_DC_BLOCK_INDEX + p]]) { if (!transform_bypass) h->h264dsp.h264_luma_dc_dequant_idct(sl->mb + (p * 256 << pixel_shift), sl->mb_luma_dc[p], h->dequant4_coeff[p][qscale][0]); else { static const uint8_t dc_mapping[16] = { 0 * 16, 1 * 16, 4 * 16, 5 * 16, 2 * 16, 3 * 16, 6 * 16, 7 * 16, 8 * 16, 9 * 16, 12 * 16, 13 * 16, 10 * 16, 11 * 16, 14 * 16, 15 * 16 }; for (i = 0; i < 16; i++) dctcoef_set(sl->mb + (p * 256 << pixel_shift), pixel_shift, dc_mapping[i], dctcoef_get(sl->mb_luma_dc[p], pixel_shift, i)); } } } }","No, it is non-vulnerable."273271,"static void peak_write_chunk(AVFormatContext *s) { WAVMuxContext *wav = s->priv_data; AVIOContext *pb = s->pb; AVCodecContext *enc = s->streams[0]->codec; int64_t peak = ff_start_tag(s->pb, ""levl""); int64_t now0; time_t now_secs; char timestamp[28]; /* Peak frame of incomplete block at end */ if (wav->peak_block_pos) peak_write_frame(s); memset(timestamp, 0, sizeof(timestamp)); if (!(s->flags & AVFMT_FLAG_BITEXACT)) { struct tm tmpbuf; av_log(s, AV_LOG_INFO, ""Writing local time and date to Peak Envelope Chunk\n""); now0 = av_gettime(); now_secs = now0 / 1000000; strftime(timestamp, sizeof(timestamp), ""%Y:%m:%d:%H:%M:%S:"", localtime_r(&now_secs, &tmpbuf)); av_strlcatf(timestamp, sizeof(timestamp), ""%03d"", (int)((now0 / 1000) % 1000)); } avio_wl32(pb, 1); /* version */ avio_wl32(pb, wav->peak_format); /* 8 or 16 bit */ avio_wl32(pb, wav->peak_ppv); /* positive and negative */ avio_wl32(pb, wav->peak_block_size); /* frames per value */ avio_wl32(pb, enc->channels); /* number of channels */ avio_wl32(pb, wav->peak_num_frames); /* number of peak frames */ avio_wl32(pb, wav->peak_pos_pop); /* audio sample frame index */ avio_wl32(pb, 128); /* equal to size of header */ avio_write(pb, timestamp, 28); /* ASCII time stamp */ ffio_fill(pb, 0, 60); avio_write(pb, wav->peak_output, wav->peak_outbuf_bytes); ff_end_tag(pb, peak); if (!wav->data) wav->data = peak; }","No, it is non-vulnerable."274272,"static void qmp_input_end_list(Visitor *v) { QmpInputVisitor *qiv = to_qiv(v); qmp_input_pop(qiv, &error_abort); }","Yes, it is vulnerable."275273,"static int get_uint32(QEMUFile *f, void *pv, size_t size) { uint32_t *v = pv; qemu_get_be32s(f, v); return 0; }","Yes, it is vulnerable."276274,static void *data_plane_thread(void *opaque) { VirtIOBlockDataPlane *s = opaque; do { event_poll(&s->event_poll); } while (s->started || s->num_reqs > 0); return NULL; },"Yes, it is vulnerable."277275,"void bdrv_close_all(void) { BlockDriverState *bs; QTAILQ_FOREACH(bs, &bdrv_states, device_list) { AioContext *aio_context = bdrv_get_aio_context(bs); aio_context_acquire(aio_context); bdrv_close(bs); aio_context_release(aio_context); } }","Yes, it is vulnerable."278276,"void monitor_init(CharDriverState *chr, int flags) { static int is_first_init = 1; Monitor *mon; if (is_first_init) { monitor_qapi_event_init(); sortcmdlist(); is_first_init = 0; } mon = g_malloc(sizeof(*mon)); monitor_data_init(mon); mon->chr = chr; mon->flags = flags; if (flags & MONITOR_USE_READLINE) { mon->rs = readline_init(monitor_readline_printf, monitor_readline_flush, mon, monitor_find_completion); monitor_read_command(mon, 0); } if (monitor_is_qmp(mon)) { qemu_chr_add_handlers(chr, monitor_can_read, monitor_qmp_read, monitor_qmp_event, mon); qemu_chr_fe_set_echo(chr, true); json_message_parser_init(&mon->qmp.parser, handle_qmp_command); } else { qemu_chr_add_handlers(chr, monitor_can_read, monitor_read, monitor_event, mon); } qemu_mutex_lock(&monitor_lock); QLIST_INSERT_HEAD(&mon_list, mon, entry); qemu_mutex_unlock(&monitor_lock); if (!default_mon || (flags & MONITOR_IS_DEFAULT)) default_mon = mon; }","Yes, it is vulnerable."279277,"static sPAPRDRConnector *spapr_phb_get_pci_drc(sPAPRPHBState *phb, PCIDevice *pdev) { uint32_t busnr = pci_bus_num(PCI_BUS(qdev_get_parent_bus(DEVICE(pdev)))); return spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_PCI, (phb->index << 16) | (busnr << 8) | pdev->devfn); }","Yes, it is vulnerable."280278,"int ff_socket_nonblock(int socket, int enable) { #ifdef __MINGW32__ return ioctlsocket(socket, FIONBIO, &enable); #else if (enable) return fcntl(socket, F_SETFL, fcntl(socket, F_GETFL) | O_NONBLOCK); else return fcntl(socket, F_SETFL, fcntl(socket, F_GETFL) & ~O_NONBLOCK); #endif }","No, it is non-vulnerable."281279,"static void adb_kbd_put_keycode(void *opaque, int keycode) { KBDState *s = opaque; if (s->count < sizeof(s->data)) { s->data[s->wptr] = keycode; if (++s->wptr == sizeof(s->data)) s->wptr = 0; s->count++; } }","Yes, it is vulnerable."282280,"static void nvdimm_build_nfit(GSList *device_list, GArray *table_offsets, GArray *table_data, GArray *linker) { GArray *structures = nvdimm_build_device_structure(device_list); void *header; acpi_add_table(table_offsets, table_data); /* NFIT header. */ header = acpi_data_push(table_data, sizeof(NvdimmNfitHeader)); /* NVDIMM device structures. */ g_array_append_vals(table_data, structures->data, structures->len); build_header(linker, table_data, header, ""NFIT"", sizeof(NvdimmNfitHeader) + structures->len, 1, NULL); g_array_free(structures, true); }","Yes, it is vulnerable."283281,"static int v9fs_do_mksock(V9fsState *s, V9fsString *path) { return s->ops->mksock(&s->ctx, path->data); }","No, it is non-vulnerable."284282,"static ram_addr_t ram_block_add(RAMBlock *new_block, Error **errp) { RAMBlock *block; ram_addr_t old_ram_size, new_ram_size; old_ram_size = last_ram_offset() >> TARGET_PAGE_BITS; /* This assumes the iothread lock is taken here too. */ qemu_mutex_lock_ramlist(); new_block->offset = find_ram_offset(new_block->max_length); if (!new_block->host) { if (xen_enabled()) { xen_ram_alloc(new_block->offset, new_block->max_length, new_block->mr); } else { new_block->host = phys_mem_alloc(new_block->max_length, &new_block->mr->align); if (!new_block->host) { error_setg_errno(errp, errno, ""cannot set up guest memory '%s'"", memory_region_name(new_block->mr)); qemu_mutex_unlock_ramlist(); return -1; } memory_try_enable_merging(new_block->host, new_block->max_length); } } /* Keep the list sorted from biggest to smallest block. */ QTAILQ_FOREACH(block, &ram_list.blocks, next) { if (block->max_length < new_block->max_length) { break; } } if (block) { QTAILQ_INSERT_BEFORE(block, new_block, next); } else { QTAILQ_INSERT_TAIL(&ram_list.blocks, new_block, next); } ram_list.mru_block = NULL; ram_list.version++; qemu_mutex_unlock_ramlist(); new_ram_size = last_ram_offset() >> TARGET_PAGE_BITS; if (new_ram_size > old_ram_size) { int i; for (i = 0; i < DIRTY_MEMORY_NUM; i++) { ram_list.dirty_memory[i] = bitmap_zero_extend(ram_list.dirty_memory[i], old_ram_size, new_ram_size); } } cpu_physical_memory_set_dirty_range(new_block->offset, new_block->used_length); qemu_ram_setup_dump(new_block->host, new_block->max_length); qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_HUGEPAGE); qemu_madvise(new_block->host, new_block->max_length, QEMU_MADV_DONTFORK); if (kvm_enabled()) { kvm_setup_guest_memory(new_block->host, new_block->max_length); } return new_block->offset; }","No, it is non-vulnerable."285283,"static void filter(FSPPContext *p, uint8_t *dst, uint8_t *src, int dst_stride, int src_stride, int width, int height, uint8_t *qp_store, int qp_stride, int is_luma) { int x, x0, y, es, qy, t; const int stride = is_luma ? p->temp_stride : (width + 16); const int step = 6 - p->log2_count; const int qpsh = 4 - p->hsub * !is_luma; const int qpsv = 4 - p->vsub * !is_luma; DECLARE_ALIGNED(32, int32_t, block_align)[4 * 8 * BLOCKSZ + 4 * 8 * BLOCKSZ]; int16_t *block = (int16_t *)block_align; int16_t *block3 = (int16_t *)(block_align + 4 * 8 * BLOCKSZ); memset(block3, 0, 4 * 8 * BLOCKSZ); if (!src || !dst) return; for (y = 0; y < height; y++) { int index = 8 + 8 * stride + y * stride; memcpy(p->src + index, src + y * src_stride, width); for (x = 0; x < 8; x++) { p->src[index - x - 1] = p->src[index + x ]; p->src[index + width + x ] = p->src[index + width - x - 1]; } } for (y = 0; y < 8; y++) { memcpy(p->src + ( 7 - y ) * stride, p->src + ( y + 8 ) * stride, stride); memcpy(p->src + (height + 8 + y) * stride, p->src + (height - y + 7) * stride, stride); } //FIXME (try edge emu) for (y = 8; y < 24; y++) memset(p->temp + 8 + y * stride, 0, width * sizeof(int16_t)); for (y = step; y < height + 8; y += step) { //step= 1,2 const int y1 = y - 8 + step; //l5-7 l4-6; qy = y - 4; if (qy > height - 1) qy = height - 1; if (qy < 0) qy = 0; qy = (qy >> qpsv) * qp_stride; p->row_fdct(block, p->src + y * stride + 2 - (y&1), stride, 2); for (x0 = 0; x0 < width + 8 - 8 * (BLOCKSZ - 1); x0 += 8 * (BLOCKSZ - 1)) { p->row_fdct(block + 8 * 8, p->src + y * stride + 8 + x0 + 2 - (y&1), stride, 2 * (BLOCKSZ - 1)); if (p->qp) p->column_fidct((int16_t *)(&p->threshold_mtx[0]), block + 0 * 8, block3 + 0 * 8, 8 * (BLOCKSZ - 1)); //yes, this is a HOTSPOT else for (x = 0; x < 8 * (BLOCKSZ - 1); x += 8) { t = x + x0 - 2; //correct t=x+x0-2-(y&1), but its the same if (t < 0) t = 0; //t always < width-2 t = qp_store[qy + (t >> qpsh)]; t = ff_norm_qscale(t, p->qscale_type); if (t != p->prev_q) p->prev_q = t, p->mul_thrmat((int16_t *)(&p->threshold_mtx_noq[0]), (int16_t *)(&p->threshold_mtx[0]), t); p->column_fidct((int16_t *)(&p->threshold_mtx[0]), block + x * 8, block3 + x * 8, 8); //yes, this is a HOTSPOT } p->row_idct(block3 + 0 * 8, p->temp + (y & 15) * stride + x0 + 2 - (y & 1), stride, 2 * (BLOCKSZ - 1)); memmove(block, block + (BLOCKSZ - 1) * 64, 8 * 8 * sizeof(int16_t)); //cycling memmove(block3, block3 + (BLOCKSZ - 1) * 64, 6 * 8 * sizeof(int16_t)); } es = width + 8 - x0; // 8, ... if (es > 8) p->row_fdct(block + 8 * 8, p->src + y * stride + 8 + x0 + 2 - (y & 1), stride, (es - 4) >> 2); p->column_fidct((int16_t *)(&p->threshold_mtx[0]), block, block3, es&(~1)); p->row_idct(block3 + 0 * 8, p->temp + (y & 15) * stride + x0 + 2 - (y & 1), stride, es >> 2); if (!(y1 & 7) && y1) { if (y1 & 8) p->store_slice(dst + (y1 - 8) * dst_stride, p->temp + 8 + 8 * stride, dst_stride, stride, width, 8, 5 - p->log2_count); else p->store_slice2(dst + (y1 - 8) * dst_stride, p->temp + 8 + 0 * stride, dst_stride, stride, width, 8, 5 - p->log2_count); } } if (y & 7) { // height % 8 != 0 if (y & 8) p->store_slice(dst + ((y - 8) & ~7) * dst_stride, p->temp + 8 + 8 * stride, dst_stride, stride, width, y&7, 5 - p->log2_count); else p->store_slice2(dst + ((y - 8) & ~7) * dst_stride, p->temp + 8 + 0 * stride, dst_stride, stride, width, y&7, 5 - p->log2_count); } }","Yes, it is vulnerable."286284,"static void make_dirty(uint8_t device) { QPCIDevice *dev; QPCIBar bmdma_bar, ide_bar; uint8_t status; size_t len = 512; uintptr_t guest_buf; void* buf; dev = get_pci_device(&bmdma_bar, &ide_bar); guest_buf = guest_alloc(guest_malloc, len); buf = g_malloc(len); memset(buf, rand() % 255 + 1, len); g_assert(guest_buf); g_assert(buf); memwrite(guest_buf, buf, len); PrdtEntry prdt[] = { { .addr = cpu_to_le32(guest_buf), .size = cpu_to_le32(len | PRDT_EOT), }, }; status = send_dma_request(CMD_WRITE_DMA, 1, 1, prdt, ARRAY_SIZE(prdt), NULL); g_assert_cmphex(status, ==, BM_STS_INTR); assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR); g_free(buf); }","Yes, it is vulnerable."287285,"unsigned long find_next_bit(const unsigned long *addr, unsigned long size, unsigned long offset) { const unsigned long *p = addr + BITOP_WORD(offset); unsigned long result = offset & ~(BITS_PER_LONG-1); unsigned long tmp; if (offset >= size) { return size; } size -= result; offset %= BITS_PER_LONG; if (offset) { tmp = *(p++); tmp &= (~0UL << offset); if (size < BITS_PER_LONG) { goto found_first; } if (tmp) { goto found_middle; } size -= BITS_PER_LONG; result += BITS_PER_LONG; } while (size & ~(BITS_PER_LONG-1)) { if ((tmp = *(p++))) { goto found_middle; } result += BITS_PER_LONG; size -= BITS_PER_LONG; } if (!size) { return result; } tmp = *p; found_first: tmp &= (~0UL >> (BITS_PER_LONG - size)); if (tmp == 0UL) { /* Are any bits set? */ return result + size; /* Nope. */ } found_middle: return result + ctzl(tmp); }","No, it is non-vulnerable."288286,"uint64_t helper_cmpbge(uint64_t op1, uint64_t op2) { uint8_t opa, opb, res; int i; res = 0; for (i = 0; i < 8; i++) { opa = op1 >> (i * 8); opb = op2 >> (i * 8); if (opa >= opb) { res |= 1 << i; } } return res; }","No, it is non-vulnerable."289287,"void helper_check_iol(CPUX86State *env, uint32_t t0) { check_io(env, t0, 4); }","No, it is non-vulnerable."290288,"static void ccid_card_vscard_handle_message(PassthruState *card, VSCMsgHeader *scr_msg_header) { uint8_t *data = (uint8_t *)&scr_msg_header[1]; switch (scr_msg_header->type) { case VSC_ATR: DPRINTF(card, D_INFO, ""VSC_ATR %d\n"", scr_msg_header->length); if (scr_msg_header->length > MAX_ATR_SIZE) { error_report(""ATR size exceeds spec, ignoring""); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_GENERAL_ERROR); } memcpy(card->atr, data, scr_msg_header->length); card->atr_length = scr_msg_header->length; ccid_card_card_inserted(&card->base); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_SUCCESS); case VSC_APDU: ccid_card_send_apdu_to_guest( &card->base, data, scr_msg_header->length); case VSC_CardRemove: DPRINTF(card, D_INFO, ""VSC_CardRemove\n""); ccid_card_card_removed(&card->base); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_SUCCESS); case VSC_Init: ccid_card_vscard_handle_init( card, scr_msg_header, (VSCMsgInit *)data); case VSC_Error: ccid_card_card_error(&card->base, *(uint32_t *)data); case VSC_ReaderAdd: if (ccid_card_ccid_attach(&card->base) < 0) { ccid_card_vscard_send_error(card, VSCARD_UNDEFINED_READER_ID, VSC_CANNOT_ADD_MORE_READERS); } else { ccid_card_vscard_send_error(card, VSCARD_MINIMAL_READER_ID, VSC_SUCCESS); } case VSC_ReaderRemove: ccid_card_ccid_detach(&card->base); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_SUCCESS); default: printf(""usb-ccid: chardev: unexpected message of type %X\n"", scr_msg_header->type); ccid_card_vscard_send_error(card, scr_msg_header->reader_id, VSC_GENERAL_ERROR); } }","Yes, it is vulnerable."291289,"static inline uint64_t do_fri(CPUPPCState *env, uint64_t arg, int rounding_mode) { CPU_DoubleU farg; farg.ll = arg; if (unlikely(float64_is_signaling_nan(farg.d))) { /* sNaN round */ farg.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI); } else if (unlikely(float64_is_quiet_nan(farg.d) || float64_is_infinity(farg.d))) { /* qNan / infinity round */ farg.ll = fload_invalid_op_excp(env, POWERPC_EXCP_FP_VXCVI); } else { set_float_rounding_mode(rounding_mode, &env->fp_status); farg.ll = float64_round_to_int(farg.d, &env->fp_status); /* Restore rounding mode from FPSCR */ fpscr_set_rounding_mode(env); } return farg.ll; }","No, it is non-vulnerable."292290,"int DMA_write_memory (int nchan, void *buf, int pos, int len) { struct dma_regs *r = &dma_controllers[nchan > 3].regs[nchan & 3]; target_phys_addr_t addr = ((r->pageh & 0x7f) << 24) | (r->page << 16) | r->now[ADDR]; if (r->mode & 0x20) { int i; uint8_t *p = buf; cpu_physical_memory_write (addr - pos - len, buf, len); /* What about 16bit transfers? */ for (i = 0; i < len; i++) { uint8_t b = p[len - i - 1]; p[i] = b; } } else cpu_physical_memory_write (addr + pos, buf, len); return len; }","No, it is non-vulnerable."293291,"static void tcx_realizefn(DeviceState *dev, Error **errp) { SysBusDevice *sbd = SYS_BUS_DEVICE(dev); TCXState *s = TCX(dev); ram_addr_t vram_offset = 0; int size, ret; uint8_t *vram_base; char *fcode_filename; memory_region_init_ram(&s->vram_mem, OBJECT(s), ""tcx.vram"", s->vram_size * (1 + 4 + 4), &error_fatal); vmstate_register_ram_global(&s->vram_mem); memory_region_set_log(&s->vram_mem, true, DIRTY_MEMORY_VGA); vram_base = memory_region_get_ram_ptr(&s->vram_mem); /* 10/ROM : FCode ROM */ vmstate_register_ram_global(&s->rom); fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, TCX_ROM_FILE); if (fcode_filename) { ret = load_image_targphys(fcode_filename, s->prom_addr, FCODE_MAX_ROM_SIZE); g_free(fcode_filename); if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) { error_report(""tcx: could not load prom '%s'"", TCX_ROM_FILE); } } /* 0/DFB8 : 8-bit plane */ s->vram = vram_base; size = s->vram_size; memory_region_init_alias(&s->vram_8bit, OBJECT(s), ""tcx.vram.8bit"", &s->vram_mem, vram_offset, size); sysbus_init_mmio(sbd, &s->vram_8bit); vram_offset += size; vram_base += size; /* 1/DFB24 : 24bit plane */ size = s->vram_size * 4; s->vram24 = (uint32_t *)vram_base; s->vram24_offset = vram_offset; memory_region_init_alias(&s->vram_24bit, OBJECT(s), ""tcx.vram.24bit"", &s->vram_mem, vram_offset, size); sysbus_init_mmio(sbd, &s->vram_24bit); vram_offset += size; vram_base += size; /* 4/RDFB32 : Raw Framebuffer */ size = s->vram_size * 4; s->cplane = (uint32_t *)vram_base; s->cplane_offset = vram_offset; memory_region_init_alias(&s->vram_cplane, OBJECT(s), ""tcx.vram.cplane"", &s->vram_mem, vram_offset, size); sysbus_init_mmio(sbd, &s->vram_cplane); /* 9/THC24bits : NetBSD writes here even with 8-bit display: dummy */ if (s->depth == 8) { memory_region_init_io(&s->thc24, OBJECT(s), &tcx_dummy_ops, s, ""tcx.thc24"", TCX_THC_NREGS); sysbus_init_mmio(sbd, &s->thc24); } sysbus_init_irq(sbd, &s->irq); if (s->depth == 8) { s->con = graphic_console_init(DEVICE(dev), 0, &tcx_ops, s); } else { s->con = graphic_console_init(DEVICE(dev), 0, &tcx24_ops, s); } s->thcmisc = 0; qemu_console_resize(s->con, s->width, s->height); }","No, it is non-vulnerable."294292,"LinuxAioState *aio_get_linux_aio(AioContext *ctx) { if (!ctx->linux_aio) { ctx->linux_aio = laio_init(); laio_attach_aio_context(ctx->linux_aio, ctx); } return ctx->linux_aio; }","No, it is non-vulnerable."295293,"static int replaygain_export(AVStream *st, const uint8_t *track_gain, const uint8_t *track_peak, const uint8_t *album_gain, const uint8_t *album_peak) { AVPacketSideData *sd, *tmp; AVReplayGain *replaygain; int32_t tg, ag; uint32_t tp, ap; tg = parse_value(track_gain, INT32_MIN); ag = parse_value(album_gain, INT32_MIN); tp = parse_value(track_peak, 0); ap = parse_value(album_peak, 0); if (tg == INT32_MIN && ag == INT32_MIN) return 0; replaygain = av_mallocz(sizeof(*replaygain)); if (!replaygain) return AVERROR(ENOMEM); tmp = av_realloc_array(st->side_data, st->nb_side_data + 1, sizeof(*tmp)); if (!tmp) { av_freep(&replaygain); return AVERROR(ENOMEM); } st->side_data = tmp; st->nb_side_data++; sd = &st->side_data[st->nb_side_data - 1]; sd->type = AV_PKT_DATA_REPLAYGAIN; sd->data = (uint8_t*)replaygain; sd->size = sizeof(*replaygain); replaygain->track_gain = tg; replaygain->track_peak = tp; replaygain->album_gain = ag; replaygain->album_peak = ap; return 0; }","No, it is non-vulnerable."296294,"static int gif_read_header1(GifState *s) { uint8_t sig[6]; int v, n; int background_color_index; if (bytestream2_get_bytes_left(&s->gb) < 13) return AVERROR_INVALIDDATA; /* read gif signature */ bytestream2_get_bufferu(&s->gb, sig, 6); if (memcmp(sig, gif87a_sig, 6) != 0 && memcmp(sig, gif89a_sig, 6) != 0) return AVERROR_INVALIDDATA; /* read screen header */ s->transparent_color_index = -1; s->screen_width = bytestream2_get_le16u(&s->gb); s->screen_height = bytestream2_get_le16u(&s->gb); if( (unsigned)s->screen_width > 32767 || (unsigned)s->screen_height > 32767){ av_log(s->avctx, AV_LOG_ERROR, ""picture size too large\n""); return AVERROR_INVALIDDATA; } av_fast_malloc(&s->idx_line, &s->idx_line_size, s->screen_width); if (!s->idx_line) return AVERROR(ENOMEM); v = bytestream2_get_byteu(&s->gb); s->color_resolution = ((v & 0x70) >> 4) + 1; s->has_global_palette = (v & 0x80); s->bits_per_pixel = (v & 0x07) + 1; background_color_index = bytestream2_get_byteu(&s->gb); n = bytestream2_get_byteu(&s->gb); if (n) { s->avctx->sample_aspect_ratio.num = n + 15; s->avctx->sample_aspect_ratio.den = 64; } av_dlog(s->avctx, ""screen_w=%d screen_h=%d bpp=%d global_palette=%d\n"", s->screen_width, s->screen_height, s->bits_per_pixel, s->has_global_palette); if (s->has_global_palette) { s->background_color_index = background_color_index; n = 1 << s->bits_per_pixel; if (bytestream2_get_bytes_left(&s->gb) < n * 3) return AVERROR_INVALIDDATA; gif_read_palette(s, s->global_palette, n); s->bg_color = s->global_palette[s->background_color_index]; } else s->background_color_index = -1; return 0; }","No, it is non-vulnerable."297295,"static ssize_t qio_channel_command_readv(QIOChannel *ioc, const struct iovec *iov, size_t niov, int **fds, size_t *nfds, Error **errp) { QIOChannelCommand *cioc = QIO_CHANNEL_COMMAND(ioc); ssize_t ret; retry: ret = readv(cioc->readfd, iov, niov); if (ret < 0) { if (errno == EAGAIN || errno == EWOULDBLOCK) { return QIO_CHANNEL_ERR_BLOCK; } if (errno == EINTR) { goto retry; } error_setg_errno(errp, errno, ""Unable to read from command""); return -1; } return ret; }","No, it is non-vulnerable."298296,"vnc_display_setup_auth(VncDisplay *vs, bool password, bool sasl, bool websocket, Error **errp) { /* * We have a choice of 3 authentication options * * 1. none * 2. vnc * 3. sasl * * The channel can be run in 2 modes * * 1. clear * 2. tls * * And TLS can use 2 types of credentials * * 1. anon * 2. x509 * * We thus have 9 possible logical combinations * * 1. clear + none * 2. clear + vnc * 3. clear + sasl * 4. tls + anon + none * 5. tls + anon + vnc * 6. tls + anon + sasl * 7. tls + x509 + none * 8. tls + x509 + vnc * 9. tls + x509 + sasl * * These need to be mapped into the VNC auth schemes * in an appropriate manner. In regular VNC, all the * TLS options get mapped into VNC_AUTH_VENCRYPT * sub-auth types. * * In websockets, the https:// protocol already provides * TLS support, so there is no need to make use of the * VeNCrypt extension. Furthermore, websockets browser * clients could not use VeNCrypt even if they wanted to, * as they cannot control when the TLS handshake takes * place. Thus there is no option but to rely on https://, * meaning combinations 4->6 and 7->9 will be mapped to * VNC auth schemes in the same way as combos 1->3. * * Regardless of fact that we have a different mapping to * VNC auth mechs for plain VNC vs websockets VNC, the end * result has the same security characteristics. */ if (password) { if (vs->tlscreds) { vs->auth = VNC_AUTH_VENCRYPT; if (websocket) { vs->ws_tls = true; } if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_X509)) { VNC_DEBUG(""Initializing VNC server with x509 password auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_X509VNC; } else if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_ANON)) { VNC_DEBUG(""Initializing VNC server with TLS password auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_TLSVNC; } else { error_setg(errp, ""Unsupported TLS cred type %s"", object_get_typename(OBJECT(vs->tlscreds))); return -1; } } else { VNC_DEBUG(""Initializing VNC server with password auth\n""); vs->auth = VNC_AUTH_VNC; vs->subauth = VNC_AUTH_INVALID; } if (websocket) { vs->ws_auth = VNC_AUTH_VNC; } else { vs->ws_auth = VNC_AUTH_INVALID; } } else if (sasl) { if (vs->tlscreds) { vs->auth = VNC_AUTH_VENCRYPT; if (websocket) { vs->ws_tls = true; } if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_X509)) { VNC_DEBUG(""Initializing VNC server with x509 SASL auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_X509SASL; } else if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_ANON)) { VNC_DEBUG(""Initializing VNC server with TLS SASL auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_TLSSASL; } else { error_setg(errp, ""Unsupported TLS cred type %s"", object_get_typename(OBJECT(vs->tlscreds))); return -1; } } else { VNC_DEBUG(""Initializing VNC server with SASL auth\n""); vs->auth = VNC_AUTH_SASL; vs->subauth = VNC_AUTH_INVALID; } if (websocket) { vs->ws_auth = VNC_AUTH_SASL; } else { vs->ws_auth = VNC_AUTH_INVALID; } } else { if (vs->tlscreds) { vs->auth = VNC_AUTH_VENCRYPT; if (websocket) { vs->ws_tls = true; } if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_X509)) { VNC_DEBUG(""Initializing VNC server with x509 no auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_X509NONE; } else if (object_dynamic_cast(OBJECT(vs->tlscreds), TYPE_QCRYPTO_TLS_CREDS_ANON)) { VNC_DEBUG(""Initializing VNC server with TLS no auth\n""); vs->subauth = VNC_AUTH_VENCRYPT_TLSNONE; } else { error_setg(errp, ""Unsupported TLS cred type %s"", object_get_typename(OBJECT(vs->tlscreds))); return -1; } } else { VNC_DEBUG(""Initializing VNC server with no auth\n""); vs->auth = VNC_AUTH_NONE; vs->subauth = VNC_AUTH_INVALID; } if (websocket) { vs->ws_auth = VNC_AUTH_NONE; } else { vs->ws_auth = VNC_AUTH_INVALID; } } return 0; }","No, it is non-vulnerable."299297,void bdrv_flush(BlockDriverState *bs) { if (bs->drv && bs->drv->bdrv_flush) bs->drv->bdrv_flush(bs);,"Yes, it is vulnerable."300298,void block_job_cancel_sync(BlockJob *job) { BlockDriverState *bs = job->bs; assert(bs->job == job); block_job_cancel(job); while (bs->job != NULL && bs->job->busy) { qemu_aio_wait(); } },"Yes, it is vulnerable."301299,"static int read_header(ShortenContext *s) { int i, ret; int maxnlpc = 0; /* shorten signature */ if (get_bits_long(&s->gb, 32) != AV_RB32(""ajkg"")) { av_log(s->avctx, AV_LOG_ERROR, ""missing shorten magic 'ajkg'\n""); return -1; } s->lpcqoffset = 0; s->blocksize = DEFAULT_BLOCK_SIZE; s->nmean = -1; s->version = get_bits(&s->gb, 8); s->internal_ftype = get_uint(s, TYPESIZE); s->channels = get_uint(s, CHANSIZE); if (s->channels > MAX_CHANNELS) { av_log(s->avctx, AV_LOG_ERROR, ""too many channels: %d\n"", s->channels); return -1; } s->avctx->channels = s->channels; /* get blocksize if version > 0 */ if (s->version > 0) { int skip_bytes, blocksize; blocksize = get_uint(s, av_log2(DEFAULT_BLOCK_SIZE)); if (!blocksize || blocksize > MAX_BLOCKSIZE) { av_log(s->avctx, AV_LOG_ERROR, ""invalid or unsupported block size: %d\n"", blocksize); return AVERROR(EINVAL); } s->blocksize = blocksize; maxnlpc = get_uint(s, LPCQSIZE); s->nmean = get_uint(s, 0); skip_bytes = get_uint(s, NSKIPSIZE); for (i=0; i<skip_bytes; i++) { skip_bits(&s->gb, 8); } } s->nwrap = FFMAX(NWRAP, maxnlpc); if ((ret = allocate_buffers(s)) < 0) return ret; if ((ret = init_offset(s)) < 0) return ret; if (s->version > 1) s->lpcqoffset = V2LPCQOFFSET; if (get_ur_golomb_shorten(&s->gb, FNSIZE) != FN_VERBATIM) { av_log(s->avctx, AV_LOG_ERROR, ""missing verbatim section at beginning of stream\n""); return -1; } s->header_size = get_ur_golomb_shorten(&s->gb, VERBATIM_CKSIZE_SIZE); if (s->header_size >= OUT_BUFFER_SIZE || s->header_size < CANONICAL_HEADER_SIZE) { av_log(s->avctx, AV_LOG_ERROR, ""header is wrong size: %d\n"", s->header_size); return -1; } for (i=0; i<s->header_size; i++) s->header[i] = (char)get_ur_golomb_shorten(&s->gb, VERBATIM_BYTE_SIZE); if (decode_wave_header(s->avctx, s->header, s->header_size) < 0) return -1; s->cur_chan = 0; s->bitshift = 0; s->got_header = 1; return 0; }","No, it is non-vulnerable."302300,"void parse_options(void *optctx, int argc, char **argv, const OptionDef *options, void (*parse_arg_function)(void *, const char*)) { const char *opt; int optindex, handleoptions = 1, ret; /* perform system-dependent conversions for arguments list */ prepare_app_arguments(&argc, &argv); /* parse options */ optindex = 1; while (optindex < argc) { opt = argv[optindex++]; if (handleoptions && opt[0] == '-' && opt[1] != '\0') { if (opt[1] == '-' && opt[2] == '\0') { handleoptions = 0; continue; } opt++; if ((ret = parse_option(optctx, opt, argv[optindex], options)) < 0) exit(1); optindex += ret; } else { if (parse_arg_function) parse_arg_function(optctx, opt); } } }","Yes, it is vulnerable."303301,"static void vtd_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); X86IOMMUClass *x86_class = X86_IOMMU_CLASS(klass); dc->reset = vtd_reset; dc->vmsd = &vtd_vmstate; dc->props = vtd_properties; dc->hotpluggable = false; x86_class->realize = vtd_realize; x86_class->int_remap = vtd_int_remap; }","Yes, it is vulnerable."304302,"static void audio_capture(void *opaque, void *buf, int size) { VncState *vs = opaque; vnc_lock_output(vs); vnc_write_u8(vs, VNC_MSG_SERVER_QEMU); vnc_write_u8(vs, VNC_MSG_SERVER_QEMU_AUDIO); vnc_write_u16(vs, VNC_MSG_SERVER_QEMU_AUDIO_DATA); vnc_write_u32(vs, size); vnc_write(vs, buf, size); vnc_unlock_output(vs); vnc_flush(vs); }","Yes, it is vulnerable."305303,"void ff_aac_search_for_ltp(AACEncContext *s, SingleChannelElement *sce, int common_window) { int w, g, w2, i, start = 0, count = 0; int saved_bits = -(15 + FFMIN(sce->ics.max_sfb, MAX_LTP_LONG_SFB)); float *C34 = &s->scoefs[128*0], *PCD = &s->scoefs[128*1]; float *PCD34 = &s->scoefs[128*2]; const int max_ltp = FFMIN(sce->ics.max_sfb, MAX_LTP_LONG_SFB); if (sce->ics.window_sequence[0] == EIGHT_SHORT_SEQUENCE || !sce->ics.ltp.lag) return; for (w = 0; w < sce->ics.num_windows; w += sce->ics.group_len[w]) { start = 0; for (g = 0; g < sce->ics.num_swb; g++) { int bits1 = 0, bits2 = 0; float dist1 = 0.0f, dist2 = 0.0f; if (w*16+g > max_ltp) { start += sce->ics.swb_sizes[g]; continue; } for (w2 = 0; w2 < sce->ics.group_len[w]; w2++) { int bits_tmp1, bits_tmp2; FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[(w+w2)*16+g]; for (i = 0; i < sce->ics.swb_sizes[g]; i++) PCD[i] = sce->coeffs[start+(w+w2)*128+i] - sce->lcoeffs[start+(w+w2)*128+i]; abs_pow34_v(C34, &sce->coeffs[start+(w+w2)*128], sce->ics.swb_sizes[g]); abs_pow34_v(PCD34, PCD, sce->ics.swb_sizes[g]); dist1 += quantize_band_cost(s, &sce->coeffs[start+(w+w2)*128], C34, sce->ics.swb_sizes[g], sce->sf_idx[(w+w2)*16+g], sce->band_type[(w+w2)*16+g], s->lambda/band->threshold, INFINITY, &bits_tmp1, NULL, 0); dist2 += quantize_band_cost(s, PCD, PCD34, sce->ics.swb_sizes[g], sce->sf_idx[(w+w2)*16+g], sce->band_type[(w+w2)*16+g], s->lambda/band->threshold, INFINITY, &bits_tmp2, NULL, 0); bits1 += bits_tmp1; bits2 += bits_tmp2; } if (dist2 < dist1 && bits2 < bits1) { for (w2 = 0; w2 < sce->ics.group_len[w]; w2++) for (i = 0; i < sce->ics.swb_sizes[g]; i++) sce->coeffs[start+(w+w2)*128+i] -= sce->lcoeffs[start+(w+w2)*128+i]; sce->ics.ltp.used[w*16+g] = 1; saved_bits += bits1 - bits2; count++; } start += sce->ics.swb_sizes[g]; } } sce->ics.ltp.present = !!count && (saved_bits >= 0); sce->ics.predictor_present = !!sce->ics.ltp.present; /* Reset any marked sfbs */ if (!sce->ics.ltp.present && !!count) { for (w = 0; w < sce->ics.num_windows; w += sce->ics.group_len[w]) { start = 0; for (g = 0; g < sce->ics.num_swb; g++) { if (sce->ics.ltp.used[w*16+g]) { for (w2 = 0; w2 < sce->ics.group_len[w]; w2++) { for (i = 0; i < sce->ics.swb_sizes[g]; i++) { sce->coeffs[start+(w+w2)*128+i] += sce->lcoeffs[start+(w+w2)*128+i]; } } } start += sce->ics.swb_sizes[g]; } } } }","No, it is non-vulnerable."306304,"void av_opencl_buffer_release(cl_mem *cl_buf) { cl_int status = 0; if (!cl_buf) return; status = clReleaseMemObject(*cl_buf); if (status != CL_SUCCESS) { av_log(&openclutils, AV_LOG_ERROR, ""Could not release OpenCL buffer: %s\n"", opencl_errstr(status)); } memset(cl_buf, 0, sizeof(*cl_buf)); }","No, it is non-vulnerable."307305,"int inet_connect_opts(QemuOpts *opts, bool *in_progress, Error **errp) { struct addrinfo ai,*res,*e; const char *addr; const char *port; char uaddr[INET6_ADDRSTRLEN+1]; char uport[33]; int sock,rc; bool block; memset(&ai,0, sizeof(ai)); ai.ai_flags = AI_CANONNAME | AI_ADDRCONFIG; ai.ai_family = PF_UNSPEC; ai.ai_socktype = SOCK_STREAM; if (in_progress) { *in_progress = false; } addr = qemu_opt_get(opts, ""host""); port = qemu_opt_get(opts, ""port""); block = qemu_opt_get_bool(opts, ""block"", 0); if (addr == NULL || port == NULL) { fprintf(stderr, ""inet_connect: host and/or port not specified\n""); error_set(errp, QERR_SOCKET_CREATE_FAILED); return -1; } if (qemu_opt_get_bool(opts, ""ipv4"", 0)) ai.ai_family = PF_INET; if (qemu_opt_get_bool(opts, ""ipv6"", 0)) ai.ai_family = PF_INET6; /* lookup */ if (0 != (rc = getaddrinfo(addr, port, &ai, &res))) { fprintf(stderr,""getaddrinfo(%s,%s): %s\n"", addr, port, gai_strerror(rc)); error_set(errp, QERR_SOCKET_CREATE_FAILED); return -1; } for (e = res; e != NULL; e = e->ai_next) { if (getnameinfo((struct sockaddr*)e->ai_addr,e->ai_addrlen, uaddr,INET6_ADDRSTRLEN,uport,32, NI_NUMERICHOST | NI_NUMERICSERV) != 0) { fprintf(stderr,""%s: getnameinfo: oops\n"", __FUNCTION__); continue; } sock = qemu_socket(e->ai_family, e->ai_socktype, e->ai_protocol); if (sock < 0) { fprintf(stderr,""%s: socket(%s): %s\n"", __FUNCTION__, inet_strfamily(e->ai_family), strerror(errno)); continue; } setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,(void*)&on,sizeof(on)); if (!block) { socket_set_nonblock(sock); } /* connect to peer */ do { rc = 0; if (connect(sock, e->ai_addr, e->ai_addrlen) < 0) { rc = -socket_error(); } } while (rc == -EINTR); #ifdef _WIN32 if (!block && (rc == -EINPROGRESS || rc == -EWOULDBLOCK || rc == -WSAEALREADY)) { #else if (!block && (rc == -EINPROGRESS)) { #endif if (in_progress) { *in_progress = true; } error_set(errp, QERR_SOCKET_CONNECT_IN_PROGRESS); } else if (rc < 0) { if (NULL == e->ai_next) fprintf(stderr, ""%s: connect(%s,%s,%s,%s): %s\n"", __FUNCTION__, inet_strfamily(e->ai_family), e->ai_canonname, uaddr, uport, strerror(errno)); closesocket(sock); continue; } freeaddrinfo(res); return sock; } error_set(errp, QERR_SOCKET_CONNECT_FAILED); freeaddrinfo(res); return -1; }","Yes, it is vulnerable."308306,"int ff_rv34_decode_frame(AVCodecContext *avctx, void *data, int *got_picture_ptr, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; RV34DecContext *r = avctx->priv_data; MpegEncContext *s = &r->s; AVFrame *pict = data; SliceInfo si; int i, ret; int slice_count; const uint8_t *slices_hdr = NULL; int last = 0; /* no supplementary picture */ if (buf_size == 0) { /* special case for last picture */ if (s->low_delay==0 && s->next_picture_ptr) { if ((ret = av_frame_ref(pict, &s->next_picture_ptr->f)) < 0) return ret; s->next_picture_ptr = NULL; *got_picture_ptr = 1; } return 0; } if(!avctx->slice_count){ slice_count = (*buf++) + 1; slices_hdr = buf + 4; buf += 8 * slice_count; buf_size -= 1 + 8 * slice_count; }else slice_count = avctx->slice_count; //parse first slice header to check whether this frame can be decoded if(get_slice_offset(avctx, slices_hdr, 0) < 0 || get_slice_offset(avctx, slices_hdr, 0) > buf_size){ av_log(avctx, AV_LOG_ERROR, ""Slice offset is invalid\n""); return AVERROR_INVALIDDATA; } init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8); if(r->parse_slice_header(r, &r->s.gb, &si) < 0 || si.start){ av_log(avctx, AV_LOG_ERROR, ""First slice header is incorrect\n""); return AVERROR_INVALIDDATA; } if ((!s->last_picture_ptr || !s->last_picture_ptr->f.data[0]) && si.type == AV_PICTURE_TYPE_B) { av_log(avctx, AV_LOG_ERROR, ""Invalid decoder state: B-frame without "" ""reference data.\n""); return AVERROR_INVALIDDATA; } if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B) || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I) || avctx->skip_frame >= AVDISCARD_ALL) return avpkt->size; /* first slice */ if (si.start == 0) { if (s->mb_num_left > 0) { av_log(avctx, AV_LOG_ERROR, ""New frame but still %d MB left."", s->mb_num_left); ff_er_frame_end(&s->er); ff_MPV_frame_end(s); } if (s->width != si.width || s->height != si.height) { int err; av_log(s->avctx, AV_LOG_WARNING, ""Changing dimensions to %dx%d\n"", si.width, si.height); s->width = si.width; s->height = si.height; err = ff_set_dimensions(s->avctx, s->width, s->height); if (err < 0) return err; if ((err = ff_MPV_common_frame_size_change(s)) < 0) return err; if ((err = rv34_decoder_realloc(r)) < 0) return err; } s->pict_type = si.type ? si.type : AV_PICTURE_TYPE_I; if (ff_MPV_frame_start(s, s->avctx) < 0) return -1; ff_mpeg_er_frame_start(s); if (!r->tmp_b_block_base) { int i; r->tmp_b_block_base = av_malloc(s->linesize * 48); for (i = 0; i < 2; i++) r->tmp_b_block_y[i] = r->tmp_b_block_base + i * 16 * s->linesize; for (i = 0; i < 4; i++) r->tmp_b_block_uv[i] = r->tmp_b_block_base + 32 * s->linesize + (i >> 1) * 8 * s->uvlinesize + (i & 1) * 16; } r->cur_pts = si.pts; if (s->pict_type != AV_PICTURE_TYPE_B) { r->last_pts = r->next_pts; r->next_pts = r->cur_pts; } else { int refdist = GET_PTS_DIFF(r->next_pts, r->last_pts); int dist0 = GET_PTS_DIFF(r->cur_pts, r->last_pts); int dist1 = GET_PTS_DIFF(r->next_pts, r->cur_pts); if(!refdist){ r->mv_weight1 = r->mv_weight2 = r->weight1 = r->weight2 = 8192; r->scaled_weight = 0; }else{ r->mv_weight1 = (dist0 << 14) / refdist; r->mv_weight2 = (dist1 << 14) / refdist; if((r->mv_weight1|r->mv_weight2) & 511){ r->weight1 = r->mv_weight1; r->weight2 = r->mv_weight2; r->scaled_weight = 0; }else{ r->weight1 = r->mv_weight1 >> 9; r->weight2 = r->mv_weight2 >> 9; r->scaled_weight = 1; } } } s->mb_x = s->mb_y = 0; ff_thread_finish_setup(s->avctx); } else if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME)) { av_log(s->avctx, AV_LOG_ERROR, ""Decoder needs full frames in frame "" ""multithreading mode (start MB is %d).\n"", si.start); return AVERROR_INVALIDDATA; } for(i = 0; i < slice_count; i++){ int offset = get_slice_offset(avctx, slices_hdr, i); int size; if(i+1 == slice_count) size = buf_size - offset; else size = get_slice_offset(avctx, slices_hdr, i+1) - offset; if(offset < 0 || offset > buf_size){ av_log(avctx, AV_LOG_ERROR, ""Slice offset is invalid\n""); break; } r->si.end = s->mb_width * s->mb_height; s->mb_num_left = r->s.mb_x + r->s.mb_y*r->s.mb_width - r->si.start; if(i+1 < slice_count){ if (get_slice_offset(avctx, slices_hdr, i+1) < 0 || get_slice_offset(avctx, slices_hdr, i+1) > buf_size) { av_log(avctx, AV_LOG_ERROR, ""Slice offset is invalid\n""); break; } init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, i+1), (buf_size-get_slice_offset(avctx, slices_hdr, i+1))*8); if(r->parse_slice_header(r, &r->s.gb, &si) < 0){ if(i+2 < slice_count) size = get_slice_offset(avctx, slices_hdr, i+2) - offset; else size = buf_size - offset; }else r->si.end = si.start; } if (size < 0 || size > buf_size - offset) { av_log(avctx, AV_LOG_ERROR, ""Slice size is invalid\n""); break; } last = rv34_decode_slice(r, r->si.end, buf + offset, size); if(last) break; } if (s->current_picture_ptr) { if (last) { if(r->loop_filter) r->loop_filter(r, s->mb_height - 1); ret = finish_frame(avctx, pict); if (ret < 0) return ret; *got_picture_ptr = ret; } else if (HAVE_THREADS && (s->avctx->active_thread_type & FF_THREAD_FRAME)) { av_log(avctx, AV_LOG_INFO, ""marking unfished frame as finished\n""); /* always mark the current frame as finished, frame-mt supports * only complete frames */ ff_er_frame_end(&s->er); ff_MPV_frame_end(s); s->mb_num_left = 0; ff_thread_report_progress(&s->current_picture_ptr->tf, INT_MAX, 0); return AVERROR_INVALIDDATA; } } return avpkt->size; }","Yes, it is vulnerable."309307,"static int get_preset_file_2(const char *preset_name, const char *codec_name, AVIOContext **s) { int i, ret = 1; char filename[1000]; const char *base[3] = { getenv(""AVCONV_DATADIR""), getenv(""HOME""), AVCONV_DATADIR, }; for (i = 0; i < FF_ARRAY_ELEMS(base) && ret; i++) { if (!base[i]) continue; if (codec_name) { snprintf(filename, sizeof(filename), ""%s%s/%s-%s.avpreset"", base[i], i != 1 ? """" : ""/.avconv"", codec_name, preset_name); ret = avio_open2(s, filename, AVIO_FLAG_READ, &int_cb, NULL); } if (ret) { snprintf(filename, sizeof(filename), ""%s%s/%s.avpreset"", base[i], i != 1 ? """" : ""/.avconv"", preset_name); ret = avio_open2(s, filename, AVIO_FLAG_READ, &int_cb, NULL); } } return ret; }","No, it is non-vulnerable."310308,"static int mov_write_mvhd_tag(ByteIOContext *pb, MOVContext *mov) { int maxTrackID = 1, i; int64_t maxTrackLenTemp, maxTrackLen = 0; int version; for (i=0; i<MAX_STREAMS; i++) { if(mov->tracks[i].entry > 0) { maxTrackLenTemp = av_rescale_rnd(mov->tracks[i].trackDuration, globalTimescale, mov->tracks[i].timescale, AV_ROUND_UP); if(maxTrackLen < maxTrackLenTemp) maxTrackLen = maxTrackLenTemp; if(maxTrackID < mov->tracks[i].trackID) maxTrackID = mov->tracks[i].trackID; } } version = maxTrackLen < UINT32_MAX ? 0 : 1; (version == 1) ? put_be32(pb, 120) : put_be32(pb, 108); /* size */ put_tag(pb, ""mvhd""); put_byte(pb, version); put_be24(pb, 0); /* flags */ if (version == 1) { put_be64(pb, mov->time); put_be64(pb, mov->time); } else { put_be32(pb, mov->time); /* creation time */ put_be32(pb, mov->time); /* modification time */ } put_be32(pb, mov->timescale); /* timescale */ (version == 1) ? put_be64(pb, maxTrackLen) : put_be32(pb, maxTrackLen); /* duration of longest track */ put_be32(pb, 0x00010000); /* reserved (preferred rate) 1.0 = normal */ put_be16(pb, 0x0100); /* reserved (preferred volume) 1.0 = normal */ put_be16(pb, 0); /* reserved */ put_be32(pb, 0); /* reserved */ put_be32(pb, 0); /* reserved */ /* Matrix structure */ put_be32(pb, 0x00010000); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x00010000); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x0); /* reserved */ put_be32(pb, 0x40000000); /* reserved */ put_be32(pb, 0); /* reserved (preview time) */ put_be32(pb, 0); /* reserved (preview duration) */ put_be32(pb, 0); /* reserved (poster time) */ put_be32(pb, 0); /* reserved (selection time) */ put_be32(pb, 0); /* reserved (selection duration) */ put_be32(pb, 0); /* reserved (current time) */ put_be32(pb, maxTrackID+1); /* Next track id */ return 0x6c; }","No, it is non-vulnerable."311309,"static void apply_tns(float coef[1024], TemporalNoiseShaping *tns, IndividualChannelStream *ics, int decode) { const int mmm = FFMIN(ics->tns_max_bands, ics->max_sfb); int w, filt, m, i; int bottom, top, order, start, end, size, inc; float lpc[TNS_MAX_ORDER]; float tmp[TNS_MAX_ORDER]; for (w = 0; w < ics->num_windows; w++) { bottom = ics->num_swb; for (filt = 0; filt < tns->n_filt[w]; filt++) { top = bottom; bottom = FFMAX(0, top - tns->length[w][filt]); order = tns->order[w][filt]; if (order == 0) continue; // tns_decode_coef compute_lpc_coefs(tns->coef[w][filt], order, lpc, 0, 0, 0); start = ics->swb_offset[FFMIN(bottom, mmm)]; end = ics->swb_offset[FFMIN( top, mmm)]; if ((size = end - start) <= 0) continue; if (tns->direction[w][filt]) { inc = -1; start = end - 1; } else { inc = 1; } start += w * 128; if (decode) { // ar filter for (m = 0; m < size; m++, start += inc) for (i = 1; i <= FFMIN(m, order); i++) coef[start] -= coef[start - i * inc] * lpc[i - 1]; } else { // ma filter for (m = 0; m < size; m++, start += inc) { tmp[0] = coef[start]; for (i = 1; i <= FFMIN(m, order); i++) coef[start] += tmp[i] * lpc[i - 1]; for (i = order; i > 0; i--) tmp[i] = tmp[i - 1]; } } } } }","No, it is non-vulnerable."312310,"static int g2m_init_buffers(G2MContext *c) { int aligned_height; if (!c->framebuf || c->old_width < c->width || c->old_height < c->height) { c->framebuf_stride = FFALIGN(c->width * 3, 16); aligned_height = FFALIGN(c->height, 16); av_free(c->framebuf); c->framebuf = av_mallocz(c->framebuf_stride * aligned_height); if (!c->framebuf) return AVERROR(ENOMEM); } if (!c->synth_tile || !c->jpeg_tile || c->old_tile_w < c->tile_width || c->old_tile_h < c->tile_height) { c->tile_stride = FFALIGN(c->tile_width * 3, 16); aligned_height = FFALIGN(c->tile_height, 16); av_free(c->synth_tile); av_free(c->jpeg_tile); av_free(c->kempf_buf); av_free(c->kempf_flags); c->synth_tile = av_mallocz(c->tile_stride * aligned_height); c->jpeg_tile = av_mallocz(c->tile_stride * aligned_height); c->kempf_buf = av_mallocz((c->tile_width + 1) * aligned_height + FF_INPUT_BUFFER_PADDING_SIZE); c->kempf_flags = av_mallocz( c->tile_width * aligned_height); if (!c->synth_tile || !c->jpeg_tile || !c->kempf_buf || !c->kempf_flags) return AVERROR(ENOMEM); } return 0; }","No, it is non-vulnerable."313311,"static uint32_t rtl8139_io_readb(void *opaque, uint8_t addr) { RTL8139State *s = opaque; int ret; addr &= 0xff; switch (addr) { case MAC0 ... MAC0+5: ret = s->phys[addr - MAC0]; break; case MAC0+6 ... MAC0+7: ret = 0; break; case MAR0 ... MAR0+7: ret = s->mult[addr - MAR0]; break; case ChipCmd: ret = rtl8139_ChipCmd_read(s); break; case Cfg9346: ret = rtl8139_Cfg9346_read(s); break; case Config0: ret = rtl8139_Config0_read(s); break; case Config1: ret = rtl8139_Config1_read(s); break; case Config3: ret = rtl8139_Config3_read(s); break; case Config4: ret = rtl8139_Config4_read(s); break; case Config5: ret = rtl8139_Config5_read(s); break; case MediaStatus: ret = 0xd0; DPRINTF(""MediaStatus read 0x%x\n"", ret); break; case HltClk: ret = s->clock_enabled; DPRINTF(""HltClk read 0x%x\n"", ret); break; case PCIRevisionID: ret = RTL8139_PCI_REVID; DPRINTF(""PCI Revision ID read 0x%x\n"", ret); break; case TxThresh: ret = s->TxThresh; DPRINTF(""C+ TxThresh read(b) val=0x%02x\n"", ret); break; case 0x43: /* Part of TxConfig register. Windows driver tries to read it */ ret = s->TxConfig >> 24; DPRINTF(""RTL8139C TxConfig at 0x43 read(b) val=0x%02x\n"", ret); break; default: DPRINTF(""not implemented read(b) addr=0x%x\n"", addr); ret = 0; break; } return ret; }","Yes, it is vulnerable."314312,"int ff_mpv_common_frame_size_change(MpegEncContext *s) { int i, err = 0; if (!s->context_initialized) return AVERROR(EINVAL); if (s->slice_context_count > 1) { for (i = 0; i < s->slice_context_count; i++) { free_duplicate_context(s->thread_context[i]); } for (i = 1; i < s->slice_context_count; i++) { av_freep(&s->thread_context[i]); } } else free_duplicate_context(s); free_context_frame(s); if (s->picture) for (i = 0; i < MAX_PICTURE_COUNT; i++) { s->picture[i].needs_realloc = 1; } s->last_picture_ptr = s->next_picture_ptr = s->current_picture_ptr = NULL; // init if (s->codec_id == AV_CODEC_ID_MPEG2VIDEO && !s->progressive_sequence) s->mb_height = (s->height + 31) / 32 * 2; else s->mb_height = (s->height + 15) / 16; if ((s->width || s->height) && (err = av_image_check_size(s->width, s->height, 0, s->avctx)) < 0) goto fail; if ((err = init_context_frame(s))) goto fail; s->thread_context[0] = s; if (s->width && s->height) { int nb_slices = s->slice_context_count; if (nb_slices > 1) { for (i = 1; i < nb_slices; i++) { s->thread_context[i] = av_malloc(sizeof(MpegEncContext)); memcpy(s->thread_context[i], s, sizeof(MpegEncContext)); } for (i = 0; i < nb_slices; i++) { if ((err = init_duplicate_context(s->thread_context[i])) < 0) goto fail; s->thread_context[i]->start_mb_y = (s->mb_height * (i) + nb_slices / 2) / nb_slices; s->thread_context[i]->end_mb_y = (s->mb_height * (i + 1) + nb_slices / 2) / nb_slices; } } else { err = init_duplicate_context(s); if (err < 0) goto fail; s->start_mb_y = 0; s->end_mb_y = s->mb_height; } s->slice_context_count = nb_slices; } return 0; fail: ff_mpv_common_end(s); return err; }","No, it is non-vulnerable."315313,"void ff_snow_horizontal_compose97i_mmx(DWTELEM *b, int width){ const int w2= (width+1)>>1; DWTELEM temp[width >> 1]; const int w_l= (width>>1); const int w_r= w2 - 1; int i; { // Lift 0 DWTELEM * const ref = b + w2 - 1; i = 1; b[0] = b[0] - ((W_DM * 2 * ref[1]+W_DO)>>W_DS); asm volatile( ""pcmpeqd %%mm7, %%mm7 \n\t"" ""pslld $31, %%mm7 \n\t"" ""psrld $29, %%mm7 \n\t"" ::); for(; i<w_l-3; i+=4){ asm volatile( ""movq (%1), %%mm2 \n\t"" ""movq 8(%1), %%mm6 \n\t"" ""paddd 4(%1), %%mm2 \n\t"" ""paddd 12(%1), %%mm6 \n\t"" ""movq %%mm2, %%mm0 \n\t"" ""movq %%mm6, %%mm4 \n\t"" ""paddd %%mm2, %%mm2 \n\t"" ""paddd %%mm6, %%mm6 \n\t"" ""paddd %%mm0, %%mm2 \n\t"" ""paddd %%mm4, %%mm6 \n\t"" ""paddd %%mm7, %%mm2 \n\t"" ""paddd %%mm7, %%mm6 \n\t"" ""psrad $3, %%mm2 \n\t"" ""psrad $3, %%mm6 \n\t"" ""movq (%0), %%mm0 \n\t"" ""movq 8(%0), %%mm4 \n\t"" ""psubd %%mm2, %%mm0 \n\t"" ""psubd %%mm6, %%mm4 \n\t"" ""movq %%mm0, (%0) \n\t"" ""movq %%mm4, 8(%0) \n\t"" :: ""r""(&b[i]), ""r""(&ref[i]) : ""memory"" ); } snow_horizontal_compose_lift_lead_out(i, b, b, ref, width, w_l, 0, W_DM, W_DO, W_DS); } { // Lift 1 DWTELEM * const dst = b+w2; i = 0; for(; i<w_r-3; i+=4){ asm volatile( ""movq (%1), %%mm2 \n\t"" ""movq 8(%1), %%mm6 \n\t"" ""paddd 4(%1), %%mm2 \n\t"" ""paddd 12(%1), %%mm6 \n\t"" ""movq (%0), %%mm0 \n\t"" ""movq 8(%0), %%mm4 \n\t"" ""psubd %%mm2, %%mm0 \n\t"" ""psubd %%mm6, %%mm4 \n\t"" ""movq %%mm0, (%0) \n\t"" ""movq %%mm4, 8(%0) \n\t"" :: ""r""(&dst[i]), ""r""(&b[i]) : ""memory"" ); } snow_horizontal_compose_lift_lead_out(i, dst, dst, b, width, w_r, 1, W_CM, W_CO, W_CS); } { // Lift 2 DWTELEM * const ref = b+w2 - 1; i = 1; b[0] = b[0] + (((2 * ref[1] + W_BO) + 4 * b[0]) >> W_BS); asm volatile( ""pslld $1, %%mm7 \n\t"" ::); for(; i<w_l-3; i+=4){ asm volatile( ""movq (%1), %%mm0 \n\t"" ""movq 8(%1), %%mm4 \n\t"" ""paddd 4(%1), %%mm0 \n\t"" ""paddd 12(%1), %%mm4 \n\t"" ""paddd %%mm7, %%mm0 \n\t"" ""paddd %%mm7, %%mm4 \n\t"" ""psrad $2, %%mm0 \n\t"" ""psrad $2, %%mm4 \n\t"" ""movq (%0), %%mm1 \n\t"" ""movq 8(%0), %%mm5 \n\t"" ""paddd %%mm1, %%mm0 \n\t"" ""paddd %%mm5, %%mm4 \n\t"" ""psrad $2, %%mm0 \n\t"" ""psrad $2, %%mm4 \n\t"" ""paddd %%mm1, %%mm0 \n\t"" ""paddd %%mm5, %%mm4 \n\t"" ""movq %%mm0, (%0) \n\t"" ""movq %%mm4, 8(%0) \n\t"" :: ""r""(&b[i]), ""r""(&ref[i]) : ""memory"" ); } snow_horizontal_compose_liftS_lead_out(i, b, b, ref, width, w_l); } { // Lift 3 DWTELEM * const src = b+w2; i = 0; for(; i<w_r-3; i+=4){ asm volatile( ""movq 4(%1), %%mm2 \n\t"" ""movq 12(%1), %%mm6 \n\t"" ""paddd (%1), %%mm2 \n\t"" ""paddd 8(%1), %%mm6 \n\t"" ""movq (%0), %%mm0 \n\t"" ""movq 8(%0), %%mm4 \n\t"" ""paddd %%mm2, %%mm0 \n\t"" ""paddd %%mm6, %%mm4 \n\t"" ""psrad $1, %%mm2 \n\t"" ""psrad $1, %%mm6 \n\t"" ""paddd %%mm0, %%mm2 \n\t"" ""paddd %%mm4, %%mm6 \n\t"" ""movq %%mm2, (%2) \n\t"" ""movq %%mm6, 8(%2) \n\t"" :: ""r""(&src[i]), ""r""(&b[i]), ""r""(&temp[i]) : ""memory"" ); } snow_horizontal_compose_lift_lead_out(i, temp, src, b, width, w_r, 1, -W_AM, W_AO+1, W_AS); } { snow_interleave_line_header(&i, width, b, temp); for (; (i & 0xE) != 0xE; i-=2){ b[i+1] = temp[i>>1]; b[i] = b[i>>1]; } for (i-=14; i>=0; i-=16){ asm volatile( ""movq (%1), %%mm0 \n\t"" ""movq 8(%1), %%mm2 \n\t"" ""movq 16(%1), %%mm4 \n\t"" ""movq 24(%1), %%mm6 \n\t"" ""movq (%1), %%mm1 \n\t"" ""movq 8(%1), %%mm3 \n\t"" ""movq 16(%1), %%mm5 \n\t"" ""movq 24(%1), %%mm7 \n\t"" ""punpckldq (%2), %%mm0 \n\t"" ""punpckldq 8(%2), %%mm2 \n\t"" ""punpckldq 16(%2), %%mm4 \n\t"" ""punpckldq 24(%2), %%mm6 \n\t"" ""movq %%mm0, (%0) \n\t"" ""movq %%mm2, 16(%0) \n\t"" ""movq %%mm4, 32(%0) \n\t"" ""movq %%mm6, 48(%0) \n\t"" ""punpckhdq (%2), %%mm1 \n\t"" ""punpckhdq 8(%2), %%mm3 \n\t"" ""punpckhdq 16(%2), %%mm5 \n\t"" ""punpckhdq 24(%2), %%mm7 \n\t"" ""movq %%mm1, 8(%0) \n\t"" ""movq %%mm3, 24(%0) \n\t"" ""movq %%mm5, 40(%0) \n\t"" ""movq %%mm7, 56(%0) \n\t"" :: ""r""(&b[i]), ""r""(&b[i>>1]), ""r""(&temp[i>>1]) : ""memory"" ); } } }","Yes, it is vulnerable."316314,"static int oma_read_packet(AVFormatContext *s, AVPacket *pkt) { OMAContext *oc = s->priv_data; int packet_size = s->streams[0]->codec->block_align; int ret = av_get_packet(s->pb, pkt, packet_size); if (ret <= 0) return AVERROR(EIO); pkt->stream_index = 0; if (oc->encrypted) { /* previous unencrypted block saved in IV for * the next packet (CBC mode) */ av_des_crypt(&oc->av_des, pkt->data, pkt->data, (packet_size >> 3), oc->iv, 1); } return ret; }","No, it is non-vulnerable."317315,"static int rtsp_fetch_packet(AVFormatContext *s, AVPacket *pkt) { RTSPState *rt = s->priv_data; int ret, len; uint8_t buf[10 * RTP_MAX_PACKET_LENGTH]; RTSPStream *rtsp_st; /* get next frames from the same RTP packet */ if (rt->cur_transport_priv) { if (rt->transport == RTSP_TRANSPORT_RDT) ret = ff_rdt_parse_packet(rt->cur_transport_priv, pkt, NULL, 0); else ret = rtp_parse_packet(rt->cur_transport_priv, pkt, NULL, 0); if (ret == 0) { rt->cur_transport_priv = NULL; return 0; } else if (ret == 1) { return 0; } else { rt->cur_transport_priv = NULL; } } /* read next RTP packet */ redo: switch(rt->lower_transport) { default: #if CONFIG_RTSP_DEMUXER case RTSP_LOWER_TRANSPORT_TCP: len = tcp_read_packet(s, &rtsp_st, buf, sizeof(buf)); break; #endif case RTSP_LOWER_TRANSPORT_UDP: case RTSP_LOWER_TRANSPORT_UDP_MULTICAST: len = udp_read_packet(s, &rtsp_st, buf, sizeof(buf)); if (len >=0 && rtsp_st->transport_priv && rt->transport == RTSP_TRANSPORT_RTP) rtp_check_and_send_back_rr(rtsp_st->transport_priv, len); break; } if (len < 0) return len; if (len == 0) return AVERROR_EOF; if (rt->transport == RTSP_TRANSPORT_RDT) ret = ff_rdt_parse_packet(rtsp_st->transport_priv, pkt, buf, len); else ret = rtp_parse_packet(rtsp_st->transport_priv, pkt, buf, len); if (ret < 0) goto redo; if (ret == 1) { /* more packets may follow, so we save the RTP context */ rt->cur_transport_priv = rtsp_st->transport_priv; } return ret; }","No, it is non-vulnerable."318316,"rtsp_open_transport_ctx(AVFormatContext *s, RTSPStream *rtsp_st) { RTSPState *rt = s->priv_data; AVStream *st = NULL; /* open the RTP context */ if (rtsp_st->stream_index >= 0) st = s->streams[rtsp_st->stream_index]; if (!st) s->ctx_flags |= AVFMTCTX_NOHEADER; if (rt->transport == RTSP_TRANSPORT_RDT) rtsp_st->transport_priv = ff_rdt_parse_open(s, st->index, rtsp_st->dynamic_protocol_context, rtsp_st->dynamic_handler); else rtsp_st->transport_priv = rtp_parse_open(s, st, rtsp_st->rtp_handle, rtsp_st->sdp_payload_type, &rtsp_st->rtp_payload_data); if (!rtsp_st->transport_priv) { return AVERROR(ENOMEM); } else if (rt->transport != RTSP_TRANSPORT_RDT) { if(rtsp_st->dynamic_handler) { rtp_parse_set_dynamic_protocol(rtsp_st->transport_priv, rtsp_st->dynamic_protocol_context, rtsp_st->dynamic_handler); } } return 0; }","No, it is non-vulnerable."319317,"void net_tx_pkt_update_ip_checksums(struct NetTxPkt *pkt) { uint16_t csum; uint32_t ph_raw_csum; assert(pkt); uint8_t gso_type = pkt->virt_hdr.gso_type & ~VIRTIO_NET_HDR_GSO_ECN; struct ip_header *ip_hdr; if (VIRTIO_NET_HDR_GSO_TCPV4 != gso_type && VIRTIO_NET_HDR_GSO_UDP != gso_type) { return; } ip_hdr = pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_base; if (pkt->payload_len + pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len > ETH_MAX_IP_DGRAM_LEN) { return; } ip_hdr->ip_len = cpu_to_be16(pkt->payload_len + pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len); /* Calculate IP header checksum */ ip_hdr->ip_sum = 0; csum = net_raw_checksum((uint8_t *)ip_hdr, pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_len); ip_hdr->ip_sum = cpu_to_be16(csum); /* Calculate IP pseudo header checksum */ ph_raw_csum = eth_calc_pseudo_hdr_csum(ip_hdr, pkt->payload_len); csum = cpu_to_be16(~net_checksum_finish(ph_raw_csum)); iov_from_buf(&pkt->vec[NET_TX_PKT_PL_START_FRAG], pkt->payload_frags, pkt->virt_hdr.csum_offset, &csum, sizeof(csum)); }","No, it is non-vulnerable."320318,"void ff_print_debug_info2(AVCodecContext *avctx, AVFrame *pict, uint8_t *mbskip_table, uint32_t *mbtype_table, int8_t *qscale_table, int16_t (*motion_val[2])[2], int *low_delay, int mb_width, int mb_height, int mb_stride, int quarter_sample) { if ((avctx->flags2 & AV_CODEC_FLAG2_EXPORT_MVS) && mbtype_table && motion_val[0]) { const int shift = 1 + quarter_sample; const int mv_sample_log2 = avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id == AV_CODEC_ID_SVQ3 ? 2 : 1; const int mv_stride = (mb_width << mv_sample_log2) + (avctx->codec->id == AV_CODEC_ID_H264 ? 0 : 1); int mb_x, mb_y, mbcount = 0; /* size is width * height * 2 * 4 where 2 is for directions and 4 is * for the maximum number of MB (4 MB in case of IS_8x8) */ AVMotionVector *mvs = av_malloc_array(mb_width * mb_height, 2 * 4 * sizeof(AVMotionVector)); if (!mvs) return; for (mb_y = 0; mb_y < mb_height; mb_y++) { for (mb_x = 0; mb_x < mb_width; mb_x++) { int i, direction, mb_type = mbtype_table[mb_x + mb_y * mb_stride]; for (direction = 0; direction < 2; direction++) { if (!USES_LIST(mb_type, direction)) continue; if (IS_8X8(mb_type)) { for (i = 0; i < 4; i++) { int sx = mb_x * 16 + 4 + 8 * (i & 1); int sy = mb_y * 16 + 4 + 8 * (i >> 1); int xy = (mb_x * 2 + (i & 1) + (mb_y * 2 + (i >> 1)) * mv_stride) << (mv_sample_log2 - 1); int mx = (motion_val[direction][xy][0] >> shift) + sx; int my = (motion_val[direction][xy][1] >> shift) + sy; mbcount += add_mb(mvs + mbcount, mb_type, sx, sy, mx, my, direction); } } else if (IS_16X8(mb_type)) { for (i = 0; i < 2; i++) { int sx = mb_x * 16 + 8; int sy = mb_y * 16 + 4 + 8 * i; int xy = (mb_x * 2 + (mb_y * 2 + i) * mv_stride) << (mv_sample_log2 - 1); int mx = (motion_val[direction][xy][0] >> shift); int my = (motion_val[direction][xy][1] >> shift); if (IS_INTERLACED(mb_type)) my *= 2; mbcount += add_mb(mvs + mbcount, mb_type, sx, sy, mx + sx, my + sy, direction); } } else if (IS_8X16(mb_type)) { for (i = 0; i < 2; i++) { int sx = mb_x * 16 + 4 + 8 * i; int sy = mb_y * 16 + 8; int xy = (mb_x * 2 + i + mb_y * 2 * mv_stride) << (mv_sample_log2 - 1); int mx = motion_val[direction][xy][0] >> shift; int my = motion_val[direction][xy][1] >> shift; if (IS_INTERLACED(mb_type)) my *= 2; mbcount += add_mb(mvs + mbcount, mb_type, sx, sy, mx + sx, my + sy, direction); } } else { int sx = mb_x * 16 + 8; int sy = mb_y * 16 + 8; int xy = (mb_x + mb_y * mv_stride) << mv_sample_log2; int mx = (motion_val[direction][xy][0]>>shift) + sx; int my = (motion_val[direction][xy][1]>>shift) + sy; mbcount += add_mb(mvs + mbcount, mb_type, sx, sy, mx, my, direction); } } } } if (mbcount) { AVFrameSideData *sd; av_log(avctx, AV_LOG_DEBUG, ""Adding %d MVs info to frame %d\n"", mbcount, avctx->frame_number); sd = av_frame_new_side_data(pict, AV_FRAME_DATA_MOTION_VECTORS, mbcount * sizeof(AVMotionVector)); if (!sd) { av_freep(&mvs); return; } memcpy(sd->data, mvs, mbcount * sizeof(AVMotionVector)); } av_freep(&mvs); } /* TODO: export all the following to make them accessible for users (and filters) */ if (avctx->hwaccel || !mbtype_table #if FF_API_CAP_VDPAU || (avctx->codec->capabilities&AV_CODEC_CAP_HWACCEL_VDPAU) #endif ) return; if (avctx->debug & (FF_DEBUG_SKIP | FF_DEBUG_QP | FF_DEBUG_MB_TYPE)) { int x,y; av_log(avctx, AV_LOG_DEBUG, ""New frame, type: %c\n"", av_get_picture_type_char(pict->pict_type)); for (y = 0; y < mb_height; y++) { for (x = 0; x < mb_width; x++) { if (avctx->debug & FF_DEBUG_SKIP) { int count = mbskip_table ? mbskip_table[x + y * mb_stride] : 0; if (count > 9) count = 9; av_log(avctx, AV_LOG_DEBUG, ""%1d"", count); } if (avctx->debug & FF_DEBUG_QP) { av_log(avctx, AV_LOG_DEBUG, ""%2d"", qscale_table[x + y * mb_stride]); } if (avctx->debug & FF_DEBUG_MB_TYPE) { int mb_type = mbtype_table[x + y * mb_stride]; // Type & MV direction if (IS_PCM(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""P""); else if (IS_INTRA(mb_type) && IS_ACPRED(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""A""); else if (IS_INTRA4x4(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""i""); else if (IS_INTRA16x16(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""I""); else if (IS_DIRECT(mb_type) && IS_SKIP(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""d""); else if (IS_DIRECT(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""D""); else if (IS_GMC(mb_type) && IS_SKIP(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""g""); else if (IS_GMC(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""G""); else if (IS_SKIP(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""S""); else if (!USES_LIST(mb_type, 1)) av_log(avctx, AV_LOG_DEBUG, "">""); else if (!USES_LIST(mb_type, 0)) av_log(avctx, AV_LOG_DEBUG, ""<""); else { av_assert2(USES_LIST(mb_type, 0) && USES_LIST(mb_type, 1)); av_log(avctx, AV_LOG_DEBUG, ""X""); } // segmentation if (IS_8X8(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""+""); else if (IS_16X8(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""-""); else if (IS_8X16(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""|""); else if (IS_INTRA(mb_type) || IS_16X16(mb_type)) av_log(avctx, AV_LOG_DEBUG, "" ""); else av_log(avctx, AV_LOG_DEBUG, ""?""); if (IS_INTERLACED(mb_type)) av_log(avctx, AV_LOG_DEBUG, ""=""); else av_log(avctx, AV_LOG_DEBUG, "" ""); } } av_log(avctx, AV_LOG_DEBUG, ""\n""); } } if ((avctx->debug & (FF_DEBUG_VIS_QP | FF_DEBUG_VIS_MB_TYPE)) || (avctx->debug_mv)) { int mb_y; int i; int h_chroma_shift, v_chroma_shift, block_height; #if FF_API_VISMV const int shift = 1 + quarter_sample; uint8_t *ptr; const int width = avctx->width; const int height = avctx->height; #endif const int mv_sample_log2 = avctx->codec_id == AV_CODEC_ID_H264 || avctx->codec_id == AV_CODEC_ID_SVQ3 ? 2 : 1; const int mv_stride = (mb_width << mv_sample_log2) + (avctx->codec->id == AV_CODEC_ID_H264 ? 0 : 1); *low_delay = 0; // needed to see the vectors without trashing the buffers avcodec_get_chroma_sub_sample(avctx->pix_fmt, &h_chroma_shift, &v_chroma_shift); av_frame_make_writable(pict); pict->opaque = NULL; #if FF_API_VISMV ptr = pict->data[0]; #endif block_height = 16 >> v_chroma_shift; for (mb_y = 0; mb_y < mb_height; mb_y++) { int mb_x; for (mb_x = 0; mb_x < mb_width; mb_x++) { const int mb_index = mb_x + mb_y * mb_stride; #if FF_API_VISMV if ((avctx->debug_mv) && motion_val[0]) { int type; for (type = 0; type < 3; type++) { int direction = 0; switch (type) { case 0: if ((!(avctx->debug_mv & FF_DEBUG_VIS_MV_P_FOR)) || (pict->pict_type!= AV_PICTURE_TYPE_P)) continue; direction = 0; break; case 1: if ((!(avctx->debug_mv & FF_DEBUG_VIS_MV_B_FOR)) || (pict->pict_type!= AV_PICTURE_TYPE_B)) continue; direction = 0; break; case 2: if ((!(avctx->debug_mv & FF_DEBUG_VIS_MV_B_BACK)) || (pict->pict_type!= AV_PICTURE_TYPE_B)) continue; direction = 1; break; } if (!USES_LIST(mbtype_table[mb_index], direction)) continue; if (IS_8X8(mbtype_table[mb_index])) { int i; for (i = 0; i < 4; i++) { int sx = mb_x * 16 + 4 + 8 * (i & 1); int sy = mb_y * 16 + 4 + 8 * (i >> 1); int xy = (mb_x * 2 + (i & 1) + (mb_y * 2 + (i >> 1)) * mv_stride) << (mv_sample_log2 - 1); int mx = (motion_val[direction][xy][0] >> shift) + sx; int my = (motion_val[direction][xy][1] >> shift) + sy; draw_arrow(ptr, sx, sy, mx, my, width, height, pict->linesize[0], 100, 0, direction); } } else if (IS_16X8(mbtype_table[mb_index])) { int i; for (i = 0; i < 2; i++) { int sx = mb_x * 16 + 8; int sy = mb_y * 16 + 4 + 8 * i; int xy = (mb_x * 2 + (mb_y * 2 + i) * mv_stride) << (mv_sample_log2 - 1); int mx = (motion_val[direction][xy][0] >> shift); int my = (motion_val[direction][xy][1] >> shift); if (IS_INTERLACED(mbtype_table[mb_index])) my *= 2; draw_arrow(ptr, sx, sy, mx + sx, my + sy, width, height, pict->linesize[0], 100, 0, direction); } } else if (IS_8X16(mbtype_table[mb_index])) { int i; for (i = 0; i < 2; i++) { int sx = mb_x * 16 + 4 + 8 * i; int sy = mb_y * 16 + 8; int xy = (mb_x * 2 + i + mb_y * 2 * mv_stride) << (mv_sample_log2 - 1); int mx = motion_val[direction][xy][0] >> shift; int my = motion_val[direction][xy][1] >> shift; if (IS_INTERLACED(mbtype_table[mb_index])) my *= 2; draw_arrow(ptr, sx, sy, mx + sx, my + sy, width, height, pict->linesize[0], 100, 0, direction); } } else { int sx= mb_x * 16 + 8; int sy= mb_y * 16 + 8; int xy= (mb_x + mb_y * mv_stride) << mv_sample_log2; int mx= (motion_val[direction][xy][0]>>shift) + sx; int my= (motion_val[direction][xy][1]>>shift) + sy; draw_arrow(ptr, sx, sy, mx, my, width, height, pict->linesize[0], 100, 0, direction); } } } #endif if ((avctx->debug & FF_DEBUG_VIS_QP)) { uint64_t c = (qscale_table[mb_index] * 128 / 31) * 0x0101010101010101ULL; int y; for (y = 0; y < block_height; y++) { *(uint64_t *)(pict->data[1] + 8 * mb_x + (block_height * mb_y + y) * pict->linesize[1]) = c; *(uint64_t *)(pict->data[2] + 8 * mb_x + (block_height * mb_y + y) * pict->linesize[2]) = c; } } if ((avctx->debug & FF_DEBUG_VIS_MB_TYPE) && motion_val[0]) { int mb_type = mbtype_table[mb_index]; uint64_t u,v; int y; #define COLOR(theta, r) \ u = (int)(128 + r * cos(theta * 3.141592 / 180)); \ v = (int)(128 + r * sin(theta * 3.141592 / 180)); u = v = 128; if (IS_PCM(mb_type)) { COLOR(120, 48) } else if ((IS_INTRA(mb_type) && IS_ACPRED(mb_type)) || IS_INTRA16x16(mb_type)) { COLOR(30, 48) } else if (IS_INTRA4x4(mb_type)) { COLOR(90, 48) } else if (IS_DIRECT(mb_type) && IS_SKIP(mb_type)) { // COLOR(120, 48) } else if (IS_DIRECT(mb_type)) { COLOR(150, 48) } else if (IS_GMC(mb_type) && IS_SKIP(mb_type)) { COLOR(170, 48) } else if (IS_GMC(mb_type)) { COLOR(190, 48) } else if (IS_SKIP(mb_type)) { // COLOR(180, 48) } else if (!USES_LIST(mb_type, 1)) { COLOR(240, 48) } else if (!USES_LIST(mb_type, 0)) { COLOR(0, 48) } else { av_assert2(USES_LIST(mb_type, 0) && USES_LIST(mb_type, 1)); COLOR(300,48) } u *= 0x0101010101010101ULL; v *= 0x0101010101010101ULL; for (y = 0; y < block_height; y++) { *(uint64_t *)(pict->data[1] + 8 * mb_x + (block_height * mb_y + y) * pict->linesize[1]) = u; *(uint64_t *)(pict->data[2] + 8 * mb_x + (block_height * mb_y + y) * pict->linesize[2]) = v; } // segmentation if (IS_8X8(mb_type) || IS_16X8(mb_type)) { *(uint64_t *)(pict->data[0] + 16 * mb_x + 0 + (16 * mb_y + 8) * pict->linesize[0]) ^= 0x8080808080808080ULL; *(uint64_t *)(pict->data[0] + 16 * mb_x + 8 + (16 * mb_y + 8) * pict->linesize[0]) ^= 0x8080808080808080ULL; } if (IS_8X8(mb_type) || IS_8X16(mb_type)) { for (y = 0; y < 16; y++) pict->data[0][16 * mb_x + 8 + (16 * mb_y + y) * pict->linesize[0]] ^= 0x80; } if (IS_8X8(mb_type) && mv_sample_log2 >= 2) { int dm = 1 << (mv_sample_log2 - 2); for (i = 0; i < 4; i++) { int sx = mb_x * 16 + 8 * (i & 1); int sy = mb_y * 16 + 8 * (i >> 1); int xy = (mb_x * 2 + (i & 1) + (mb_y * 2 + (i >> 1)) * mv_stride) << (mv_sample_log2 - 1); // FIXME bidir int32_t *mv = (int32_t *) &motion_val[0][xy]; if (mv[0] != mv[dm] || mv[dm * mv_stride] != mv[dm * (mv_stride + 1)]) for (y = 0; y < 8; y++) pict->data[0][sx + 4 + (sy + y) * pict->linesize[0]] ^= 0x80; if (mv[0] != mv[dm * mv_stride] || mv[dm] != mv[dm * (mv_stride + 1)]) *(uint64_t *)(pict->data[0] + sx + (sy + 4) * pict->linesize[0]) ^= 0x8080808080808080ULL; } } if (IS_INTERLACED(mb_type) && avctx->codec->id == AV_CODEC_ID_H264) { // hmm } } if (mbskip_table) mbskip_table[mb_index] = 0; } } } }","No, it is non-vulnerable."321319,"static void alloc_picture(void *opaque) { VideoState *is = opaque; VideoPicture *vp; vp = &is->pictq[is->pictq_windex]; if (vp->bmp) SDL_FreeYUVOverlay(vp->bmp); #if CONFIG_AVFILTER if (vp->picref) avfilter_unref_buffer(vp->picref); vp->picref = NULL; vp->width = is->out_video_filter->inputs[0]->w; vp->height = is->out_video_filter->inputs[0]->h; vp->pix_fmt = is->out_video_filter->inputs[0]->format; #else vp->width = is->video_st->codec->width; vp->height = is->video_st->codec->height; vp->pix_fmt = is->video_st->codec->pix_fmt; #endif vp->bmp = SDL_CreateYUVOverlay(vp->width, vp->height, SDL_YV12_OVERLAY, screen); SDL_LockMutex(is->pictq_mutex); vp->allocated = 1; SDL_CondSignal(is->pictq_cond); SDL_UnlockMutex(is->pictq_mutex);","Yes, it is vulnerable."322320,"int css_create_css_image(uint8_t cssid, bool default_image) { trace_css_new_image(cssid, default_image ? ""(default)"" : """"); if (cssid > MAX_CSSID) { return -EINVAL; } if (channel_subsys.css[cssid]) { return -EBUSY; } channel_subsys.css[cssid] = g_malloc0(sizeof(CssImage)); if (default_image) { channel_subsys.default_cssid = cssid; } return 0; }","Yes, it is vulnerable."323321,"static int decode_nal_unit(HEVCContext *s, const HEVCNAL *nal) { HEVCLocalContext *lc = &s->HEVClc; GetBitContext *gb = &lc->gb; int ctb_addr_ts, ret; ret = init_get_bits8(gb, nal->data, nal->size); if (ret < 0) return ret; ret = hls_nal_unit(s); if (ret < 0) { av_log(s->avctx, AV_LOG_ERROR, ""Invalid NAL unit %d, skipping.\n"", s->nal_unit_type); goto fail; } else if (!ret) return 0; switch (s->nal_unit_type) { case NAL_VPS: ret = ff_hevc_decode_nal_vps(gb, s->avctx, &s->ps); if (ret < 0) goto fail; break; case NAL_SPS: ret = ff_hevc_decode_nal_sps(gb, s->avctx, &s->ps, s->apply_defdispwin); if (ret < 0) goto fail; break; case NAL_PPS: ret = ff_hevc_decode_nal_pps(gb, s->avctx, &s->ps); if (ret < 0) goto fail; break; case NAL_SEI_PREFIX: case NAL_SEI_SUFFIX: ret = ff_hevc_decode_nal_sei(s); if (ret < 0) goto fail; break; case NAL_TRAIL_R: case NAL_TRAIL_N: case NAL_TSA_N: case NAL_TSA_R: case NAL_STSA_N: case NAL_STSA_R: case NAL_BLA_W_LP: case NAL_BLA_W_RADL: case NAL_BLA_N_LP: case NAL_IDR_W_RADL: case NAL_IDR_N_LP: case NAL_CRA_NUT: case NAL_RADL_N: case NAL_RADL_R: case NAL_RASL_N: case NAL_RASL_R: ret = hls_slice_header(s); if (ret < 0) return ret; if (s->max_ra == INT_MAX) { if (s->nal_unit_type == NAL_CRA_NUT || IS_BLA(s)) { s->max_ra = s->poc; } else { if (IS_IDR(s)) s->max_ra = INT_MIN; } } if ((s->nal_unit_type == NAL_RASL_R || s->nal_unit_type == NAL_RASL_N) && s->poc <= s->max_ra) { s->is_decoded = 0; break; } else { if (s->nal_unit_type == NAL_RASL_R && s->poc > s->max_ra) s->max_ra = INT_MIN; } if (s->sh.first_slice_in_pic_flag) { ret = hevc_frame_start(s); if (ret < 0) return ret; } else if (!s->ref) { av_log(s->avctx, AV_LOG_ERROR, ""First slice in a frame missing.\n""); goto fail; } if (s->nal_unit_type != s->first_nal_type) { av_log(s->avctx, AV_LOG_ERROR, ""Non-matching NAL types of the VCL NALUs: %d %d\n"", s->first_nal_type, s->nal_unit_type); return AVERROR_INVALIDDATA; } if (!s->sh.dependent_slice_segment_flag && s->sh.slice_type != I_SLICE) { ret = ff_hevc_slice_rpl(s); if (ret < 0) { av_log(s->avctx, AV_LOG_WARNING, ""Error constructing the reference lists for the current slice.\n""); goto fail; } } if (s->sh.first_slice_in_pic_flag && s->avctx->hwaccel) { ret = s->avctx->hwaccel->start_frame(s->avctx, NULL, 0); if (ret < 0) goto fail; } if (s->avctx->hwaccel) { ret = s->avctx->hwaccel->decode_slice(s->avctx, nal->raw_data, nal->raw_size); if (ret < 0) goto fail; } else { ctb_addr_ts = hls_slice_data(s); if (ctb_addr_ts >= (s->ps.sps->ctb_width * s->ps.sps->ctb_height)) { s->is_decoded = 1; if ((s->ps.pps->transquant_bypass_enable_flag || (s->ps.sps->pcm.loop_filter_disable_flag && s->ps.sps->pcm_enabled_flag)) && s->ps.sps->sao_enabled) restore_tqb_pixels(s); } if (ctb_addr_ts < 0) { ret = ctb_addr_ts; goto fail; } } break; case NAL_EOS_NUT: case NAL_EOB_NUT: s->seq_decode = (s->seq_decode + 1) & 0xff; s->max_ra = INT_MAX; break; case NAL_AUD: case NAL_FD_NUT: break; default: av_log(s->avctx, AV_LOG_INFO, ""Skipping NAL unit %d\n"", s->nal_unit_type); } return 0; fail: if (s->avctx->err_recognition & AV_EF_EXPLODE) return ret; return 0; }","No, it is non-vulnerable."324322,"static void pxa2xx_pic_save(QEMUFile *f, void *opaque) { PXA2xxPICState *s = (PXA2xxPICState *) opaque; int i; for (i = 0; i < 2; i ++) qemu_put_be32s(f, &s->int_enabled[i]); for (i = 0; i < 2; i ++) qemu_put_be32s(f, &s->int_pending[i]); for (i = 0; i < 2; i ++) qemu_put_be32s(f, &s->is_fiq[i]); qemu_put_be32s(f, &s->int_idle); for (i = 0; i < PXA2XX_PIC_SRCS; i ++) qemu_put_be32s(f, &s->priority[i]); }","No, it is non-vulnerable."325323,"static int nbd_co_send_request(BDRVNBDState *s, struct nbd_request *request, struct iovec *iov, int offset) { int rc, ret; qemu_co_mutex_lock(&s->send_mutex); s->send_coroutine = qemu_coroutine_self(); qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, nbd_restart_write, nbd_have_request, NULL, s); rc = nbd_send_request(s->sock, request); if (rc >= 0 && iov) { ret = qemu_co_sendv(s->sock, iov, request->len, offset); if (ret != request->len) { errno = -EIO; rc = -1; } } qemu_aio_set_fd_handler(s->sock, nbd_reply_ready, NULL, nbd_have_request, NULL, s); s->send_coroutine = NULL; qemu_co_mutex_unlock(&s->send_mutex); return rc; }","No, it is non-vulnerable."326324,void replay_save_input_event(InputEvent *evt) { InputKeyEvent *key; InputBtnEvent *btn; InputMoveEvent *move; replay_put_dword(evt->type); switch (evt->type) { case INPUT_EVENT_KIND_KEY: key = evt->u.key; replay_put_dword(key->key->type); switch (key->key->type) { case KEY_VALUE_KIND_NUMBER: replay_put_qword(key->key->u.number); replay_put_byte(key->down); break; case KEY_VALUE_KIND_QCODE: replay_put_dword(key->key->u.qcode); replay_put_byte(key->down); break; case KEY_VALUE_KIND__MAX: /* keep gcc happy */ break; } break; case INPUT_EVENT_KIND_BTN: btn = evt->u.btn; replay_put_dword(btn->button); replay_put_byte(btn->down); break; case INPUT_EVENT_KIND_REL: move = evt->u.rel; replay_put_dword(move->axis); replay_put_qword(move->value); break; case INPUT_EVENT_KIND_ABS: move = evt->u.abs; replay_put_dword(move->axis); replay_put_qword(move->value); break; case INPUT_EVENT_KIND__MAX: /* keep gcc happy */ break; } },"No, it is non-vulnerable."327325,"static void internal_snapshot_prepare(BlkActionState *common, Error **errp) { Error *local_err = NULL; const char *device; const char *name; BlockBackend *blk; BlockDriverState *bs; QEMUSnapshotInfo old_sn, *sn; bool ret; qemu_timeval tv; BlockdevSnapshotInternal *internal; InternalSnapshotState *state; int ret1; g_assert(common->action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC); internal = common->action->u.blockdev_snapshot_internal_sync.data; state = DO_UPCAST(InternalSnapshotState, common, common); /* 1. parse input */ device = internal->device; name = internal->name; /* 2. check for validation */ if (action_check_completion_mode(common, errp) < 0) { return; } blk = blk_by_name(device); if (!blk) { error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND, ""Device '%s' not found"", device); return; } /* AioContext is released in .clean() */ state->aio_context = blk_get_aio_context(blk); aio_context_acquire(state->aio_context); if (!blk_is_available(blk)) { error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device); return; } bs = blk_bs(blk); state->bs = bs; bdrv_drained_begin(bs); if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) { return; } if (bdrv_is_read_only(bs)) { error_setg(errp, ""Device '%s' is read only"", device); return; } if (!bdrv_can_snapshot(bs)) { error_setg(errp, ""Block format '%s' used by device '%s' "" ""does not support internal snapshots"", bs->drv->format_name, device); return; } if (!strlen(name)) { error_setg(errp, ""Name is empty""); return; } /* check whether a snapshot with name exist */ ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn, &local_err); if (local_err) { error_propagate(errp, local_err); return; } else if (ret) { error_setg(errp, ""Snapshot with name '%s' already exists on device '%s'"", name, device); return; } /* 3. take the snapshot */ sn = &state->sn; pstrcpy(sn->name, sizeof(sn->name), name); qemu_gettimeofday(&tv); sn->date_sec = tv.tv_sec; sn->date_nsec = tv.tv_usec * 1000; sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); ret1 = bdrv_snapshot_create(bs, sn); if (ret1 < 0) { error_setg_errno(errp, -ret1, ""Failed to create snapshot '%s' on device '%s'"", name, device); return; } /* 4. succeed, mark a snapshot is created */ state->created = true; }","No, it is non-vulnerable."328326,"void qdev_set_parent_bus(DeviceState *dev, BusState *bus) { Property *prop; if (qdev_hotplug) { assert(bus->allow_hotplug); } dev->parent_bus = bus; QTAILQ_INSERT_HEAD(&bus->children, dev, sibling); qdev_prop_set_defaults(dev, dev->parent_bus->info->props); for (prop = qdev_get_bus_info(dev)->props; prop && prop->name; prop++) { qdev_property_add_legacy(dev, prop, NULL); qdev_property_add_static(dev, prop, NULL); } }","No, it is non-vulnerable."329327,"int object_property_get_enum(Object *obj, const char *name, const char *typename, Error **errp) { Error *err = NULL; StringOutputVisitor *sov; Visitor *v; char *str; int ret; ObjectProperty *prop = object_property_find(obj, name, errp); EnumProperty *enumprop; if (prop == NULL) { return 0; } if (!g_str_equal(prop->type, typename)) { error_setg(errp, ""Property %s on %s is not '%s' enum type"", name, object_class_get_name( object_get_class(obj)), typename); return 0; } enumprop = prop->opaque; sov = string_output_visitor_new(false); object_property_get(obj, string_output_get_visitor(sov), name, &err); if (err) { error_propagate(errp, err); string_output_visitor_cleanup(sov); return 0; } str = string_output_get_string(sov); string_output_visitor_cleanup(sov); v = string_input_visitor_new(str); visit_type_enum(v, name, &ret, enumprop->strings, errp); g_free(str); visit_free(v); return ret; }","No, it is non-vulnerable."330328,"static uint64_t omap_sti_read(void *opaque, target_phys_addr_t addr, unsigned size) { struct omap_sti_s *s = (struct omap_sti_s *) opaque; if (size != 4) { return omap_badwidth_read32(opaque, addr); } switch (addr) { case 0x00: /* STI_REVISION */ return 0x10; case 0x10: /* STI_SYSCONFIG */ return s->sysconfig; case 0x14: /* STI_SYSSTATUS / STI_RX_STATUS / XTI_SYSSTATUS */ return 0x00; case 0x18: /* STI_IRQSTATUS */ return s->irqst; case 0x1c: /* STI_IRQSETEN / STI_IRQCLREN */ return s->irqen; case 0x24: /* STI_ER / STI_DR / XTI_TRACESELECT */ case 0x28: /* STI_RX_DR / XTI_RXDATA */ /* TODO */ return 0; case 0x2c: /* STI_CLK_CTRL / XTI_SCLKCRTL */ return s->clkcontrol; case 0x30: /* STI_SERIAL_CFG / XTI_SCONFIG */ return s->serial_config; } OMAP_BAD_REG(addr); return 0; }","No, it is non-vulnerable."331329,"static int pollfds_fill(GArray *pollfds, fd_set *rfds, fd_set *wfds, fd_set *xfds) { int nfds = -1; int i; for (i = 0; i < pollfds->len; i++) { GPollFD *pfd = &g_array_index(pollfds, GPollFD, i); int fd = pfd->fd; int events = pfd->events; if (events & G_IO_IN) { FD_SET(fd, rfds); nfds = MAX(nfds, fd); } if (events & G_IO_OUT) { FD_SET(fd, wfds); nfds = MAX(nfds, fd); } if (events & G_IO_PRI) { FD_SET(fd, xfds); nfds = MAX(nfds, fd); } } return nfds; }","No, it is non-vulnerable."332330,void qemu_bh_schedule_idle(QEMUBH *bh) { if (bh->scheduled) return; bh->scheduled = 1; bh->idle = 1; },"No, it is non-vulnerable."333331,"void stl_phys(target_phys_addr_t addr, uint32_t val) { stl_phys_internal(addr, val, DEVICE_NATIVE_ENDIAN); }","No, it is non-vulnerable."334332,"build_madt(GArray *table_data, GArray *linker, PCMachineState *pcms, AcpiCpuInfo *cpu) { int madt_start = table_data->len; AcpiMultipleApicTable *madt; AcpiMadtIoApic *io_apic; AcpiMadtIntsrcovr *intsrcovr; AcpiMadtLocalNmi *local_nmi; int i; madt = acpi_data_push(table_data, sizeof *madt); madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS); madt->flags = cpu_to_le32(1); for (i = 0; i < pcms->apic_id_limit; i++) { AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic); apic->type = ACPI_APIC_PROCESSOR; apic->length = sizeof(*apic); apic->processor_id = i; apic->local_apic_id = i; if (test_bit(i, cpu->found_cpus)) { apic->flags = cpu_to_le32(1); } else { apic->flags = cpu_to_le32(0); } } io_apic = acpi_data_push(table_data, sizeof *io_apic); io_apic->type = ACPI_APIC_IO; io_apic->length = sizeof(*io_apic); #define ACPI_BUILD_IOAPIC_ID 0x0 io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID; io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS); io_apic->interrupt = cpu_to_le32(0); if (pcms->apic_xrupt_override) { intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr); intsrcovr->type = ACPI_APIC_XRUPT_OVERRIDE; intsrcovr->length = sizeof(*intsrcovr); intsrcovr->source = 0; intsrcovr->gsi = cpu_to_le32(2); intsrcovr->flags = cpu_to_le16(0); /* conforms to bus specifications */ } for (i = 1; i < 16; i++) { #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11)) if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) { /* No need for a INT source override structure. */ continue; } intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr); intsrcovr->type = ACPI_APIC_XRUPT_OVERRIDE; intsrcovr->length = sizeof(*intsrcovr); intsrcovr->source = i; intsrcovr->gsi = cpu_to_le32(i); intsrcovr->flags = cpu_to_le16(0xd); /* active high, level triggered */ } local_nmi = acpi_data_push(table_data, sizeof *local_nmi); local_nmi->type = ACPI_APIC_LOCAL_NMI; local_nmi->length = sizeof(*local_nmi); local_nmi->processor_id = 0xff; /* all processors */ local_nmi->flags = cpu_to_le16(0); local_nmi->lint = 1; /* ACPI_LINT1 */ build_header(linker, table_data, (void *)(table_data->data + madt_start), ""APIC"", table_data->len - madt_start, 1, NULL, NULL); }","No, it is non-vulnerable."335333,"static inline int vc1_i_pred_dc(MpegEncContext *s, int overlap, int pq, int n, int16_t **dc_val_ptr, int *dir_ptr) { int a, b, c, wrap, pred, scale; int16_t *dc_val; static const uint16_t dcpred[32] = { -1, 1024, 512, 341, 256, 205, 171, 146, 128, 114, 102, 93, 85, 79, 73, 68, 64, 60, 57, 54, 51, 49, 47, 45, 43, 41, 39, 38, 37, 35, 34, 33 }; /* find prediction - wmv3_dc_scale always used here in fact */ if (n < 4) scale = s->y_dc_scale; else scale = s->c_dc_scale; wrap = s->block_wrap[n]; dc_val= s->dc_val[0] + s->block_index[n]; /* B A * C X */ c = dc_val[ - 1]; b = dc_val[ - 1 - wrap]; a = dc_val[ - wrap]; if (pq < 9 || !overlap) { /* Set outer values */ if (!s->mb_y && (n!=2 && n!=3)) b=a=dcpred[scale]; if (s->mb_x == 0 && (n!=1 && n!=3)) b=c=dcpred[scale]; } else { /* Set outer values */ if (!s->mb_y && (n!=2 && n!=3)) b=a=0; if (s->mb_x == 0 && (n!=1 && n!=3)) b=c=0; } if (abs(a - b) <= abs(b - c)) { pred = c; *dir_ptr = 1;//left } else { pred = a; *dir_ptr = 0;//top } /* update predictor */ *dc_val_ptr = &dc_val[0]; return pred; }","No, it is non-vulnerable."336334,"static void multiwrite_user_cb(MultiwriteCB *mcb) { int i; for (i = 0; i < mcb->num_callbacks; i++) { mcb->callbacks[i].cb(mcb->callbacks[i].opaque, mcb->error); if (mcb->callbacks[i].free_qiov) { qemu_iovec_destroy(mcb->callbacks[i].free_qiov); } g_free(mcb->callbacks[i].free_qiov); } }","No, it is non-vulnerable."337335,"char *get_boot_devices_list(uint32_t *size) { FWBootEntry *i; uint32_t total = 0; char *list = NULL; QTAILQ_FOREACH(i, &fw_boot_order, link) { char *devpath = NULL, *bootpath; int len; if (i->dev) { devpath = qdev_get_fw_dev_path(i->dev); assert(devpath); } if (i->suffix && devpath) { bootpath = qemu_malloc(strlen(devpath) + strlen(i->suffix) + 1); sprintf(bootpath, ""%s%s"", devpath, i->suffix); qemu_free(devpath); } else if (devpath) { bootpath = devpath; } else { bootpath = strdup(i->suffix); assert(bootpath); } if (total) { list[total-1] = '\n'; } len = strlen(bootpath) + 1; list = qemu_realloc(list, total + len); memcpy(&list[total], bootpath, len); total += len; qemu_free(bootpath); } *size = total; return list; }","No, it is non-vulnerable."338336,"void rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst, uint8_t *vdst, int width, int height, int lumStride, int chromStride, int srcStride) { int y; const int chromWidth = width >> 1; for (y = 0; y < height; y += 2) { int i; for (i = 0; i < chromWidth; i++) { unsigned int b = src[6 * i + 0]; unsigned int g = src[6 * i + 1]; unsigned int r = src[6 * i + 2]; unsigned int Y = ((RY * r + GY * g + BY * b) >> RGB2YUV_SHIFT) + 16; unsigned int V = ((RV * r + GV * g + BV * b) >> RGB2YUV_SHIFT) + 128; unsigned int U = ((RU * r + GU * g + BU * b) >> RGB2YUV_SHIFT) + 128; udst[i] = U; vdst[i] = V; ydst[2 * i] = Y; b = src[6 * i + 3]; g = src[6 * i + 4]; r = src[6 * i + 5]; Y = ((RY * r + GY * g + BY * b) >> RGB2YUV_SHIFT) + 16; ydst[2 * i + 1] = Y; } ydst += lumStride; src += srcStride; if (y+1 == height) break; for (i = 0; i < chromWidth; i++) { unsigned int b = src[6 * i + 0]; unsigned int g = src[6 * i + 1]; unsigned int r = src[6 * i + 2]; unsigned int Y = ((RY * r + GY * g + BY * b) >> RGB2YUV_SHIFT) + 16; ydst[2 * i] = Y; b = src[6 * i + 3]; g = src[6 * i + 4]; r = src[6 * i + 5]; Y = ((RY * r + GY * g + BY * b) >> RGB2YUV_SHIFT) + 16; ydst[2 * i + 1] = Y; } udst += chromStride; vdst += chromStride; ydst += lumStride; src += srcStride; } }","Yes, it is vulnerable."339337,"static void framebuffer_update_request(VncState *vs, int incremental, int x_position, int y_position, int w, int h) { int i; const size_t width = surface_width(vs->vd->ds) / VNC_DIRTY_PIXELS_PER_BIT; const size_t height = surface_height(vs->vd->ds); if (y_position > height) { y_position = height; } if (y_position + h >= height) { h = height - y_position; } vs->need_update = 1; if (!incremental) { vs->force_update = 1; for (i = 0; i < h; i++) { bitmap_set(vs->dirty[y_position + i], 0, width); bitmap_clear(vs->dirty[y_position + i], width, VNC_DIRTY_BITS - width); } } }","Yes, it is vulnerable."340338,"static void sdp_parse_fmtp_config(AVCodecContext *codec, char *attr, char *value) { switch (codec->codec_id) { case CODEC_ID_MPEG4: case CODEC_ID_AAC: if (!strcmp(attr, ""config"")) { /* decode the hexa encoded parameter */ int len = hex_to_data(NULL, value); codec->extradata = av_mallocz(len + FF_INPUT_BUFFER_PADDING_SIZE); if (!codec->extradata) return; codec->extradata_size = len; hex_to_data(codec->extradata, value); } break; default: break; } return; }","Yes, it is vulnerable."341339,"static int tpm_passthrough_unix_write(int fd, const uint8_t *buf, uint32_t len) { int ret, remain; remain = len; while (len > 0) { ret = write(fd, buf, remain); if (ret < 0) { if (errno != EINTR && errno != EAGAIN) { return -1; } } else if (ret == 0) { break; } else { buf += ret; remain -= ret; } } return len - remain; }","Yes, it is vulnerable."342340,"static int mp3_header_decompress(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args, uint8_t **poutbuf, int *poutbuf_size, const uint8_t *buf, int buf_size, int keyframe){ uint32_t header; int sample_rate= avctx->sample_rate; int sample_rate_index=0; int lsf, mpeg25, bitrate_index, frame_size; header = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]; if(ff_mpa_check_header(header) >= 0){ *poutbuf= (uint8_t *) buf; *poutbuf_size= buf_size; return 0; } header= 0xFFE00000 | ((4-3)<<17) | (1<<16); //FIXME simplify lsf = sample_rate < (24000+32000)/2; mpeg25 = sample_rate < (12000+16000)/2; header |= (!mpeg25)<<20; header |= (!lsf )<<19; if(sample_rate<<(lsf+mpeg25) < (44100+32000)/2) sample_rate_index |= 2; else if(sample_rate<<(lsf+mpeg25) > (44100+48000)/2) sample_rate_index |= 1; header |= sample_rate_index<<10; sample_rate= mpa_freq_tab[sample_rate_index] >> (lsf + mpeg25); //in case sample rate is a little off for(bitrate_index=2; bitrate_index<30; bitrate_index++){ frame_size = mpa_bitrate_tab[lsf][2][bitrate_index>>1]; frame_size = (frame_size * 144000) / (sample_rate << lsf) + (bitrate_index&1); if(frame_size == buf_size + 4) break; } if(bitrate_index == 30){ av_log(avctx, AV_LOG_ERROR, ""couldnt find bitrate_index\n""); return -1; } header |= (bitrate_index&1)<<9; header |= (bitrate_index>>1)<<12; header |= (avctx->channels==1 ? MPA_MONO : MPA_JSTEREO)<<6; *poutbuf_size= buf_size + 4; *poutbuf= av_malloc(buf_size + 4 + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(*poutbuf + 4, buf, buf_size + FF_INPUT_BUFFER_PADDING_SIZE); if(avctx->channels==2){ if(lsf){ FFSWAP(int, (*poutbuf)[5], (*poutbuf)[6]); header |= ((*poutbuf)[5] & 0xC0)>>2; }else{ header |= (*poutbuf)[5] & 0x30; } } (*poutbuf)[0]= header>>24; (*poutbuf)[1]= header>>16; (*poutbuf)[2]= header>> 8; (*poutbuf)[3]= header ; return 1; }","No, it is non-vulnerable."343341,"static struct iovec *lock_iovec(int type, abi_ulong target_addr, int count, int copy) { struct target_iovec *target_vec; struct iovec *vec; abi_ulong total_len, max_len; int i; int err = 0; bool bad_address = false; if (count == 0) { errno = 0; return NULL; if (count < 0 || count > IOV_MAX) { errno = EINVAL; return NULL; vec = calloc(count, sizeof(struct iovec)); if (vec == NULL) { errno = ENOMEM; return NULL; target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1); if (target_vec == NULL) { err = EFAULT; goto fail2; /* ??? If host page size > target page size, this will result in a value larger than what we can actually support. */ max_len = 0x7fffffff & TARGET_PAGE_MASK; total_len = 0; for (i = 0; i < count; i++) { abi_ulong base = tswapal(target_vec[i].iov_base); abi_long len = tswapal(target_vec[i].iov_len); if (len < 0) { err = EINVAL; goto fail; } else if (len == 0) { /* Zero length pointer is ignored. */ vec[i].iov_base = 0; } else { vec[i].iov_base = lock_user(type, base, len, copy); /* If the first buffer pointer is bad, this is a fault. But * subsequent bad buffers will result in a partial write; this * is realized by filling the vector with null pointers and * zero lengths. */ if (!vec[i].iov_base) { if (i == 0) { err = EFAULT; goto fail; } else { bad_address = true; if (bad_address) { len = 0; if (len > max_len - total_len) { len = max_len - total_len; vec[i].iov_len = len; total_len += len; unlock_user(target_vec, target_addr, 0); return vec; fail: unlock_user(target_vec, target_addr, 0); fail2: free(vec); errno = err; return NULL;","Yes, it is vulnerable."344342,"static void cris_cpu_initfn(Object *obj) { CPUState *cs = CPU(obj); CRISCPU *cpu = CRIS_CPU(obj); CRISCPUClass *ccc = CRIS_CPU_GET_CLASS(obj); CPUCRISState *env = &cpu->env; static bool tcg_initialized; cs->env_ptr = env; cpu_exec_init(cs, &error_abort); env->pregs[PR_VR] = ccc->vr; #ifndef CONFIG_USER_ONLY /* IRQ and NMI lines. */ qdev_init_gpio_in(DEVICE(cpu), cris_cpu_set_irq, 2); #endif if (tcg_enabled() && !tcg_initialized) { tcg_initialized = true; if (env->pregs[PR_VR] < 32) { cris_initialize_crisv10_tcg(); } else { cris_initialize_tcg(); } } }","Yes, it is vulnerable."345343,"static int get_cod(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, uint8_t *properties) { Jpeg2000CodingStyle tmp; int compno; if (s->buf_end - s->buf < 5) return AVERROR(EINVAL); tmp.log2_prec_width = tmp.log2_prec_height = 15; tmp.csty = bytestream_get_byte(&s->buf); // get progression order tmp.prog_order = bytestream_get_byte(&s->buf); tmp.nlayers = bytestream_get_be16(&s->buf); tmp.mct = bytestream_get_byte(&s->buf); // multiple component transformation get_cox(s, &tmp); for (compno = 0; compno < s->ncomponents; compno++) if (!(properties[compno] & HAD_COC)) memcpy(c + compno, &tmp, sizeof(tmp)); return 0; }","No, it is non-vulnerable."346344,"static int32_t scalarproduct_and_madd_int16_c(int16_t *v1, const int16_t *v2, const int16_t *v3, int order, int mul) { int res = 0; while (order--) { res += *v1 * *v2++; *v1++ += mul * *v3++; } return res; }","Yes, it is vulnerable."347345,"void exec_start_incoming_migration(const char *command, Error **errp) { QEMUFile *f; DPRINTF(""Attempting to start an incoming migration\n""); f = qemu_popen_cmd(command, ""r""); if(f == NULL) { error_setg_errno(errp, errno, ""failed to popen the migration source""); return; } qemu_set_fd_handler2(qemu_get_fd(f), NULL, exec_accept_incoming_migration, NULL, f); }","Yes, it is vulnerable."348346,"static void io_mem_init(void) { cpu_register_io_memory(IO_MEM_ROM >> IO_MEM_SHIFT, error_mem_read, unassigned_mem_write, NULL); cpu_register_io_memory(IO_MEM_UNASSIGNED >> IO_MEM_SHIFT, unassigned_mem_read, unassigned_mem_write, NULL); cpu_register_io_memory(IO_MEM_NOTDIRTY >> IO_MEM_SHIFT, error_mem_read, notdirty_mem_write, NULL); io_mem_nb = 5; /* alloc dirty bits array */ phys_ram_dirty = qemu_vmalloc(phys_ram_size >> TARGET_PAGE_BITS); memset(phys_ram_dirty, 0xff, phys_ram_size >> TARGET_PAGE_BITS); }","Yes, it is vulnerable."349347,"static int avi_read_header(AVFormatContext *s, AVFormatParameters *ap) { AVIContext *avi = s->priv_data; ByteIOContext *pb = &s->pb; uint32_t tag, tag1, handler; int codec_type, stream_index, frame_period, bit_rate; unsigned int size, nb_frames; int i, n; AVStream *st; AVIStream *ast = NULL; int xan_video = 0; /* hack to support Xan A/V */ char str_track[4]; avi->stream_index= -1; if (get_riff(avi, pb) < 0) return -1; /* first list tag */ stream_index = -1; codec_type = -1; frame_period = 0; for(;;) { if (url_feof(pb)) goto fail; tag = get_le32(pb); size = get_le32(pb); #ifdef DEBUG print_tag(""tag"", tag, size); #endif switch(tag) { case MKTAG('L', 'I', 'S', 'T'): /* ignored, except when start of video packets */ tag1 = get_le32(pb); #ifdef DEBUG print_tag(""list"", tag1, 0); #endif if (tag1 == MKTAG('m', 'o', 'v', 'i')) { avi->movi_list = url_ftell(pb) - 4; if(size) avi->movi_end = avi->movi_list + size + (size & 1); else avi->movi_end = url_fsize(pb); #ifdef DEBUG printf(""movi end=%""PRIx64""\n"", avi->movi_end); #endif goto end_of_header; } break; case MKTAG('d', 'm', 'l', 'h'): avi->is_odml = 1; url_fskip(pb, size + (size & 1)); break; case MKTAG('a', 'v', 'i', 'h'): /* avi header */ /* using frame_period is bad idea */ frame_period = get_le32(pb); bit_rate = get_le32(pb) * 8; get_le32(pb); avi->non_interleaved |= get_le32(pb) & AVIF_MUSTUSEINDEX; url_fskip(pb, 2 * 4); n = get_le32(pb); for(i=0;i<n;i++) { AVIStream *ast; st = av_new_stream(s, i); if (!st) goto fail; ast = av_mallocz(sizeof(AVIStream)); if (!ast) goto fail; st->priv_data = ast; } url_fskip(pb, size - 7 * 4); break; case MKTAG('s', 't', 'r', 'h'): /* stream header */ stream_index++; tag1 = get_le32(pb); handler = get_le32(pb); /* codec tag */ #ifdef DEBUG print_tag(""strh"", tag1, -1); #endif if(tag1 == MKTAG('i', 'a', 'v', 's') || tag1 == MKTAG('i', 'v', 'a', 's')){ /* * After some consideration -- I don't think we * have to support anything but DV in a type1 AVIs. */ if (s->nb_streams != 1) goto fail; if (handler != MKTAG('d', 'v', 's', 'd') && handler != MKTAG('d', 'v', 'h', 'd') && handler != MKTAG('d', 'v', 's', 'l')) goto fail; ast = s->streams[0]->priv_data; av_freep(&s->streams[0]->codec->extradata); av_freep(&s->streams[0]); s->nb_streams = 0; if (ENABLE_DV_DEMUXER) { avi->dv_demux = dv_init_demux(s); if (!avi->dv_demux) goto fail; } s->streams[0]->priv_data = ast; url_fskip(pb, 3 * 4); ast->scale = get_le32(pb); ast->rate = get_le32(pb); stream_index = s->nb_streams - 1; url_fskip(pb, size - 7*4); break; } if (stream_index >= s->nb_streams) { url_fskip(pb, size - 8); /* ignore padding stream */ if (tag1 == MKTAG('p', 'a', 'd', 's')) stream_index--; break; } st = s->streams[stream_index]; ast = st->priv_data; st->codec->stream_codec_tag= handler; get_le32(pb); /* flags */ get_le16(pb); /* priority */ get_le16(pb); /* language */ get_le32(pb); /* initial frame */ ast->scale = get_le32(pb); ast->rate = get_le32(pb); if(ast->scale && ast->rate){ }else if(frame_period){ ast->rate = 1000000; ast->scale = frame_period; }else{ ast->rate = 25; ast->scale = 1; } av_set_pts_info(st, 64, ast->scale, ast->rate); ast->cum_len=get_le32(pb); /* start */ nb_frames = get_le32(pb); st->start_time = 0; st->duration = nb_frames; get_le32(pb); /* buffer size */ get_le32(pb); /* quality */ ast->sample_size = get_le32(pb); /* sample ssize */ ast->cum_len *= FFMAX(1, ast->sample_size); // av_log(NULL, AV_LOG_DEBUG, ""%d %d %d %d\n"", ast->rate, ast->scale, ast->start, ast->sample_size); switch(tag1) { case MKTAG('v', 'i', 'd', 's'): codec_type = CODEC_TYPE_VIDEO; ast->sample_size = 0; break; case MKTAG('a', 'u', 'd', 's'): codec_type = CODEC_TYPE_AUDIO; break; case MKTAG('t', 'x', 't', 's'): //FIXME codec_type = CODEC_TYPE_DATA; //CODEC_TYPE_SUB ? FIXME break; case MKTAG('p', 'a', 'd', 's'): codec_type = CODEC_TYPE_UNKNOWN; stream_index--; break; default: av_log(s, AV_LOG_ERROR, ""unknown stream type %X\n"", tag1); goto fail; } ast->frame_offset= ast->cum_len; url_fskip(pb, size - 12 * 4); break; case MKTAG('s', 't', 'r', 'f'): /* stream header */ if (stream_index >= s->nb_streams || avi->dv_demux) { url_fskip(pb, size); } else { st = s->streams[stream_index]; switch(codec_type) { case CODEC_TYPE_VIDEO: get_le32(pb); /* size */ st->codec->width = get_le32(pb); st->codec->height = get_le32(pb); get_le16(pb); /* panes */ st->codec->bits_per_sample= get_le16(pb); /* depth */ tag1 = get_le32(pb); get_le32(pb); /* ImageSize */ get_le32(pb); /* XPelsPerMeter */ get_le32(pb); /* YPelsPerMeter */ get_le32(pb); /* ClrUsed */ get_le32(pb); /* ClrImportant */ if(size > 10*4 && size<(1<<30)){ st->codec->extradata_size= size - 10*4; st->codec->extradata= av_malloc(st->codec->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); get_buffer(pb, st->codec->extradata, st->codec->extradata_size); } if(st->codec->extradata_size & 1) //FIXME check if the encoder really did this correctly get_byte(pb); /* Extract palette from extradata if bpp <= 8 */ /* This code assumes that extradata contains only palette */ /* This is true for all paletted codecs implemented in ffmpeg */ if (st->codec->extradata_size && (st->codec->bits_per_sample <= 8)) { st->codec->palctrl = av_mallocz(sizeof(AVPaletteControl)); #ifdef WORDS_BIGENDIAN for (i = 0; i < FFMIN(st->codec->extradata_size, AVPALETTE_SIZE)/4; i++) st->codec->palctrl->palette[i] = bswap_32(((uint32_t*)st->codec->extradata)[i]); #else memcpy(st->codec->palctrl->palette, st->codec->extradata, FFMIN(st->codec->extradata_size, AVPALETTE_SIZE)); #endif st->codec->palctrl->palette_changed = 1; } #ifdef DEBUG print_tag(""video"", tag1, 0); #endif st->codec->codec_type = CODEC_TYPE_VIDEO; st->codec->codec_tag = tag1; st->codec->codec_id = codec_get_id(codec_bmp_tags, tag1); if (st->codec->codec_id == CODEC_ID_XAN_WC4) xan_video = 1; st->need_parsing = 2; //only parse headers dont do slower repacketization, this is needed to get the pict type which is needed for generating correct pts // url_fskip(pb, size - 5 * 4); break; case CODEC_TYPE_AUDIO: get_wav_header(pb, st->codec, size); if(ast->sample_size && st->codec->block_align && ast->sample_size % st->codec->block_align) av_log(s, AV_LOG_DEBUG, ""invalid sample size or block align detected\n""); if (size%2) /* 2-aligned (fix for Stargate SG-1 - 3x18 - Shades of Grey.avi) */ url_fskip(pb, 1); /* special case time: To support Xan DPCM, hardcode * the format if Xxan is the video codec */ st->need_parsing = 1; /* ADTS header is in extradata, AAC without header must be stored as exact frames, parser not needed and it will fail */ if (st->codec->codec_id == CODEC_ID_AAC && st->codec->extradata_size) st->need_parsing = 0; /* force parsing as several audio frames can be in one packet */ if (xan_video) st->codec->codec_id = CODEC_ID_XAN_DPCM; break; default: st->codec->codec_type = CODEC_TYPE_DATA; st->codec->codec_id= CODEC_ID_NONE; st->codec->codec_tag= 0; url_fskip(pb, size); break; } } break; case MKTAG('i', 'n', 'd', 'x'): i= url_ftell(pb); if(!url_is_streamed(pb) && !(s->flags & AVFMT_FLAG_IGNIDX)){ read_braindead_odml_indx(s, 0); } url_fseek(pb, i+size, SEEK_SET); break; case MKTAG('I', 'N', 'A', 'M'): avi_read_tag(pb, s->title, sizeof(s->title), size); break; case MKTAG('I', 'A', 'R', 'T'): avi_read_tag(pb, s->author, sizeof(s->author), size); break; case MKTAG('I', 'C', 'O', 'P'): avi_read_tag(pb, s->copyright, sizeof(s->copyright), size); break; case MKTAG('I', 'C', 'M', 'T'): avi_read_tag(pb, s->comment, sizeof(s->comment), size); break; case MKTAG('I', 'G', 'N', 'R'): avi_read_tag(pb, s->genre, sizeof(s->genre), size); break; case MKTAG('I', 'P', 'R', 'D'): avi_read_tag(pb, s->album, sizeof(s->album), size); break; case MKTAG('I', 'P', 'R', 'T'): avi_read_tag(pb, str_track, sizeof(str_track), size); sscanf(str_track, ""%d"", &s->track); break; default: /* skip tag */ size += (size & 1); url_fskip(pb, size); break; } } end_of_header: /* check stream number */ if (stream_index != s->nb_streams - 1) { fail: for(i=0;i<s->nb_streams;i++) { av_freep(&s->streams[i]->codec->extradata); av_freep(&s->streams[i]); } return -1; } if(!avi->index_loaded && !url_is_streamed(pb)) avi_load_index(s); avi->index_loaded = 1; avi->non_interleaved |= guess_ni_flag(s); if(avi->non_interleaved) clean_index(s); return 0; }","No, it is non-vulnerable."350348,"static int ffserver_parse_config_feed(FFServerConfig *config, const char *cmd, const char **p, FFServerStream **pfeed) { FFServerStream *feed; char arg[1024]; av_assert0(pfeed); feed = *pfeed; if (!av_strcasecmp(cmd, ""<Feed"")) { char *q; FFServerStream *s; feed = av_mallocz(sizeof(FFServerStream)); if (!feed) return AVERROR(ENOMEM); ffserver_get_arg(feed->filename, sizeof(feed->filename), p); q = strrchr(feed->filename, '>'); if (*q) *q = '\0'; for (s = config->first_feed; s; s = s->next) { if (!strcmp(feed->filename, s->filename)) ERROR(""Feed '%s' already registered\n"", s->filename); } feed->fmt = av_guess_format(""ffm"", NULL, NULL); /* default feed file */ snprintf(feed->feed_filename, sizeof(feed->feed_filename), ""/tmp/%s.ffm"", feed->filename); feed->feed_max_size = 5 * 1024 * 1024; feed->is_feed = 1; feed->feed = feed; /* self feeding :-) */ *pfeed = feed; return 0; } av_assert0(feed); if (!av_strcasecmp(cmd, ""Launch"")) { int i; feed->child_argv = av_mallocz(64 * sizeof(char *)); if (!feed->child_argv) return AVERROR(ENOMEM); for (i = 0; i < 62; i++) { ffserver_get_arg(arg, sizeof(arg), p); if (!arg[0]) break; feed->child_argv[i] = av_strdup(arg); if (!feed->child_argv[i]) return AVERROR(ENOMEM); } feed->child_argv[i] = av_asprintf(""http://%s:%d/%s"", (config->http_addr.sin_addr.s_addr == INADDR_ANY) ? ""127.0.0.1"" : inet_ntoa(config->http_addr.sin_addr), ntohs(config->http_addr.sin_port), feed->filename); if (!feed->child_argv[i]) return AVERROR(ENOMEM); } else if (!av_strcasecmp(cmd, ""ACL"")) { ffserver_parse_acl_row(NULL, feed, NULL, *p, config->filename, config->line_num); } else if (!av_strcasecmp(cmd, ""File"") || !av_strcasecmp(cmd, ""ReadOnlyFile"")) { ffserver_get_arg(feed->feed_filename, sizeof(feed->feed_filename), p); feed->readonly = !av_strcasecmp(cmd, ""ReadOnlyFile""); } else if (!av_strcasecmp(cmd, ""Truncate"")) { ffserver_get_arg(arg, sizeof(arg), p); /* assume Truncate is true in case no argument is specified */ if (!arg[0]) { feed->truncate = 1; } else { WARNING(""Truncate N syntax in configuration file is deprecated, "" ""use Truncate alone with no arguments\n""); feed->truncate = strtod(arg, NULL); } } else if (!av_strcasecmp(cmd, ""FileMaxSize"")) { char *p1; double fsize; ffserver_get_arg(arg, sizeof(arg), p); p1 = arg; fsize = strtod(p1, &p1); switch(av_toupper(*p1)) { case 'K': fsize *= 1024; break; case 'M': fsize *= 1024 * 1024; break; case 'G': fsize *= 1024 * 1024 * 1024; break; default: ERROR(""Invalid file size: %s\n"", arg); break; } feed->feed_max_size = (int64_t)fsize; if (feed->feed_max_size < FFM_PACKET_SIZE*4) ERROR(""Feed max file size is too small, must be at least %d\n"", FFM_PACKET_SIZE*4); } else if (!av_strcasecmp(cmd, ""</Feed>"")) { *pfeed = NULL; } else { ERROR(""Invalid entry '%s' inside <Feed></Feed>\n"", cmd); } return 0; }","Yes, it is vulnerable."351349,"static void build_feed_streams(void) { FFServerStream *stream, *feed; int i; /* gather all streams */ for(stream = config.first_stream; stream; stream = stream->next) { feed = stream->feed; if (feed) { if (stream->is_feed) { for(i=0;i<stream->nb_streams;i++) stream->feed_streams[i] = i; } else { /* we handle a stream coming from a feed */ for(i=0;i<stream->nb_streams;i++) stream->feed_streams[i] = add_av_stream(feed, stream->streams[i]); } } } /* create feed files if needed */ for(feed = config.first_feed; feed; feed = feed->next_feed) { int fd; if (avio_check(feed->feed_filename, AVIO_FLAG_READ) > 0) { /* See if it matches */ AVFormatContext *s = NULL; int matches = 0; if (avformat_open_input(&s, feed->feed_filename, NULL, NULL) >= 0) { /* set buffer size */ ffio_set_buf_size(s->pb, FFM_PACKET_SIZE); /* Now see if it matches */ if (s->nb_streams == feed->nb_streams) { matches = 1; for(i=0;i<s->nb_streams;i++) { AVStream *sf, *ss; sf = feed->streams[i]; ss = s->streams[i]; if (sf->index != ss->index || sf->id != ss->id) { http_log(""Index & Id do not match for stream %d (%s)\n"", i, feed->feed_filename); matches = 0; } else { AVCodecContext *ccf, *ccs; ccf = sf->codec; ccs = ss->codec; #define CHECK_CODEC(x) (ccf->x != ccs->x) if (CHECK_CODEC(codec_id) || CHECK_CODEC(codec_type)) { http_log(""Codecs do not match for stream %d\n"", i); matches = 0; } else if (CHECK_CODEC(bit_rate) || CHECK_CODEC(flags)) { http_log(""Codec bitrates do not match for stream %d\n"", i); matches = 0; } else if (ccf->codec_type == AVMEDIA_TYPE_VIDEO) { if (CHECK_CODEC(time_base.den) || CHECK_CODEC(time_base.num) || CHECK_CODEC(width) || CHECK_CODEC(height)) { http_log(""Codec width, height and framerate do not match for stream %d\n"", i); matches = 0; } } else if (ccf->codec_type == AVMEDIA_TYPE_AUDIO) { if (CHECK_CODEC(sample_rate) || CHECK_CODEC(channels) || CHECK_CODEC(frame_size)) { http_log(""Codec sample_rate, channels, frame_size do not match for stream %d\n"", i); matches = 0; } } else { http_log(""Unknown codec type\n""); matches = 0; } } if (!matches) break; } } else http_log(""Deleting feed file '%s' as stream counts differ (%d != %d)\n"", feed->feed_filename, s->nb_streams, feed->nb_streams); avformat_close_input(&s); } else http_log(""Deleting feed file '%s' as it appears to be corrupt\n"", feed->feed_filename); if (!matches) { if (feed->readonly) { http_log(""Unable to delete feed file '%s' as it is marked readonly\n"", feed->feed_filename); exit(1); } unlink(feed->feed_filename); } } if (avio_check(feed->feed_filename, AVIO_FLAG_WRITE) <= 0) { AVFormatContext *s = avformat_alloc_context(); if (!s) { http_log(""Failed to allocate context\n""); exit(1); } if (feed->readonly) { http_log(""Unable to create feed file '%s' as it is marked readonly\n"", feed->feed_filename); exit(1); } /* only write the header of the ffm file */ if (avio_open(&s->pb, feed->feed_filename, AVIO_FLAG_WRITE) < 0) { http_log(""Could not open output feed file '%s'\n"", feed->feed_filename); exit(1); } s->oformat = feed->fmt; s->nb_streams = feed->nb_streams; s->streams = feed->streams; if (avformat_write_header(s, NULL) < 0) { http_log(""Container doesn't support the required parameters\n""); exit(1); } /* XXX: need better API */ av_freep(&s->priv_data); avio_closep(&s->pb); s->streams = NULL; s->nb_streams = 0; avformat_free_context(s); } /* get feed size and write index */ fd = open(feed->feed_filename, O_RDONLY); if (fd < 0) { http_log(""Could not open output feed file '%s'\n"", feed->feed_filename); exit(1); } feed->feed_write_index = FFMAX(ffm_read_write_index(fd), FFM_PACKET_SIZE); feed->feed_size = lseek(fd, 0, SEEK_END); /* ensure that we do not wrap before the end of file */ if (feed->feed_max_size && feed->feed_max_size < feed->feed_size) feed->feed_max_size = feed->feed_size; close(fd); } }","Yes, it is vulnerable."352350,"static void virtio_balloon_device_realize(DeviceState *dev, Error **errp) { VirtIODevice *vdev = VIRTIO_DEVICE(dev); VirtIOBalloon *s = VIRTIO_BALLOON(dev); int ret; virtio_init(vdev, ""virtio-balloon"", VIRTIO_ID_BALLOON, sizeof(struct virtio_balloon_config)); ret = qemu_add_balloon_handler(virtio_balloon_to_target, virtio_balloon_stat, s); if (ret < 0) { error_setg(errp, ""Adding balloon handler failed""); virtio_cleanup(vdev); return; } s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats); reset_stats(s); register_savevm(dev, ""virtio-balloon"", -1, 1, virtio_balloon_save, virtio_balloon_load, s); object_property_add(OBJECT(dev), ""guest-stats"", ""guest statistics"", balloon_stats_get_all, NULL, NULL, s, NULL); object_property_add(OBJECT(dev), ""guest-stats-polling-interval"", ""int"", balloon_stats_get_poll_interval, balloon_stats_set_poll_interval, NULL, s, NULL); }","Yes, it is vulnerable."353351,"static inline void RENAME(LEToUV)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused) { #if COMPILE_TEMPLATE_MMX __asm__ volatile( ""mov %0, %%""REG_a"" \n\t"" ""1: \n\t"" ""movq (%1, %%""REG_a"",2), %%mm0 \n\t"" ""movq 8(%1, %%""REG_a"",2), %%mm1 \n\t"" ""movq (%2, %%""REG_a"",2), %%mm2 \n\t"" ""movq 8(%2, %%""REG_a"",2), %%mm3 \n\t"" ""psrlw $8, %%mm0 \n\t"" ""psrlw $8, %%mm1 \n\t"" ""psrlw $8, %%mm2 \n\t"" ""psrlw $8, %%mm3 \n\t"" ""packuswb %%mm1, %%mm0 \n\t"" ""packuswb %%mm3, %%mm2 \n\t"" ""movq %%mm0, (%3, %%""REG_a"") \n\t"" ""movq %%mm2, (%4, %%""REG_a"") \n\t"" ""add $8, %%""REG_a"" \n\t"" "" js 1b \n\t"" : : ""g"" ((x86_reg)-width), ""r"" (src1+width*2), ""r"" (src2+width*2), ""r"" (dstU+width), ""r"" (dstV+width) : ""%""REG_a ); #else int i; for (i=0; i<width; i++) { dstU[i]= src1[2*i + 1]; dstV[i]= src2[2*i + 1]; } #endif }","Yes, it is vulnerable."354352,"static int qcow_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info) { BDRVQcowState *s = bs->opaque; QCowSnapshot *snapshots1, sn1, *sn = &sn1; int i, ret; uint64_t *l1_table = NULL; memset(sn, 0, sizeof(*sn)); if (sn_info->id_str[0] == '\0') { /* compute a new id */ find_new_snapshot_id(bs, sn_info->id_str, sizeof(sn_info->id_str)); } /* check that the ID is unique */ if (find_snapshot_by_id(bs, sn_info->id_str) >= 0) return -ENOENT; sn->id_str = qemu_strdup(sn_info->id_str); if (!sn->id_str) goto fail; sn->name = qemu_strdup(sn_info->name); if (!sn->name) goto fail; sn->vm_state_size = sn_info->vm_state_size; sn->date_sec = sn_info->date_sec; sn->date_nsec = sn_info->date_nsec; sn->vm_clock_nsec = sn_info->vm_clock_nsec; ret = update_snapshot_refcount(bs, s->l1_table_offset, s->l1_size, 1); if (ret < 0) goto fail; /* create the L1 table of the snapshot */ sn->l1_table_offset = alloc_clusters(bs, s->l1_size * sizeof(uint64_t)); sn->l1_size = s->l1_size; l1_table = qemu_malloc(s->l1_size * sizeof(uint64_t)); if (!l1_table) goto fail; for(i = 0; i < s->l1_size; i++) { l1_table[i] = cpu_to_be64(s->l1_table[i]); } if (bdrv_pwrite(s->hd, sn->l1_table_offset, l1_table, s->l1_size * sizeof(uint64_t)) != (s->l1_size * sizeof(uint64_t))) goto fail; qemu_free(l1_table); l1_table = NULL; snapshots1 = qemu_malloc((s->nb_snapshots + 1) * sizeof(QCowSnapshot)); if (!snapshots1) goto fail; memcpy(snapshots1, s->snapshots, s->nb_snapshots * sizeof(QCowSnapshot)); s->snapshots = snapshots1; s->snapshots[s->nb_snapshots++] = *sn; if (qcow_write_snapshots(bs) < 0) goto fail; #ifdef DEBUG_ALLOC check_refcounts(bs); #endif return 0; fail: qemu_free(sn->name); qemu_free(l1_table); return -1; }","Yes, it is vulnerable."355353,"static int resize_peers(IVShmemState *s, int new_min_size) { int j, old_size; /* limit number of max peers */ if (new_min_size <= 0 || new_min_size > IVSHMEM_MAX_PEERS) { return -1; } if (new_min_size <= s->nb_peers) { return 0; } old_size = s->nb_peers; s->nb_peers = new_min_size; IVSHMEM_DPRINTF(""bumping storage to %d peers\n"", s->nb_peers); s->peers = g_realloc(s->peers, s->nb_peers * sizeof(Peer)); for (j = old_size; j < s->nb_peers; j++) { s->peers[j].eventfds = g_new0(EventNotifier, s->vectors); s->peers[j].nb_eventfds = 0; } return 0; }","Yes, it is vulnerable."356354,"static int s390_virtio_blk_init(VirtIOS390Device *s390_dev) { VirtIOBlkS390 *dev = VIRTIO_BLK_S390(s390_dev); DeviceState *vdev = DEVICE(&dev->vdev); virtio_blk_set_conf(vdev, &(dev->blk)); qdev_set_parent_bus(vdev, BUS(&s390_dev->bus)); if (qdev_init(vdev) < 0) { return -1; } return s390_virtio_device_init(s390_dev, VIRTIO_DEVICE(vdev)); }","Yes, it is vulnerable."357355,"static void aarch64_cpu_class_init(ObjectClass *oc, void *data) { CPUClass *cc = CPU_CLASS(oc); cc->dump_state = aarch64_cpu_dump_state; cc->set_pc = aarch64_cpu_set_pc; cc->gdb_read_register = aarch64_cpu_gdb_read_register; cc->gdb_write_register = aarch64_cpu_gdb_write_register; cc->gdb_num_core_regs = 34; cc->gdb_core_xml_file = ""aarch64-core.xml""; }","Yes, it is vulnerable."358356,"void ppc_hw_interrupt(CPUPPCState *env) { PowerPCCPU *cpu = ppc_env_get_cpu(env); int hdice; #if 0 CPUState *cs = CPU(cpu); qemu_log_mask(CPU_LOG_INT, ""%s: %p pending %08x req %08x me %d ee %d\n"", __func__, env, env->pending_interrupts, cs->interrupt_request, (int)msr_me, (int)msr_ee); #endif /* External reset */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_RESET)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_RESET); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_RESET); return; } /* Machine check exception */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_MCK)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_MCK); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_MCHECK); return; } #if 0 /* TODO */ /* External debug exception */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_DEBUG)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DEBUG); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DEBUG); return; } #endif if (0) { /* XXX: find a suitable condition to enable the hypervisor mode */ hdice = env->spr[SPR_LPCR] & 1; } else { hdice = 0; } if ((msr_ee != 0 || msr_hv == 0 || msr_pr != 0) && hdice != 0) { /* Hypervisor decrementer exception */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_HDECR)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_HDECR); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_HDECR); return; } } if (msr_ce != 0) { /* External critical interrupt */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_CEXT)) { /* Taking a critical external interrupt does not clear the external * critical interrupt status */ #if 0 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CEXT); #endif powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_CRITICAL); return; } } if (msr_ee != 0) { /* Watchdog timer on embedded PowerPC */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_WDT)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_WDT); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_WDT); return; } if (env->pending_interrupts & (1 << PPC_INTERRUPT_CDOORBELL)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_CDOORBELL); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DOORCI); return; } /* Fixed interval timer on embedded PowerPC */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_FIT)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_FIT); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_FIT); return; } /* Programmable interval timer on embedded PowerPC */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_PIT)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PIT); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_PIT); return; } /* Decrementer exception */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_DECR)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DECR); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DECR); return; } /* External interrupt */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_EXT)) { /* Taking an external interrupt does not clear the external * interrupt status */ #if 0 env->pending_interrupts &= ~(1 << PPC_INTERRUPT_EXT); #endif powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_EXTERNAL); return; } if (env->pending_interrupts & (1 << PPC_INTERRUPT_DOORBELL)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_DOORBELL); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_DOORI); return; } if (env->pending_interrupts & (1 << PPC_INTERRUPT_PERFM)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_PERFM); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_PERFM); return; } /* Thermal interrupt */ if (env->pending_interrupts & (1 << PPC_INTERRUPT_THERM)) { env->pending_interrupts &= ~(1 << PPC_INTERRUPT_THERM); powerpc_excp(cpu, env->excp_model, POWERPC_EXCP_THERM); return; } } }","No, it is non-vulnerable."359357,"static int mjpeg_decode_dht(MJpegDecodeContext *s) { int len, index, i, class, n, v, code_max; uint8_t bits_table[17]; uint8_t val_table[256]; len = get_bits(&s->gb, 16) - 2; while (len > 0) { if (len < 17) return -1; class = get_bits(&s->gb, 4); if (class >= 2) return -1; index = get_bits(&s->gb, 4); if (index >= 4) return -1; n = 0; for(i=1;i<=16;i++) { bits_table[i] = get_bits(&s->gb, 8); n += bits_table[i]; } len -= 17; if (len < n || n > 256) return -1; code_max = 0; for(i=0;i<n;i++) { v = get_bits(&s->gb, 8); if (v > code_max) code_max = v; val_table[i] = v; } len -= n; /* build VLC and flush previous vlc if present */ free_vlc(&s->vlcs[class][index]); dprintf(""class=%d index=%d nb_codes=%d\n"", class, index, code_max + 1); build_vlc(&s->vlcs[class][index], bits_table, val_table, code_max + 1); } return 0; }","No, it is non-vulnerable."360358,"static int usb_net_handle_dataout(USBNetState *s, USBPacket *p) { int ret = p->len; int sz = sizeof(s->out_buf) - s->out_ptr; struct rndis_packet_msg_type *msg = (struct rndis_packet_msg_type *) s->out_buf; uint32_t len; #ifdef TRAFFIC_DEBUG fprintf(stderr, ""usbnet: data out len %u\n"", p->len); { int i; fprintf(stderr, "":""); for (i = 0; i < p->len; i++) { if (!(i & 15)) fprintf(stderr, ""\n%04x:"", i); fprintf(stderr, "" %02x"", p->data[i]); } fprintf(stderr, ""\n\n""); } #endif if (sz > ret) sz = ret; memcpy(&s->out_buf[s->out_ptr], p->data, sz); s->out_ptr += sz; if (!s->rndis) { if (ret < 64) { qemu_send_packet(&s->nic->nc, s->out_buf, s->out_ptr); s->out_ptr = 0; } return ret; } len = le32_to_cpu(msg->MessageLength); if (s->out_ptr < 8 || s->out_ptr < len) return ret; if (le32_to_cpu(msg->MessageType) == RNDIS_PACKET_MSG) { uint32_t offs = 8 + le32_to_cpu(msg->DataOffset); uint32_t size = le32_to_cpu(msg->DataLength); if (offs + size <= len) qemu_send_packet(&s->nic->nc, s->out_buf + offs, size); } s->out_ptr -= len; memmove(s->out_buf, &s->out_buf[len], s->out_ptr); return ret; }","No, it is non-vulnerable."361359,int bdrv_get_backing_file_depth(BlockDriverState *bs) { if (!bs->drv) { return 0; } if (!bs->backing_hd) { return 0; } return 1 + bdrv_get_backing_file_depth(bs->backing_hd); },"No, it is non-vulnerable."362360,"static int parallels_create(const char *filename, QemuOpts *opts, Error **errp) { int64_t total_size, cl_size; uint8_t tmp[BDRV_SECTOR_SIZE]; Error *local_err = NULL; BlockDriverState *file; uint32_t cat_entries, cat_sectors; ParallelsHeader header; int ret; total_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0), BDRV_SECTOR_SIZE); cl_size = ROUND_UP(qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE, DEFAULT_CLUSTER_SIZE), BDRV_SECTOR_SIZE); ret = bdrv_create_file(filename, opts, &local_err); if (ret < 0) { error_propagate(errp, local_err); return ret; } file = NULL; ret = bdrv_open(&file, filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL, NULL, &local_err); if (ret < 0) { error_propagate(errp, local_err); return ret; } ret = bdrv_truncate(file, 0); if (ret < 0) { goto exit; } cat_entries = DIV_ROUND_UP(total_size, cl_size); cat_sectors = DIV_ROUND_UP(cat_entries * sizeof(uint32_t) + sizeof(ParallelsHeader), cl_size); cat_sectors = (cat_sectors * cl_size) >> BDRV_SECTOR_BITS; memset(&header, 0, sizeof(header)); memcpy(header.magic, HEADER_MAGIC2, sizeof(header.magic)); header.version = cpu_to_le32(HEADER_VERSION); /* don't care much about geometry, it is not used on image level */ header.heads = cpu_to_le32(16); header.cylinders = cpu_to_le32(total_size / BDRV_SECTOR_SIZE / 16 / 32); header.tracks = cpu_to_le32(cl_size >> BDRV_SECTOR_BITS); header.catalog_entries = cpu_to_le32(cat_entries); header.nb_sectors = cpu_to_le64(DIV_ROUND_UP(total_size, BDRV_SECTOR_SIZE)); header.data_off = cpu_to_le32(cat_sectors); /* write all the data */ memset(tmp, 0, sizeof(tmp)); memcpy(tmp, &header, sizeof(header)); ret = bdrv_pwrite(file, 0, tmp, BDRV_SECTOR_SIZE); if (ret < 0) { goto exit; } ret = bdrv_write_zeroes(file, 1, cat_sectors - 1, 0); if (ret < 0) { goto exit; } ret = 0; done: bdrv_unref(file); return ret; exit: error_setg_errno(errp, -ret, ""Failed to create Parallels image""); goto done; }","No, it is non-vulnerable."363361,"static void pxa2xx_pwrmode_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { PXA2xxState *s = (PXA2xxState *)ri->opaque; static const char *pwrmode[8] = { ""Normal"", ""Idle"", ""Deep-idle"", ""Standby"", ""Sleep"", ""reserved (!)"", ""reserved (!)"", ""Deep-sleep"", }; if (value & 8) { printf(""%s: CPU voltage change attempt\n"", __func__); } switch (value & 7) { case 0: /* Do nothing */ break; case 1: /* Idle */ if (!(s->cm_regs[CCCR >> 2] & (1U << 31))) { /* CPDIS */ cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT); break; } /* Fall through. */ case 2: /* Deep-Idle */ cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_HALT); s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */ goto message; case 3: s->cpu->env.uncached_cpsr = ARM_CPU_MODE_SVC; s->cpu->env.daif = PSTATE_A | PSTATE_F | PSTATE_I; s->cpu->env.cp15.sctlr_ns = 0; s->cpu->env.cp15.c1_coproc = 0; s->cpu->env.cp15.ttbr0_el[1] = 0; s->cpu->env.cp15.c3 = 0; s->pm_regs[PSSR >> 2] |= 0x8; /* Set STS */ s->pm_regs[RCSR >> 2] |= 0x8; /* Set GPR */ /* * The scratch-pad register is almost universally used * for storing the return address on suspend. For the * lack of a resuming bootloader, perform a jump * directly to that address. */ memset(s->cpu->env.regs, 0, 4 * 15); s->cpu->env.regs[15] = s->pm_regs[PSPR >> 2]; #if 0 buffer = 0xe59ff000; /* ldr pc, [pc, #0] */ cpu_physical_memory_write(0, &buffer, 4); buffer = s->pm_regs[PSPR >> 2]; cpu_physical_memory_write(8, &buffer, 4); #endif /* Suspend */ cpu_interrupt(current_cpu, CPU_INTERRUPT_HALT); goto message; default: message: printf(""%s: machine entered %s mode\n"", __func__, pwrmode[value & 7]); } }","No, it is non-vulnerable."364362,"static void hmp_change_read_arg(Monitor *mon, const char *password, void *opaque) { qmp_change_vnc_password(password, NULL); monitor_read_command(mon, 1); }","No, it is non-vulnerable."365363,"static int readv_f(int argc, char **argv) { struct timeval t1, t2; int Cflag = 0, qflag = 0, vflag = 0; int c, cnt; char *buf; int64_t offset; /* Some compilers get confused and warn if this is not initialized. */ int total = 0; int nr_iov; QEMUIOVector qiov; int pattern = 0; int Pflag = 0; while ((c = getopt(argc, argv, ""CP:qv"")) != EOF) { switch (c) { case 'C': Cflag = 1; break; case 'P': Pflag = 1; pattern = parse_pattern(optarg); if (pattern < 0) { return 0; } break; case 'q': qflag = 1; break; case 'v': vflag = 1; break; default: return command_usage(&readv_cmd); } } if (optind > argc - 2) { return command_usage(&readv_cmd); } offset = cvtnum(argv[optind]); if (offset < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } optind++; if (offset & 0x1ff) { printf(""offset %"" PRId64 "" is not sector aligned\n"", offset); return 0; } nr_iov = argc - optind; buf = create_iovec(&qiov, &argv[optind], nr_iov, 0xab); if (buf == NULL) { return 0; } gettimeofday(&t1, NULL); cnt = do_aio_readv(&qiov, offset, &total); gettimeofday(&t2, NULL); if (cnt < 0) { printf(""readv failed: %s\n"", strerror(-cnt)); goto out; } if (Pflag) { void *cmp_buf = g_malloc(qiov.size); memset(cmp_buf, pattern, qiov.size); if (memcmp(buf, cmp_buf, qiov.size)) { printf(""Pattern verification failed at offset %"" PRId64 "", %zd bytes\n"", offset, qiov.size); } g_free(cmp_buf); } if (qflag) { goto out; } if (vflag) { dump_buffer(buf, offset, qiov.size); } /* Finally, report back -- -C gives a parsable format */ t2 = tsub(t2, t1); print_report(""read"", &t2, offset, qiov.size, total, cnt, Cflag); out: qemu_io_free(buf); return 0; }","Yes, it is vulnerable."366364,"ssize_t pcnet_receive(NetClientState *nc, const uint8_t *buf, size_t size_) { PCNetState *s = qemu_get_nic_opaque(nc); int is_padr = 0, is_bcast = 0, is_ladr = 0; uint8_t buf1[60]; int remaining; int crc_err = 0; int size = size_; if (CSR_DRX(s) || CSR_STOP(s) || CSR_SPND(s) || !size || (CSR_LOOP(s) && !s->looptest)) { return -1; } #ifdef PCNET_DEBUG printf(""pcnet_receive size=%d\n"", size); #endif /* if too small buffer, then expand it */ if (size < MIN_BUF_SIZE) { memcpy(buf1, buf, size); memset(buf1 + size, 0, MIN_BUF_SIZE - size); buf = buf1; size = MIN_BUF_SIZE; } if (CSR_PROM(s) || (is_padr=padr_match(s, buf, size)) || (is_bcast=padr_bcast(s, buf, size)) || (is_ladr=ladr_match(s, buf, size))) { pcnet_rdte_poll(s); if (!(CSR_CRST(s) & 0x8000) && s->rdra) { struct pcnet_RMD rmd; int rcvrc = CSR_RCVRC(s)-1,i; hwaddr nrda; for (i = CSR_RCVRL(s)-1; i > 0; i--, rcvrc--) { if (rcvrc <= 1) rcvrc = CSR_RCVRL(s); nrda = s->rdra + (CSR_RCVRL(s) - rcvrc) * (BCR_SWSTYLE(s) ? 16 : 8 ); RMDLOAD(&rmd, nrda); if (GET_FIELD(rmd.status, RMDS, OWN)) { #ifdef PCNET_DEBUG_RMD printf(""pcnet - scan buffer: RCVRC=%d PREV_RCVRC=%d\n"", rcvrc, CSR_RCVRC(s)); #endif CSR_RCVRC(s) = rcvrc; pcnet_rdte_poll(s); break; } } } if (!(CSR_CRST(s) & 0x8000)) { #ifdef PCNET_DEBUG_RMD printf(""pcnet - no buffer: RCVRC=%d\n"", CSR_RCVRC(s)); #endif s->csr[0] |= 0x1000; /* Set MISS flag */ CSR_MISSC(s)++; } else { uint8_t *src = s->buffer; hwaddr crda = CSR_CRDA(s); struct pcnet_RMD rmd; int pktcount = 0; if (!s->looptest) { memcpy(src, buf, size); /* no need to compute the CRC */ src[size] = 0; src[size + 1] = 0; src[size + 2] = 0; src[size + 3] = 0; size += 4; } else if (s->looptest == PCNET_LOOPTEST_CRC || !CSR_DXMTFCS(s) || size < MIN_BUF_SIZE+4) { uint32_t fcs = ~0; uint8_t *p = src; while (p != &src[size]) CRC(fcs, *p++); *(uint32_t *)p = htonl(fcs); size += 4; } else { uint32_t fcs = ~0; uint8_t *p = src; while (p != &src[size-4]) CRC(fcs, *p++); crc_err = (*(uint32_t *)p != htonl(fcs)); } #ifdef PCNET_DEBUG_MATCH PRINT_PKTHDR(buf); #endif RMDLOAD(&rmd, PHYSADDR(s,crda)); /*if (!CSR_LAPPEN(s))*/ SET_FIELD(&rmd.status, RMDS, STP, 1); #define PCNET_RECV_STORE() do { \ int count = MIN(4096 - GET_FIELD(rmd.buf_length, RMDL, BCNT),remaining); \ hwaddr rbadr = PHYSADDR(s, rmd.rbadr); \ s->phys_mem_write(s->dma_opaque, rbadr, src, count, CSR_BSWP(s)); \ src += count; remaining -= count; \ SET_FIELD(&rmd.status, RMDS, OWN, 0); \ RMDSTORE(&rmd, PHYSADDR(s,crda)); \ pktcount++; \ } while (0) remaining = size; PCNET_RECV_STORE(); if ((remaining > 0) && CSR_NRDA(s)) { hwaddr nrda = CSR_NRDA(s); #ifdef PCNET_DEBUG_RMD PRINT_RMD(&rmd); #endif RMDLOAD(&rmd, PHYSADDR(s,nrda)); if (GET_FIELD(rmd.status, RMDS, OWN)) { crda = nrda; PCNET_RECV_STORE(); #ifdef PCNET_DEBUG_RMD PRINT_RMD(&rmd); #endif if ((remaining > 0) && (nrda=CSR_NNRD(s))) { RMDLOAD(&rmd, PHYSADDR(s,nrda)); if (GET_FIELD(rmd.status, RMDS, OWN)) { crda = nrda; PCNET_RECV_STORE(); } } } } #undef PCNET_RECV_STORE RMDLOAD(&rmd, PHYSADDR(s,crda)); if (remaining == 0) { SET_FIELD(&rmd.msg_length, RMDM, MCNT, size); SET_FIELD(&rmd.status, RMDS, ENP, 1); SET_FIELD(&rmd.status, RMDS, PAM, !CSR_PROM(s) && is_padr); SET_FIELD(&rmd.status, RMDS, LFAM, !CSR_PROM(s) && is_ladr); SET_FIELD(&rmd.status, RMDS, BAM, !CSR_PROM(s) && is_bcast); if (crc_err) { SET_FIELD(&rmd.status, RMDS, CRC, 1); SET_FIELD(&rmd.status, RMDS, ERR, 1); } } else { SET_FIELD(&rmd.status, RMDS, OFLO, 1); SET_FIELD(&rmd.status, RMDS, BUFF, 1); SET_FIELD(&rmd.status, RMDS, ERR, 1); } RMDSTORE(&rmd, PHYSADDR(s,crda)); s->csr[0] |= 0x0400; #ifdef PCNET_DEBUG printf(""RCVRC=%d CRDA=0x%08x BLKS=%d\n"", CSR_RCVRC(s), PHYSADDR(s,CSR_CRDA(s)), pktcount); #endif #ifdef PCNET_DEBUG_RMD PRINT_RMD(&rmd); #endif while (pktcount--) { if (CSR_RCVRC(s) <= 1) CSR_RCVRC(s) = CSR_RCVRL(s); else CSR_RCVRC(s)--; } pcnet_rdte_poll(s); } } pcnet_poll(s); pcnet_update_irq(s); return size_; }","Yes, it is vulnerable."367365,"static bool pcie_has_upstream_port(PCIDevice *dev) { PCIDevice *parent_dev = pci_bridge_get_device(dev->bus); /* Device associated with an upstream port. * As there are several types of these, it's easier to check the * parent device: upstream ports are always connected to * root or downstream ports. */ return parent_dev && pci_is_express(parent_dev) && parent_dev->exp.exp_cap && (pcie_cap_get_type(parent_dev) == PCI_EXP_TYPE_ROOT_PORT || pcie_cap_get_type(parent_dev) == PCI_EXP_TYPE_DOWNSTREAM); }","No, it is non-vulnerable."368366,"int ff_mov_read_stsd_entries(MOVContext *c, AVIOContext *pb, int entries) { AVStream *st; MOVStreamContext *sc; int j, pseudo_stream_id; if (c->fc->nb_streams < 1) return 0; st = c->fc->streams[c->fc->nb_streams-1]; sc = st->priv_data; for (pseudo_stream_id=0; pseudo_stream_id<entries; pseudo_stream_id++) { //Parsing Sample description table enum AVCodecID id; int dref_id = 1; MOVAtom a = { AV_RL32(""stsd"") }; int64_t start_pos = avio_tell(pb); int size = avio_rb32(pb); /* size */ uint32_t format = avio_rl32(pb); /* data format */ if (size >= 16) { avio_rb32(pb); /* reserved */ avio_rb16(pb); /* reserved */ dref_id = avio_rb16(pb); } if (st->codec->codec_tag && st->codec->codec_tag != format && (c->fc->video_codec_id ? ff_codec_get_id(ff_codec_movvideo_tags, format) != c->fc->video_codec_id : st->codec->codec_tag != MKTAG('j','p','e','g')) ){ /* Multiple fourcc, we skip JPEG. This is not correct, we should * export it as a separate AVStream but this needs a few changes * in the MOV demuxer, patch welcome. */ multiple_stsd: av_log(c->fc, AV_LOG_WARNING, ""multiple fourcc not supported\n""); avio_skip(pb, size - (avio_tell(pb) - start_pos)); continue; } /* we cannot demux concatenated h264 streams because of different extradata */ if (st->codec->codec_tag && st->codec->codec_tag == AV_RL32(""avc1"")) goto multiple_stsd; sc->pseudo_stream_id = st->codec->codec_tag ? -1 : pseudo_stream_id; sc->dref_id= dref_id; st->codec->codec_tag = format; id = ff_codec_get_id(ff_codec_movaudio_tags, format); if (id<=0 && ((format&0xFFFF) == 'm'+('s'<<8) || (format&0xFFFF) == 'T'+('S'<<8))) id = ff_codec_get_id(ff_codec_wav_tags, av_bswap32(format)&0xFFFF); if (st->codec->codec_type != AVMEDIA_TYPE_VIDEO && id > 0) { st->codec->codec_type = AVMEDIA_TYPE_AUDIO; } else if (st->codec->codec_type != AVMEDIA_TYPE_AUDIO && /* do not overwrite codec type */ format && format != MKTAG('m','p','4','s')) { /* skip old asf mpeg4 tag */ id = ff_codec_get_id(ff_codec_movvideo_tags, format); if (id <= 0) id = ff_codec_get_id(ff_codec_bmp_tags, format); if (id > 0) st->codec->codec_type = AVMEDIA_TYPE_VIDEO; else if (st->codec->codec_type == AVMEDIA_TYPE_DATA){ id = ff_codec_get_id(ff_codec_movsubtitle_tags, format); if (id > 0) st->codec->codec_type = AVMEDIA_TYPE_SUBTITLE; } } av_dlog(c->fc, ""size=%d 4CC= %c%c%c%c codec_type=%d\n"", size, (format >> 0) & 0xff, (format >> 8) & 0xff, (format >> 16) & 0xff, (format >> 24) & 0xff, st->codec->codec_type); if (st->codec->codec_type==AVMEDIA_TYPE_VIDEO) { unsigned int color_depth, len; int color_greyscale; int color_table_id; st->codec->codec_id = id; avio_rb16(pb); /* version */ avio_rb16(pb); /* revision level */ avio_rb32(pb); /* vendor */ avio_rb32(pb); /* temporal quality */ avio_rb32(pb); /* spatial quality */ st->codec->width = avio_rb16(pb); /* width */ st->codec->height = avio_rb16(pb); /* height */ avio_rb32(pb); /* horiz resolution */ avio_rb32(pb); /* vert resolution */ avio_rb32(pb); /* data size, always 0 */ avio_rb16(pb); /* frames per samples */ len = avio_r8(pb); /* codec name, pascal string */ if (len > 31) len = 31; mov_read_mac_string(c, pb, len, st->codec->codec_name, 32); if (len < 31) avio_skip(pb, 31 - len); /* codec_tag YV12 triggers an UV swap in rawdec.c */ if (!memcmp(st->codec->codec_name, ""Planar Y'CbCr 8-bit 4:2:0"", 25)) st->codec->codec_tag=MKTAG('I', '4', '2', '0'); st->codec->bits_per_coded_sample = avio_rb16(pb); /* depth */ color_table_id = avio_rb16(pb); /* colortable id */ av_dlog(c->fc, ""depth %d, ctab id %d\n"", st->codec->bits_per_coded_sample, color_table_id); /* figure out the palette situation */ color_depth = st->codec->bits_per_coded_sample & 0x1F; color_greyscale = st->codec->bits_per_coded_sample & 0x20; /* if the depth is 2, 4, or 8 bpp, file is palettized */ if ((color_depth == 2) || (color_depth == 4) || (color_depth == 8)) { /* for palette traversal */ unsigned int color_start, color_count, color_end; unsigned char r, g, b; if (color_greyscale) { int color_index, color_dec; /* compute the greyscale palette */ st->codec->bits_per_coded_sample = color_depth; color_count = 1 << color_depth; color_index = 255; color_dec = 256 / (color_count - 1); for (j = 0; j < color_count; j++) { r = g = b = color_index; sc->palette[j] = (r << 16) | (g << 8) | (b); color_index -= color_dec; if (color_index < 0) color_index = 0; } } else if (color_table_id) { const uint8_t *color_table; /* if flag bit 3 is set, use the default palette */ color_count = 1 << color_depth; if (color_depth == 2) color_table = ff_qt_default_palette_4; else if (color_depth == 4) color_table = ff_qt_default_palette_16; else color_table = ff_qt_default_palette_256; for (j = 0; j < color_count; j++) { r = color_table[j * 3 + 0]; g = color_table[j * 3 + 1]; b = color_table[j * 3 + 2]; sc->palette[j] = (r << 16) | (g << 8) | (b); } } else { /* load the palette from the file */ color_start = avio_rb32(pb); color_count = avio_rb16(pb); color_end = avio_rb16(pb); if ((color_start <= 255) && (color_end <= 255)) { for (j = color_start; j <= color_end; j++) { /* each R, G, or B component is 16 bits; * only use the top 8 bits; skip alpha bytes * up front */ avio_r8(pb); avio_r8(pb); r = avio_r8(pb); avio_r8(pb); g = avio_r8(pb); avio_r8(pb); b = avio_r8(pb); avio_r8(pb); sc->palette[j] = (r << 16) | (g << 8) | (b); } } } sc->has_palette = 1; } } else if (st->codec->codec_type==AVMEDIA_TYPE_AUDIO) { int bits_per_sample, flags; uint16_t version = avio_rb16(pb); st->codec->codec_id = id; avio_rb16(pb); /* revision level */ avio_rb32(pb); /* vendor */ st->codec->channels = avio_rb16(pb); /* channel count */ av_dlog(c->fc, ""audio channels %d\n"", st->codec->channels); st->codec->bits_per_coded_sample = avio_rb16(pb); /* sample size */ sc->audio_cid = avio_rb16(pb); avio_rb16(pb); /* packet size = 0 */ st->codec->sample_rate = ((avio_rb32(pb) >> 16)); //Read QT version 1 fields. In version 0 these do not exist. av_dlog(c->fc, ""version =%d, isom =%d\n"",version,c->isom); if (!c->isom) { if (version==1) { sc->samples_per_frame = avio_rb32(pb); avio_rb32(pb); /* bytes per packet */ sc->bytes_per_frame = avio_rb32(pb); avio_rb32(pb); /* bytes per sample */ } else if (version==2) { avio_rb32(pb); /* sizeof struct only */ st->codec->sample_rate = av_int2double(avio_rb64(pb)); /* float 64 */ st->codec->channels = avio_rb32(pb); avio_rb32(pb); /* always 0x7F000000 */ st->codec->bits_per_coded_sample = avio_rb32(pb); /* bits per channel if sound is uncompressed */ flags = avio_rb32(pb); /* lpcm format specific flag */ sc->bytes_per_frame = avio_rb32(pb); /* bytes per audio packet if constant */ sc->samples_per_frame = avio_rb32(pb); /* lpcm frames per audio packet if constant */ if (format == MKTAG('l','p','c','m')) st->codec->codec_id = ff_mov_get_lpcm_codec_id(st->codec->bits_per_coded_sample, flags); } } switch (st->codec->codec_id) { case AV_CODEC_ID_PCM_S8: case AV_CODEC_ID_PCM_U8: if (st->codec->bits_per_coded_sample == 16) st->codec->codec_id = AV_CODEC_ID_PCM_S16BE; break; case AV_CODEC_ID_PCM_S16LE: case AV_CODEC_ID_PCM_S16BE: if (st->codec->bits_per_coded_sample == 8) st->codec->codec_id = AV_CODEC_ID_PCM_S8; else if (st->codec->bits_per_coded_sample == 24) st->codec->codec_id = st->codec->codec_id == AV_CODEC_ID_PCM_S16BE ? AV_CODEC_ID_PCM_S24BE : AV_CODEC_ID_PCM_S24LE; break; /* set values for old format before stsd version 1 appeared */ case AV_CODEC_ID_MACE3: sc->samples_per_frame = 6; sc->bytes_per_frame = 2*st->codec->channels; break; case AV_CODEC_ID_MACE6: sc->samples_per_frame = 6; sc->bytes_per_frame = 1*st->codec->channels; break; case AV_CODEC_ID_ADPCM_IMA_QT: sc->samples_per_frame = 64; sc->bytes_per_frame = 34*st->codec->channels; break; case AV_CODEC_ID_GSM: sc->samples_per_frame = 160; sc->bytes_per_frame = 33; break; default: break; } bits_per_sample = av_get_bits_per_sample(st->codec->codec_id); if (bits_per_sample) { st->codec->bits_per_coded_sample = bits_per_sample; sc->sample_size = (bits_per_sample >> 3) * st->codec->channels; } } else if (st->codec->codec_type==AVMEDIA_TYPE_SUBTITLE){ // ttxt stsd contains display flags, justification, background // color, fonts, and default styles, so fake an atom to read it MOVAtom fake_atom = { .size = size - (avio_tell(pb) - start_pos) }; if (format != AV_RL32(""mp4s"")) // mp4s contains a regular esds atom mov_read_glbl(c, pb, fake_atom); st->codec->codec_id= id; st->codec->width = sc->width; st->codec->height = sc->height; } else { /* other codec type, just skip (rtp, mp4s, tmcd ...) */ avio_skip(pb, size - (avio_tell(pb) - start_pos)); } /* this will read extra atoms at the end (wave, alac, damr, avcC, SMI ...) */ a.size = size - (avio_tell(pb) - start_pos); if (a.size > 8) { int ret; if ((ret = mov_read_default(c, pb, a)) < 0) return ret; } else if (a.size > 0) avio_skip(pb, a.size); } if (st->codec->codec_type==AVMEDIA_TYPE_AUDIO && st->codec->sample_rate==0 && sc->time_scale>1) st->codec->sample_rate= sc->time_scale; /* special codec parameters handling */ switch (st->codec->codec_id) { #if CONFIG_DV_DEMUXER case AV_CODEC_ID_DVAUDIO: c->dv_fctx = avformat_alloc_context(); c->dv_demux = avpriv_dv_init_demux(c->dv_fctx); if (!c->dv_demux) { av_log(c->fc, AV_LOG_ERROR, ""dv demux context init error\n""); return AVERROR(ENOMEM); } sc->dv_audio_container = 1; st->codec->codec_id = AV_CODEC_ID_PCM_S16LE; break; #endif /* no ifdef since parameters are always those */ case AV_CODEC_ID_QCELP: // force sample rate for qcelp when not stored in mov if (st->codec->codec_tag != MKTAG('Q','c','l','p')) st->codec->sample_rate = 8000; st->codec->channels= 1; /* really needed */ break; case AV_CODEC_ID_AMR_NB: st->codec->channels= 1; /* really needed */ /* force sample rate for amr, stsd in 3gp does not store sample rate */ st->codec->sample_rate = 8000; break; case AV_CODEC_ID_AMR_WB: st->codec->channels = 1; st->codec->sample_rate = 16000; break; case AV_CODEC_ID_MP2: case AV_CODEC_ID_MP3: st->codec->codec_type = AVMEDIA_TYPE_AUDIO; /* force type after stsd for m1a hdlr */ st->need_parsing = AVSTREAM_PARSE_FULL; break; case AV_CODEC_ID_GSM: case AV_CODEC_ID_ADPCM_MS: case AV_CODEC_ID_ADPCM_IMA_WAV: case AV_CODEC_ID_ILBC: st->codec->block_align = sc->bytes_per_frame; break; case AV_CODEC_ID_ALAC: if (st->codec->extradata_size == 36) { st->codec->channels = AV_RB8 (st->codec->extradata+21); st->codec->sample_rate = AV_RB32(st->codec->extradata+32); } break; case AV_CODEC_ID_VC1: st->need_parsing = AVSTREAM_PARSE_FULL; break; default: break; } return 0; }","No, it is non-vulnerable."369367,"build_gtdt(GArray *table_data, GArray *linker) { int gtdt_start = table_data->len; AcpiGenericTimerTable *gtdt; gtdt = acpi_data_push(table_data, sizeof *gtdt); /* The interrupt values are the same with the device tree when adding 16 */ gtdt->secure_el1_interrupt = ARCH_TIMER_S_EL1_IRQ + 16; gtdt->secure_el1_flags = ACPI_EDGE_SENSITIVE; gtdt->non_secure_el1_interrupt = ARCH_TIMER_NS_EL1_IRQ + 16; gtdt->non_secure_el1_flags = ACPI_EDGE_SENSITIVE; gtdt->virtual_timer_interrupt = ARCH_TIMER_VIRT_IRQ + 16; gtdt->virtual_timer_flags = ACPI_EDGE_SENSITIVE; gtdt->non_secure_el2_interrupt = ARCH_TIMER_NS_EL2_IRQ + 16; gtdt->non_secure_el2_flags = ACPI_EDGE_SENSITIVE; build_header(linker, table_data, (void *)(table_data->data + gtdt_start), ""GTDT"", table_data->len - gtdt_start, 2, NULL); }","No, it is non-vulnerable."370368,"static target_ulong h_random(PowerPCCPU *cpu, sPAPRMachineState *spapr, target_ulong opcode, target_ulong *args) { sPAPRRngState *rngstate; HRandomData hrdata; rngstate = SPAPR_RNG(object_resolve_path_type("""", TYPE_SPAPR_RNG, NULL)); if (!rngstate || !rngstate->backend) { return H_HARDWARE; } qemu_sem_init(&hrdata.sem, 0); hrdata.val.v64 = 0; hrdata.received = 0; qemu_mutex_unlock_iothread(); while (hrdata.received < 8) { rng_backend_request_entropy(rngstate->backend, 8 - hrdata.received, random_recv, &hrdata); qemu_sem_wait(&hrdata.sem); } qemu_mutex_lock_iothread(); qemu_sem_destroy(&hrdata.sem); args[0] = hrdata.val.v64; return H_SUCCESS; }","Yes, it is vulnerable."371369,"static int normalize_bits(int num, int width) { int i = 0; int bits = (width) ? 31 : 15; int limit = 1 << (bits - 1); if (num) { if (num == -1) return bits; if (num < 0) num = ~num; for (i = 0; num < limit; i++) num <<= 1; } return i; }","No, it is non-vulnerable."372370,"static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp) { SDHCIState *s = SYSBUS_SDHCI(dev); SysBusDevice *sbd = SYS_BUS_DEVICE(dev); sdhci_common_realize(s, errp); if (errp && *errp) { return; } if (s->dma_mr) { address_space_init(s->dma_as, s->dma_mr, ""sdhci-dma""); } else { /* use system_memory() if property ""dma"" not set */ s->dma_as = &address_space_memory; } sysbus_init_irq(sbd, &s->irq); sysbus_init_mmio(sbd, &s->iomem); }","Yes, it is vulnerable."373371,"static int decode_vop_header(MpegEncContext *s, GetBitContext *gb){ int time_incr, time_increment; s->pict_type = get_bits(gb, 2) + AV_PICTURE_TYPE_I; /* pict type: I = 0 , P = 1 */ if(s->pict_type==AV_PICTURE_TYPE_B && s->low_delay && s->vol_control_parameters==0 && !(s->flags & CODEC_FLAG_LOW_DELAY)){ av_log(s->avctx, AV_LOG_ERROR, ""low_delay flag incorrectly, clearing it\n""); s->low_delay=0; } s->partitioned_frame= s->data_partitioning && s->pict_type!=AV_PICTURE_TYPE_B; if(s->partitioned_frame) s->decode_mb= mpeg4_decode_partitioned_mb; else s->decode_mb= mpeg4_decode_mb; time_incr=0; while (get_bits1(gb) != 0) time_incr++; check_marker(gb, ""before time_increment""); if(s->time_increment_bits==0 || !(show_bits(gb, s->time_increment_bits+1)&1)){ av_log(s->avctx, AV_LOG_ERROR, ""hmm, seems the headers are not complete, trying to guess time_increment_bits\n""); for(s->time_increment_bits=1 ;s->time_increment_bits<16; s->time_increment_bits++){ if ( s->pict_type == AV_PICTURE_TYPE_P || (s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE)) { if((show_bits(gb, s->time_increment_bits+6)&0x37) == 0x30) break; }else if((show_bits(gb, s->time_increment_bits+5)&0x1F) == 0x18) break; } av_log(s->avctx, AV_LOG_ERROR, ""my guess is %d bits ;)\n"",s->time_increment_bits); } if(IS_3IV1) time_increment= get_bits1(gb); //FIXME investigate further else time_increment= get_bits(gb, s->time_increment_bits); if(s->pict_type!=AV_PICTURE_TYPE_B){ s->last_time_base= s->time_base; s->time_base+= time_incr; s->time= s->time_base*s->avctx->time_base.den + time_increment; if(s->workaround_bugs&FF_BUG_UMP4){ if(s->time < s->last_non_b_time){ /* header is not mpeg-4-compatible, broken encoder, * trying to workaround */ s->time_base++; s->time+= s->avctx->time_base.den; } } s->pp_time= s->time - s->last_non_b_time; s->last_non_b_time= s->time; }else{ s->time= (s->last_time_base + time_incr)*s->avctx->time_base.den + time_increment; s->pb_time= s->pp_time - (s->last_non_b_time - s->time); if(s->pp_time <=s->pb_time || s->pp_time <= s->pp_time - s->pb_time || s->pp_time<=0){ /* messed up order, maybe after seeking? skipping current b-frame */ return FRAME_SKIPPED; } ff_mpeg4_init_direct_mv(s); if(s->t_frame==0) s->t_frame= s->pb_time; if(s->t_frame==0) s->t_frame=1; // 1/0 protection s->pp_field_time= ( ROUNDED_DIV(s->last_non_b_time, s->t_frame) - ROUNDED_DIV(s->last_non_b_time - s->pp_time, s->t_frame))*2; s->pb_field_time= ( ROUNDED_DIV(s->time, s->t_frame) - ROUNDED_DIV(s->last_non_b_time - s->pp_time, s->t_frame))*2; if(!s->progressive_sequence){ if(s->pp_field_time <= s->pb_field_time || s->pb_field_time <= 1) return FRAME_SKIPPED; } } if(s->avctx->time_base.num) s->current_picture_ptr->f.pts = (s->time + s->avctx->time_base.num / 2) / s->avctx->time_base.num; else s->current_picture_ptr->f.pts = AV_NOPTS_VALUE; if(s->avctx->debug&FF_DEBUG_PTS) av_log(s->avctx, AV_LOG_DEBUG, ""MPEG4 PTS: %""PRId64""\n"", s->current_picture_ptr->f.pts); check_marker(gb, ""before vop_coded""); /* vop coded */ if (get_bits1(gb) != 1){ if(s->avctx->debug&FF_DEBUG_PICT_INFO) av_log(s->avctx, AV_LOG_ERROR, ""vop not coded\n""); return FRAME_SKIPPED; } if (s->shape != BIN_ONLY_SHAPE && ( s->pict_type == AV_PICTURE_TYPE_P || (s->pict_type == AV_PICTURE_TYPE_S && s->vol_sprite_usage==GMC_SPRITE))) { /* rounding type for motion estimation */ s->no_rounding = get_bits1(gb); } else { s->no_rounding = 0; } //FIXME reduced res stuff if (s->shape != RECT_SHAPE) { if (s->vol_sprite_usage != 1 || s->pict_type != AV_PICTURE_TYPE_I) { skip_bits(gb, 13); /* width */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* height */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* hor_spat_ref */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* ver_spat_ref */ } skip_bits1(gb); /* change_CR_disable */ if (get_bits1(gb) != 0) { skip_bits(gb, 8); /* constant_alpha_value */ } } //FIXME complexity estimation stuff if (s->shape != BIN_ONLY_SHAPE) { skip_bits_long(gb, s->cplx_estimation_trash_i); if(s->pict_type != AV_PICTURE_TYPE_I) skip_bits_long(gb, s->cplx_estimation_trash_p); if(s->pict_type == AV_PICTURE_TYPE_B) skip_bits_long(gb, s->cplx_estimation_trash_b); s->intra_dc_threshold= ff_mpeg4_dc_threshold[ get_bits(gb, 3) ]; if(!s->progressive_sequence){ s->top_field_first= get_bits1(gb); s->alternate_scan= get_bits1(gb); }else s->alternate_scan= 0; } if(s->alternate_scan){ ff_init_scantable(s->dsp.idct_permutation, &s->inter_scantable , ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_scantable , ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_h_scantable, ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_v_scantable, ff_alternate_vertical_scan); } else{ ff_init_scantable(s->dsp.idct_permutation, &s->inter_scantable , ff_zigzag_direct); ff_init_scantable(s->dsp.idct_permutation, &s->intra_scantable , ff_zigzag_direct); ff_init_scantable(s->dsp.idct_permutation, &s->intra_h_scantable, ff_alternate_horizontal_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_v_scantable, ff_alternate_vertical_scan); } if(s->pict_type == AV_PICTURE_TYPE_S && (s->vol_sprite_usage==STATIC_SPRITE || s->vol_sprite_usage==GMC_SPRITE)){ mpeg4_decode_sprite_trajectory(s, gb); if(s->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, ""sprite_brightness_change not supported\n""); if(s->vol_sprite_usage==STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, ""static sprite not supported\n""); } if (s->shape != BIN_ONLY_SHAPE) { s->chroma_qscale= s->qscale = get_bits(gb, s->quant_precision); if(s->qscale==0){ av_log(s->avctx, AV_LOG_ERROR, ""Error, header damaged or not MPEG4 header (qscale=0)\n""); return -1; // makes no sense to continue, as there is nothing left from the image then } if (s->pict_type != AV_PICTURE_TYPE_I) { s->f_code = get_bits(gb, 3); /* fcode_for */ if(s->f_code==0){ av_log(s->avctx, AV_LOG_ERROR, ""Error, header damaged or not MPEG4 header (f_code=0)\n""); return -1; // makes no sense to continue, as the MV decoding will break very quickly } }else s->f_code=1; if (s->pict_type == AV_PICTURE_TYPE_B) { s->b_code = get_bits(gb, 3); }else s->b_code=1; if(s->avctx->debug&FF_DEBUG_PICT_INFO){ av_log(s->avctx, AV_LOG_DEBUG, ""qp:%d fc:%d,%d %s size:%d pro:%d alt:%d top:%d %spel part:%d resync:%d w:%d a:%d rnd:%d vot:%d%s dc:%d ce:%d/%d/%d\n"", s->qscale, s->f_code, s->b_code, s->pict_type == AV_PICTURE_TYPE_I ? ""I"" : (s->pict_type == AV_PICTURE_TYPE_P ? ""P"" : (s->pict_type == AV_PICTURE_TYPE_B ? ""B"" : ""S"")), gb->size_in_bits,s->progressive_sequence, s->alternate_scan, s->top_field_first, s->quarter_sample ? ""q"" : ""h"", s->data_partitioning, s->resync_marker, s->num_sprite_warping_points, s->sprite_warping_accuracy, 1-s->no_rounding, s->vo_type, s->vol_control_parameters ? "" VOLC"" : "" "", s->intra_dc_threshold, s->cplx_estimation_trash_i, s->cplx_estimation_trash_p, s->cplx_estimation_trash_b); } if(!s->scalability){ if (s->shape!=RECT_SHAPE && s->pict_type!=AV_PICTURE_TYPE_I) { skip_bits1(gb); // vop shape coding type } }else{ if(s->enhancement_type){ int load_backward_shape= get_bits1(gb); if(load_backward_shape){ av_log(s->avctx, AV_LOG_ERROR, ""load backward shape isn't supported\n""); } } skip_bits(gb, 2); //ref_select_code } } /* detect buggy encoders which don't set the low_delay flag (divx4/xvid/opendivx)*/ // note we cannot detect divx5 without b-frames easily (although it's buggy too) if(s->vo_type==0 && s->vol_control_parameters==0 && s->divx_version==-1 && s->picture_number==0){ av_log(s->avctx, AV_LOG_WARNING, ""looks like this file was encoded with (divx4/(old)xvid/opendivx) -> forcing low_delay flag\n""); s->low_delay=1; } s->picture_number++; // better than pic number==0 always ;) s->y_dc_scale_table= ff_mpeg4_y_dc_scale_table; //FIXME add short header support s->c_dc_scale_table= ff_mpeg4_c_dc_scale_table; if(s->workaround_bugs&FF_BUG_EDGE){ s->h_edge_pos= s->width; s->v_edge_pos= s->height; } return 0; }","Yes, it is vulnerable."374372,"static int handle_cmd(AHCIState *s, int port, int slot) { IDEState *ide_state; uint32_t opts; uint64_t tbl_addr; AHCICmdHdr *cmd; uint8_t *cmd_fis; dma_addr_t cmd_len; if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) { /* Engine currently busy, try again later */ DPRINTF(port, ""engine busy\n""); return -1; } cmd = &((AHCICmdHdr *)s->dev[port].lst)[slot]; if (!s->dev[port].lst) { DPRINTF(port, ""error: lst not given but cmd handled""); return -1; } /* remember current slot handle for later */ s->dev[port].cur_cmd = cmd; opts = le32_to_cpu(cmd->opts); tbl_addr = le64_to_cpu(cmd->tbl_addr); cmd_len = 0x80; cmd_fis = dma_memory_map(s->as, tbl_addr, &cmd_len, DMA_DIRECTION_FROM_DEVICE); if (!cmd_fis) { DPRINTF(port, ""error: guest passed us an invalid cmd fis\n""); return -1; } /* The device we are working for */ ide_state = &s->dev[port].port.ifs[0]; if (!ide_state->blk) { DPRINTF(port, ""error: guest accessed unused port""); goto out; } debug_print_fis(cmd_fis, 0x90); //debug_print_fis(cmd_fis, (opts & AHCI_CMD_HDR_CMD_FIS_LEN) * 4); switch (cmd_fis[0]) { case SATA_FIS_TYPE_REGISTER_H2D: break; default: DPRINTF(port, ""unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "" ""cmd_fis[2]=%02x\n"", cmd_fis[0], cmd_fis[1], cmd_fis[2]); goto out; break; } switch (cmd_fis[1]) { case SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER: break; case 0: break; default: DPRINTF(port, ""unknown command cmd_fis[0]=%02x cmd_fis[1]=%02x "" ""cmd_fis[2]=%02x\n"", cmd_fis[0], cmd_fis[1], cmd_fis[2]); goto out; break; } if (!(cmd_fis[1] & SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER)) { switch (s->dev[port].port_state) { case STATE_RUN: if (cmd_fis[15] & ATA_SRST) { s->dev[port].port_state = STATE_RESET; } break; case STATE_RESET: if (!(cmd_fis[15] & ATA_SRST)) { ahci_reset_port(s, port); } break; } } else if (cmd_fis[1] & SATA_FIS_REG_H2D_UPDATE_COMMAND_REGISTER) { /* Check for NCQ command */ if (is_ncq(cmd_fis[2])) { process_ncq_command(s, port, cmd_fis, slot); goto out; } /* Decompose the FIS: * AHCI does not interpret FIS packets, it only forwards them. * SATA 1.0 describes how to decode LBA28 and CHS FIS packets. * Later specifications, e.g, SATA 3.2, describe LBA48 FIS packets. * * ATA4 describes sector number for LBA28/CHS commands. * ATA6 describes sector number for LBA48 commands. * ATA8 deprecates CHS fully, describing only LBA28/48. * * We dutifully convert the FIS into IDE registers, and allow the * core layer to interpret them as needed. */ ide_state->feature = cmd_fis[3]; ide_state->sector = cmd_fis[4]; /* LBA 7:0 */ ide_state->lcyl = cmd_fis[5]; /* LBA 15:8 */ ide_state->hcyl = cmd_fis[6]; /* LBA 23:16 */ ide_state->select = cmd_fis[7]; /* LBA 27:24 (LBA28) */ ide_state->hob_sector = cmd_fis[8]; /* LBA 31:24 */ ide_state->hob_lcyl = cmd_fis[9]; /* LBA 39:32 */ ide_state->hob_hcyl = cmd_fis[10]; /* LBA 47:40 */ ide_state->hob_feature = cmd_fis[11]; ide_state->nsector = (int64_t)((cmd_fis[13] << 8) | cmd_fis[12]); /* 14, 16, 17, 18, 19: Reserved (SATA 1.0) */ /* 15: Only valid when UPDATE_COMMAND not set. */ /* Copy the ACMD field (ATAPI packet, if any) from the AHCI command * table to ide_state->io_buffer */ if (opts & AHCI_CMD_ATAPI) { memcpy(ide_state->io_buffer, &cmd_fis[AHCI_COMMAND_TABLE_ACMD], 0x10); debug_print_fis(ide_state->io_buffer, 0x10); s->dev[port].done_atapi_packet = false; /* XXX send PIO setup FIS */ } ide_state->error = 0; /* Reset transferred byte counter */ cmd->status = 0; /* We're ready to process the command in FIS byte 2. */ ide_exec_cmd(&s->dev[port].port, cmd_fis[2]); } out: dma_memory_unmap(s->as, cmd_fis, cmd_len, DMA_DIRECTION_FROM_DEVICE, cmd_len); if (s->dev[port].port.ifs[0].status & (BUSY_STAT|DRQ_STAT)) { /* async command, complete later */ s->dev[port].busy_slot = slot; return -1; } /* done handling the command */ return 0; }","Yes, it is vulnerable."375373,"static int decompress_p(AVCodecContext *avctx, uint32_t *dst, int linesize, uint32_t *prev, int plinesize) { SCPRContext *s = avctx->priv_data; GetByteContext *gb = &s->gb; int ret, temp, min, max, x, y, cx = 0, cx1 = 0; int backstep = linesize - avctx->width; const int cxshift = s->cxshift; if (bytestream2_get_byte(gb) == 0) return 0; bytestream2_skip(gb, 1); init_rangecoder(&s->rc, gb); ret = decode_value(s, s->range_model, 256, 1, &min); ret |= decode_value(s, s->range_model, 256, 1, &temp); min += temp << 8; ret |= decode_value(s, s->range_model, 256, 1, &max); ret |= decode_value(s, s->range_model, 256, 1, &temp); if (ret < 0) return ret; max += temp << 8; memset(s->blocks, 0, sizeof(*s->blocks) * s->nbcount); while (min <= max) { int fill, count; ret = decode_value(s, s->fill_model, 5, 10, &fill); ret |= decode_value(s, s->count_model, 256, 20, &count); if (ret < 0) return ret; while (min < s->nbcount && count-- > 0) { s->blocks[min++] = fill; } } for (y = 0; y < s->nby; y++) { for (x = 0; x < s->nbx; x++) { int sy1 = 0, sy2 = 16, sx1 = 0, sx2 = 16; if (s->blocks[y * s->nbx + x] == 0) continue; if (((s->blocks[y * s->nbx + x] - 1) & 1) > 0) { ret = decode_value(s, s->sxy_model[0], 16, 100, &sx1); ret |= decode_value(s, s->sxy_model[1], 16, 100, &sy1); ret |= decode_value(s, s->sxy_model[2], 16, 100, &sx2); ret |= decode_value(s, s->sxy_model[3], 16, 100, &sy2); if (ret < 0) return ret; sx2++; sy2++; } if (((s->blocks[y * s->nbx + x] - 1) & 2) > 0) { int i, j, by = y * 16, bx = x * 16; int mvx, mvy; ret = decode_value(s, s->mv_model[0], 512, 100, &mvx); ret |= decode_value(s, s->mv_model[1], 512, 100, &mvy); if (ret < 0) return ret; mvx -= 256; mvy -= 256; if (by + mvy + sy1 < 0 || bx + mvx + sx1 < 0) return AVERROR_INVALIDDATA; for (i = 0; i < sy2 - sy1 && (by + sy1 + i) < avctx->height; i++) { for (j = 0; j < sx2 - sx1 && (bx + sx1 + j) < avctx->width; j++) { dst[(by + i + sy1) * linesize + bx + sx1 + j] = prev[(by + mvy + sy1 + i) * plinesize + bx + sx1 + mvx + j]; } } } else { int run, r, g, b, z, bx = x * 16 + sx1, by = y * 16 + sy1; unsigned clr, ptype = 0; for (; by < y * 16 + sy2 && by < avctx->height;) { ret = decode_value(s, s->op_model[ptype], 6, 1000, &ptype); if (ptype == 0) { ret = decode_unit(s, &s->pixel_model[0][cx + cx1], 400, &r); if (ret < 0) return ret; cx1 = (cx << 6) & 0xFC0; cx = r >> cxshift; ret = decode_unit(s, &s->pixel_model[1][cx + cx1], 400, &g); if (ret < 0) return ret; cx1 = (cx << 6) & 0xFC0; cx = g >> cxshift; ret = decode_unit(s, &s->pixel_model[2][cx + cx1], 400, &b); if (ret < 0) return ret; cx1 = (cx << 6) & 0xFC0; cx = b >> cxshift; clr = (b << 16) + (g << 8) + r; } if (ptype > 5) return AVERROR_INVALIDDATA; ret = decode_value(s, s->run_model[ptype], 256, 400, &run); if (ret < 0) return ret; switch (ptype) { case 0: while (run-- > 0) { if (by >= avctx->height) return AVERROR_INVALIDDATA; dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; case 1: while (run-- > 0) { if (bx == 0) { if (by < 1) return AVERROR_INVALIDDATA; z = backstep; } else { z = 0; } if (by >= avctx->height) return AVERROR_INVALIDDATA; clr = dst[by * linesize + bx - 1 - z]; dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; case 2: while (run-- > 0) { if (by < 1 || by >= avctx->height) return AVERROR_INVALIDDATA; clr = dst[(by - 1) * linesize + bx]; dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; case 3: while (run-- > 0) { if (by >= avctx->height) return AVERROR_INVALIDDATA; clr = prev[by * linesize + bx]; dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; case 4: while (run-- > 0) { uint8_t *odst = (uint8_t *)dst; if (by < 1 || by >= avctx->height) return AVERROR_INVALIDDATA; if (bx == 0) { z = backstep; } else { z = 0; } r = odst[((by - 1) * linesize + bx) * 4] + odst[(by * linesize + bx - 1 - z) * 4] - odst[((by - 1) * linesize + bx - 1 - z) * 4]; g = odst[((by - 1) * linesize + bx) * 4 + 1] + odst[(by * linesize + bx - 1 - z) * 4 + 1] - odst[((by - 1) * linesize + bx - 1 - z) * 4 + 1]; b = odst[((by - 1) * linesize + bx) * 4 + 2] + odst[(by * linesize + bx - 1 - z) * 4 + 2] - odst[((by - 1) * linesize + bx - 1 - z) * 4 + 2]; clr = ((b & 0xFF) << 16) + ((g & 0xFF) << 8) + (r & 0xFF); dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; case 5: while (run-- > 0) { if (by < 1 || by >= avctx->height) return AVERROR_INVALIDDATA; if (bx == 0) { z = backstep; } else { z = 0; } clr = dst[(by - 1) * linesize + bx - 1 - z]; dst[by * linesize + bx] = clr; bx++; if (bx >= x * 16 + sx2 || bx >= avctx->width) { bx = x * 16 + sx1; by++; } } break; } if (avctx->bits_per_coded_sample == 16) { cx1 = (clr & 0xFF00) >> 2; cx = (clr & 0xFFFFFF) >> 16; } else { cx1 = (clr & 0xFC00) >> 4; cx = (clr & 0xFFFFFF) >> 18; } } } } } return 0; }","No, it is non-vulnerable."376374,"static void *rndis_queue_response(USBNetState *s, unsigned int length) { struct rndis_response *r = qemu_mallocz(sizeof(struct rndis_response) + length); TAILQ_INSERT_TAIL(&s->rndis_resp, r, entries); r->length = length; return &r->buf[0]; }","No, it is non-vulnerable."377375,static char *visitor_get(TestOutputVisitorData *data) { data->str = string_output_get_string(data->sov); g_assert(data->str); return data->str; },"No, it is non-vulnerable."378376,"static void do_change_vnc(const char *target) { if (strcmp(target, ""passwd"") == 0 || strcmp(target, ""password"") == 0) { char password[9]; monitor_readline(""Password: "", 1, password, sizeof(password)); if (vnc_display_password(NULL, password) < 0) term_printf(""could not set VNC server password\n""); } else { if (vnc_display_open(NULL, target) < 0) term_printf(""could not start VNC server on %s\n"", target); } }","No, it is non-vulnerable."379377,"void do_interrupt (CPUState *env) { #if defined (CONFIG_USER_ONLY) env->exception_index |= 0x100; #else uint32_t msr; int excp = env->exception_index; msr = _load_msr(env); #if defined (DEBUG_EXCEPTIONS) if ((excp == EXCP_PROGRAM || excp == EXCP_DSI) && msr_pr == 1) { if (loglevel > 0) { fprintf(logfile, ""Raise exception at 0x%08x => 0x%08x (%02x)\n"", env->nip, excp << 8, env->error_code); } if (loglevel > 0) cpu_ppc_dump_state(env, logfile, 0); } #endif /* Generate informations in save/restore registers */ switch (excp) { case EXCP_OFCALL: #if defined (USE_OPEN_FIRMWARE) env->gpr[3] = OF_client_entry((void *)env->gpr[3]); #endif return; case EXCP_RTASCALL: #if defined (USE_OPEN_FIRMWARE) printf(""RTAS call !\n""); env->gpr[3] = RTAS_entry((void *)env->gpr[3]); printf(""RTAS call done\n""); #endif return; case EXCP_NONE: /* Do nothing */ #if defined (DEBUG_EXCEPTIONS) printf(""%s: escape EXCP_NONE\n"", __func__); #endif return; case EXCP_RESET: if (msr_ip) excp += 0xFFC00; goto store_next; case EXCP_MACHINE_CHECK: if (msr_me == 0) { cpu_abort(env, ""Machine check exception while not allowed\n""); } msr_me = 0; break; case EXCP_DSI: /* Store exception cause */ /* data location address has been stored * when the fault has been detected */ msr &= ~0xFFFF0000; env->spr[DSISR] = 0; if (env->error_code & EXCP_DSI_TRANSLATE) env->spr[DSISR] |= 0x40000000; else if (env->error_code & EXCP_DSI_PROT) env->spr[DSISR] |= 0x08000000; else if (env->error_code & EXCP_DSI_NOTSUP) { env->spr[DSISR] |= 0x80000000; if (env->error_code & EXCP_DSI_DIRECT) env->spr[DSISR] |= 0x04000000; } if (env->error_code & EXCP_DSI_STORE) env->spr[DSISR] |= 0x02000000; if ((env->error_code & 0xF) == EXCP_DSI_DABR) env->spr[DSISR] |= 0x00400000; if (env->error_code & EXCP_DSI_ECXW) env->spr[DSISR] |= 0x00100000; #if defined (DEBUG_EXCEPTIONS) if (loglevel) { fprintf(logfile, ""DSI exception: DSISR=0x%08x, DAR=0x%08x\n"", env->spr[DSISR], env->spr[DAR]); } else { printf(""DSI exception: DSISR=0x%08x, DAR=0x%08x nip=0x%08x\n"", env->spr[DSISR], env->spr[DAR], env->nip); } #endif goto store_next; case EXCP_ISI: /* Store exception cause */ msr &= ~0xFFFF0000; if (env->error_code == EXCP_ISI_TRANSLATE) msr |= 0x40000000; else if (env->error_code == EXCP_ISI_NOEXEC || env->error_code == EXCP_ISI_GUARD || env->error_code == EXCP_ISI_DIRECT) msr |= 0x10000000; else msr |= 0x08000000; #if defined (DEBUG_EXCEPTIONS) if (loglevel) { fprintf(logfile, ""ISI exception: msr=0x%08x, nip=0x%08x\n"", msr, env->nip); } else { printf(""ISI exception: msr=0x%08x, nip=0x%08x tbl:0x%08x\n"", msr, env->nip, env->spr[V_TBL]); } #endif goto store_next; case EXCP_EXTERNAL: if (msr_ee == 0) { #if defined (DEBUG_EXCEPTIONS) if (loglevel > 0) { fprintf(logfile, ""Skipping hardware interrupt\n""); } #endif /* Requeue it */ do_raise_exception(EXCP_EXTERNAL); return; } goto store_next; case EXCP_ALIGN: /* Store exception cause */ /* Get rS/rD and rA from faulting opcode */ env->spr[DSISR] |= (ldl_code((void *)(env->nip - 4)) & 0x03FF0000) >> 16; /* data location address has been stored * when the fault has been detected */ goto store_current; case EXCP_PROGRAM: msr &= ~0xFFFF0000; switch (env->error_code & ~0xF) { case EXCP_FP: if (msr_fe0 == 0 && msr_fe1 == 0) { #if defined (DEBUG_EXCEPTIONS) printf(""Ignore floating point exception\n""); #endif return; } msr |= 0x00100000; /* Set FX */ env->fpscr[7] |= 0x8; /* Finally, update FEX */ if ((((env->fpscr[7] & 0x3) << 3) | (env->fpscr[6] >> 1)) & ((env->fpscr[1] << 1) | (env->fpscr[0] >> 3))) env->fpscr[7] |= 0x4; break; case EXCP_INVAL: // printf(""Invalid instruction at 0x%08x\n"", env->nip); msr |= 0x00080000; break; case EXCP_PRIV: msr |= 0x00040000; break; case EXCP_TRAP: msr |= 0x00020000; break; default: /* Should never occur */ break; } msr |= 0x00010000; goto store_current; case EXCP_NO_FP: goto store_current; case EXCP_DECR: if (msr_ee == 0) { /* Requeue it */ do_raise_exception(EXCP_DECR); return; } goto store_next; case EXCP_SYSCALL: #if defined (DEBUG_EXCEPTIONS) if (msr_pr) { if (loglevel) { fprintf(logfile, ""syscall %d 0x%08x 0x%08x 0x%08x 0x%08x\n"", env->gpr[0], env->gpr[3], env->gpr[4], env->gpr[5], env->gpr[6]); } else { printf(""syscall %d from 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n"", env->gpr[0], env->nip, env->gpr[3], env->gpr[4], env->gpr[5], env->gpr[6]); } } #endif goto store_next; case EXCP_TRACE: goto store_next; case EXCP_FP_ASSIST: goto store_next; case EXCP_MTMSR: /* Nothing to do */ return; case EXCP_BRANCH: /* Nothing to do */ return; case EXCP_RFI: /* Restore user-mode state */ tb_flush(env); #if defined (DEBUG_EXCEPTIONS) if (msr_pr == 1) printf(""Return from exception => 0x%08x\n"", (uint32_t)env->nip); #endif return; store_current: /* SRR0 is set to current instruction */ env->spr[SRR0] = (uint32_t)env->nip - 4; break; store_next: /* SRR0 is set to next instruction */ env->spr[SRR0] = (uint32_t)env->nip; break; } env->spr[SRR1] = msr; /* reload MSR with correct bits */ msr_pow = 0; msr_ee = 0; msr_pr = 0; msr_fp = 0; msr_fe0 = 0; msr_se = 0; msr_be = 0; msr_fe1 = 0; msr_ir = 0; msr_dr = 0; msr_ri = 0; msr_le = msr_ile; /* Jump to handler */ env->nip = excp << 8; env->exception_index = EXCP_NONE; /* Invalidate all TLB as we may have changed translation mode */ tlb_flush(env, 1); /* ensure that no TB jump will be modified as the program flow was changed */ #ifdef __sparc__ tmp_T0 = 0; #else T0 = 0; #endif #endif env->exception_index = -1; }","No, it is non-vulnerable."380378,"int rom_add_blob(const char *name, const void *blob, size_t len, target_phys_addr_t addr) { Rom *rom; rom = g_malloc0(sizeof(*rom)); rom->name = g_strdup(name); rom->addr = addr; rom->romsize = len; rom->data = g_malloc0(rom->romsize); memcpy(rom->data, blob, len); rom_insert(rom); return 0; }","No, it is non-vulnerable."381379,"static av_cold int decode_init_mp3on4(AVCodecContext * avctx) { MP3On4DecodeContext *s = avctx->priv_data; MPEG4AudioConfig cfg; int i; if ((avctx->extradata_size < 2) || (avctx->extradata == NULL)) { av_log(avctx, AV_LOG_ERROR, ""Codec extradata missing or too short.\n""); return AVERROR_INVALIDDATA; } avpriv_mpeg4audio_get_config(&cfg, avctx->extradata, avctx->extradata_size * 8, 1); if (!cfg.chan_config || cfg.chan_config > 7) { av_log(avctx, AV_LOG_ERROR, ""Invalid channel config number.\n""); return AVERROR_INVALIDDATA; } s->frames = mp3Frames[cfg.chan_config]; s->coff = chan_offset[cfg.chan_config]; avctx->channels = ff_mpeg4audio_channels[cfg.chan_config]; avctx->channel_layout = chan_layout[cfg.chan_config]; if (cfg.sample_rate < 16000) s->syncword = 0xffe00000; else s->syncword = 0xfff00000; /* Init the first mp3 decoder in standard way, so that all tables get builded * We replace avctx->priv_data with the context of the first decoder so that * decode_init() does not have to be changed. * Other decoders will be initialized here copying data from the first context */ // Allocate zeroed memory for the first decoder context s->mp3decctx[0] = av_mallocz(sizeof(MPADecodeContext)); if (!s->mp3decctx[0]) goto alloc_fail; // Put decoder context in place to make init_decode() happy avctx->priv_data = s->mp3decctx[0]; decode_init(avctx); // Restore mp3on4 context pointer avctx->priv_data = s; s->mp3decctx[0]->adu_mode = 1; // Set adu mode /* Create a separate codec/context for each frame (first is already ok). * Each frame is 1 or 2 channels - up to 5 frames allowed */ for (i = 1; i < s->frames; i++) { s->mp3decctx[i] = av_mallocz(sizeof(MPADecodeContext)); if (!s->mp3decctx[i]) goto alloc_fail; s->mp3decctx[i]->adu_mode = 1; s->mp3decctx[i]->avctx = avctx; s->mp3decctx[i]->mpadsp = s->mp3decctx[0]->mpadsp; } return 0; alloc_fail: decode_close_mp3on4(avctx); return AVERROR(ENOMEM); }","No, it is non-vulnerable."382380,"static void avc_luma_midv_qrt_and_aver_dst_8w_msa(const uint8_t *src, int32_t src_stride, uint8_t *dst, int32_t dst_stride, int32_t height, uint8_t vert_offset) { int32_t loop_cnt; v16i8 src0, src1, src2, src3, src4; v16u8 dst0, dst1, dst2, dst3; v16i8 mask0, mask1, mask2; v8i16 hz_out0, hz_out1, hz_out2, hz_out3; v8i16 hz_out4, hz_out5, hz_out6, hz_out7, hz_out8; v8i16 res0, res1, res2, res3; v8i16 res4, res5, res6, res7; LD_SB3(&luma_mask_arr[0], 16, mask0, mask1, mask2); LD_SB5(src, src_stride, src0, src1, src2, src3, src4); XORI_B5_128_SB(src0, src1, src2, src3, src4); src += (5 * src_stride); hz_out0 = AVC_HORZ_FILTER_SH(src0, mask0, mask1, mask2); hz_out1 = AVC_HORZ_FILTER_SH(src1, mask0, mask1, mask2); hz_out2 = AVC_HORZ_FILTER_SH(src2, mask0, mask1, mask2); hz_out3 = AVC_HORZ_FILTER_SH(src3, mask0, mask1, mask2); hz_out4 = AVC_HORZ_FILTER_SH(src4, mask0, mask1, mask2); for (loop_cnt = (height >> 2); loop_cnt--;) { LD_SB4(src, src_stride, src0, src1, src2, src3); XORI_B4_128_SB(src0, src1, src2, src3); src += (4 * src_stride); LD_UB4(dst, dst_stride, dst0, dst1, dst2, dst3); hz_out5 = AVC_HORZ_FILTER_SH(src0, mask0, mask1, mask2); hz_out6 = AVC_HORZ_FILTER_SH(src1, mask0, mask1, mask2); hz_out7 = AVC_HORZ_FILTER_SH(src2, mask0, mask1, mask2); hz_out8 = AVC_HORZ_FILTER_SH(src3, mask0, mask1, mask2); res0 = AVC_CALC_DPADD_H_6PIX_2COEFF_SH(hz_out0, hz_out1, hz_out2, hz_out3, hz_out4, hz_out5); res2 = AVC_CALC_DPADD_H_6PIX_2COEFF_SH(hz_out1, hz_out2, hz_out3, hz_out4, hz_out5, hz_out6); res4 = AVC_CALC_DPADD_H_6PIX_2COEFF_SH(hz_out2, hz_out3, hz_out4, hz_out5, hz_out6, hz_out7); res6 = AVC_CALC_DPADD_H_6PIX_2COEFF_SH(hz_out3, hz_out4, hz_out5, hz_out6, hz_out7, hz_out8); if (vert_offset) { res1 = __msa_srari_h(hz_out3, 5); res3 = __msa_srari_h(hz_out4, 5); res5 = __msa_srari_h(hz_out5, 5); res7 = __msa_srari_h(hz_out6, 5); } else { res1 = __msa_srari_h(hz_out2, 5); res3 = __msa_srari_h(hz_out3, 5); res5 = __msa_srari_h(hz_out4, 5); res7 = __msa_srari_h(hz_out5, 5); } SAT_SH4_SH(res1, res3, res5, res7, 7); res0 = __msa_aver_s_h(res0, res1); res1 = __msa_aver_s_h(res2, res3); res2 = __msa_aver_s_h(res4, res5); res3 = __msa_aver_s_h(res6, res7); ILVR_D2_UB(dst1, dst0, dst3, dst2, dst0, dst1); CONVERT_UB_AVG_ST8x4_UB(res0, res1, res2, res3, dst0, dst1, dst, dst_stride); dst += (4 * dst_stride); hz_out0 = hz_out4; hz_out1 = hz_out5; hz_out2 = hz_out6; hz_out3 = hz_out7; hz_out4 = hz_out8; } }","No, it is non-vulnerable."383381,static const AVClass *filter_child_class_next(const AVClass *prev) { AVFilter **f = NULL; while (prev && *(f = av_filter_next(f))) if ((*f)->priv_class == prev) break; while (*(f = av_filter_next(f))) if ((*f)->priv_class) return (*f)->priv_class; return NULL; },"No, it is non-vulnerable."384382,"void qmp_output_visitor_cleanup(QmpOutputVisitor *v) { QStackEntry *e, *tmp; QTAILQ_FOREACH_SAFE(e, &v->stack, node, tmp) { QTAILQ_REMOVE(&v->stack, e, node); if (e->value) { qobject_decref(e->value); } g_free(e); } g_free(v); }","Yes, it is vulnerable."385383,"static int qemu_chr_open_udp(QemuOpts *opts, CharDriverState **_chr) { CharDriverState *chr = NULL; NetCharDriver *s = NULL; int fd = -1; int ret; chr = g_malloc0(sizeof(CharDriverState)); s = g_malloc0(sizeof(NetCharDriver)); fd = inet_dgram_opts(opts); if (fd < 0) { fprintf(stderr, ""inet_dgram_opts failed\n""); ret = -errno; goto return_err; } s->fd = fd; s->bufcnt = 0; s->bufptr = 0; chr->opaque = s; chr->chr_write = udp_chr_write; chr->chr_update_read_handler = udp_chr_update_read_handler; chr->chr_close = udp_chr_close; *_chr = chr; return 0; return_err: g_free(chr); g_free(s); if (fd >= 0) { closesocket(fd); } return ret; }","Yes, it is vulnerable."386384,"void helper_wrpsr(CPUSPARCState *env, target_ulong new_psr) { if ((new_psr & PSR_CWP) >= env->nwindows) { cpu_raise_exception_ra(env, TT_ILL_INSN, GETPC()); } else { cpu_put_psr(env, new_psr); } }","Yes, it is vulnerable."387385,"void helper_wrpstate(CPUSPARCState *env, target_ulong new_state) { cpu_change_pstate(env, new_state & 0xf3f); #if !defined(CONFIG_USER_ONLY) if (cpu_interrupts_enabled(env)) { cpu_check_irqs(env); } #endif }","Yes, it is vulnerable."388386,"void tb_flush(CPUState *cpu) { #if defined(DEBUG_FLUSH) printf(""qemu: flush code_size=%ld nb_tbs=%d avg_tb_size=%ld\n"", (unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer), tcg_ctx.tb_ctx.nb_tbs, tcg_ctx.tb_ctx.nb_tbs > 0 ? ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer)) / tcg_ctx.tb_ctx.nb_tbs : 0); #endif if ((unsigned long)(tcg_ctx.code_gen_ptr - tcg_ctx.code_gen_buffer) > tcg_ctx.code_gen_buffer_size) { cpu_abort(cpu, ""Internal error: code buffer overflow\n""); tcg_ctx.tb_ctx.nb_tbs = 0; CPU_FOREACH(cpu) { memset(cpu->tb_jmp_cache, 0, sizeof(cpu->tb_jmp_cache)); cpu->tb_flushed = true; qht_reset_size(&tcg_ctx.tb_ctx.htable, CODE_GEN_HTABLE_SIZE); page_flush_tb(); tcg_ctx.code_gen_ptr = tcg_ctx.code_gen_buffer; /* XXX: flush processor icache at this point if cache flush is expensive */ tcg_ctx.tb_ctx.tb_flush_count++;","Yes, it is vulnerable."389387,"int register_savevm(DeviceState *dev, const char *idstr, int instance_id, int version_id, SaveStateHandler *save_state, LoadStateHandler *load_state, void *opaque) { SaveVMHandlers *ops = g_malloc0(sizeof(SaveVMHandlers)); ops->save_state = save_state; ops->load_state = load_state; return register_savevm_live(dev, idstr, instance_id, version_id, ops, opaque); }","Yes, it is vulnerable."390388,"static void test_validate_union(TestInputVisitorData *data, const void *unused) { UserDefUnion *tmp = NULL; Visitor *v; Error *err = NULL; v = validate_test_init(data, ""{ 'type': 'b', 'integer': 41, 'data' : { 'integer': 42 } }""); visit_type_UserDefUnion(v, &tmp, NULL, &err); g_assert(!err); qapi_free_UserDefUnion(tmp); }","No, it is non-vulnerable."391389,"static av_always_inline void mpeg_motion_lowres(MpegEncContext *s, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr, int field_based, int bottom_field, int field_select, uint8_t **ref_picture, h264_chroma_mc_func *pix_op, int motion_x, int motion_y, int h) { uint8_t *ptr_y, *ptr_cb, *ptr_cr; int mx, my, src_x, src_y, uvsrc_x, uvsrc_y, uvlinesize, linesize, sx, sy, uvsx, uvsy; const int lowres= s->avctx->lowres; const int block_s= 8>>lowres; const int s_mask= (2<<lowres)-1; const int h_edge_pos = s->h_edge_pos >> lowres; const int v_edge_pos = s->v_edge_pos >> lowres; linesize = s->current_picture.linesize[0] << field_based; uvlinesize = s->current_picture.linesize[1] << field_based; if(s->quarter_sample){ //FIXME obviously not perfect but qpel wont work in lowres anyway motion_x/=2; motion_y/=2; } if(field_based){ motion_y += (bottom_field - field_select)*((1<<lowres)-1); } sx= motion_x & s_mask; sy= motion_y & s_mask; src_x = s->mb_x*2*block_s + (motion_x >> (lowres+1)); src_y =(s->mb_y*2*block_s>>field_based) + (motion_y >> (lowres+1)); if (s->out_format == FMT_H263) { uvsx = ((motion_x>>1) & s_mask) | (sx&1); uvsy = ((motion_y>>1) & s_mask) | (sy&1); uvsrc_x = src_x>>1; uvsrc_y = src_y>>1; }else if(s->out_format == FMT_H261){//even chroma mv's are full pel in H261 mx = motion_x / 4; my = motion_y / 4; uvsx = (2*mx) & s_mask; uvsy = (2*my) & s_mask; uvsrc_x = s->mb_x*block_s + (mx >> lowres); uvsrc_y = s->mb_y*block_s + (my >> lowres); } else { mx = motion_x / 2; my = motion_y / 2; uvsx = mx & s_mask; uvsy = my & s_mask; uvsrc_x = s->mb_x*block_s + (mx >> (lowres+1)); uvsrc_y =(s->mb_y*block_s>>field_based) + (my >> (lowres+1)); } ptr_y = ref_picture[0] + src_y * linesize + src_x; ptr_cb = ref_picture[1] + uvsrc_y * uvlinesize + uvsrc_x; ptr_cr = ref_picture[2] + uvsrc_y * uvlinesize + uvsrc_x; if( (unsigned)src_x > h_edge_pos - (!!sx) - 2*block_s || (unsigned)src_y >(v_edge_pos >> field_based) - (!!sy) - h){ ff_emulated_edge_mc(s->edge_emu_buffer, ptr_y, s->linesize, 17, 17+field_based, src_x, src_y<<field_based, h_edge_pos, v_edge_pos); ptr_y = s->edge_emu_buffer; if(!(s->flags&CODEC_FLAG_GRAY)){ uint8_t *uvbuf= s->edge_emu_buffer+18*s->linesize; ff_emulated_edge_mc(uvbuf , ptr_cb, s->uvlinesize, 9, 9+field_based, uvsrc_x, uvsrc_y<<field_based, h_edge_pos>>1, v_edge_pos>>1); ff_emulated_edge_mc(uvbuf+16, ptr_cr, s->uvlinesize, 9, 9+field_based, uvsrc_x, uvsrc_y<<field_based, h_edge_pos>>1, v_edge_pos>>1); ptr_cb= uvbuf; ptr_cr= uvbuf+16; } } if(bottom_field){ //FIXME use this for field pix too instead of the obnoxious hack which changes picture.data dest_y += s->linesize; dest_cb+= s->uvlinesize; dest_cr+= s->uvlinesize; } if(field_select){ ptr_y += s->linesize; ptr_cb+= s->uvlinesize; ptr_cr+= s->uvlinesize; } sx <<= 2 - lowres; sy <<= 2 - lowres; pix_op[lowres-1](dest_y, ptr_y, linesize, h, sx, sy); if(!(s->flags&CODEC_FLAG_GRAY)){ uvsx <<= 2 - lowres; uvsy <<= 2 - lowres; pix_op[lowres](dest_cb, ptr_cb, uvlinesize, h >> s->chroma_y_shift, uvsx, uvsy); pix_op[lowres](dest_cr, ptr_cr, uvlinesize, h >> s->chroma_y_shift, uvsx, uvsy); } //FIXME h261 lowres loop filter }","No, it is non-vulnerable."392390,"static int encode_slice_plane(AVCodecContext *avctx, int mb_count, uint8_t *src, int src_stride, uint8_t *buf, unsigned buf_size, int *qmat, int chroma) { ProresContext* ctx = avctx->priv_data; FDCTDSPContext *fdsp = &ctx->fdsp; DECLARE_ALIGNED(16, int16_t, blocks)[DEFAULT_SLICE_MB_WIDTH << 8], *block; int i, blocks_per_slice; PutBitContext pb; block = blocks; for (i = 0; i < mb_count; i++) { fdct_get(fdsp, src, src_stride, block + (0 << 6)); fdct_get(fdsp, src + 8 * src_stride, src_stride, block + ((2 - chroma) << 6)); if (!chroma) { fdct_get(fdsp, src + 16, src_stride, block + (1 << 6)); fdct_get(fdsp, src + 16 + 8 * src_stride, src_stride, block + (3 << 6)); } block += (256 >> chroma); src += (32 >> chroma); } blocks_per_slice = mb_count << (2 - chroma); init_put_bits(&pb, buf, buf_size << 3); encode_dc_coeffs(&pb, blocks, blocks_per_slice, qmat); encode_ac_coeffs(avctx, &pb, blocks, blocks_per_slice, qmat); flush_put_bits(&pb); return put_bits_ptr(&pb) - pb.buf; }","Yes, it is vulnerable."393391,"static inline void render_line_unrolled(intptr_t x, intptr_t y, int x1, intptr_t sy, int ady, int adx, float *buf) { int err = -adx; x -= x1 - 1; buf += x1 - 1; while (++x < 0) { err += ady; if (err >= 0) { err += ady - adx; y += sy; buf[x++] = ff_vorbis_floor1_inverse_db_table[y]; } buf[x] = ff_vorbis_floor1_inverse_db_table[y]; } if (x <= 0) { if (err + ady >= 0) y += sy; buf[x] = ff_vorbis_floor1_inverse_db_table[y]; } }","Yes, it is vulnerable."394392,static int webm_dash_manifest_write_trailer(AVFormatContext *s) { WebMDashMuxContext *w = s->priv_data; int i; for (i = 0; i < w->nb_as; i++) { av_freep(&w->as[i].streams); } av_freep(&w->as); return 0; },"Yes, it is vulnerable."395393,"void test_misc(void) { char table[256]; long res, i; for(i=0;i<256;i++) table[i] = 256 - i; res = 0x12345678; asm (""xlat"" : ""=a"" (res) : ""b"" (table), ""0"" (res)); printf(""xlat: EAX="" FMTLX ""\n"", res); #if defined(__x86_64__) #if 0 { /* XXX: see if Intel Core2 and AMD64 behavior really differ. Here we implemented the Intel way which is not compatible yet with QEMU. */ static struct __attribute__((packed)) { uint64_t offset; uint16_t seg; } desc; long cs_sel; asm volatile (""mov %%cs, %0"" : ""=r"" (cs_sel)); asm volatile (""push %1\n"" ""call func_lret\n"" : ""=a"" (res) : ""r"" (cs_sel) : ""memory"", ""cc""); printf(""func_lret="" FMTLX ""\n"", res); desc.offset = (long)&func_lret; desc.seg = cs_sel; asm volatile (""xor %%rax, %%rax\n"" ""rex64 lcall *(%%rcx)\n"" : ""=a"" (res) : ""c"" (&desc) : ""memory"", ""cc""); printf(""func_lret2="" FMTLX ""\n"", res); asm volatile (""push %2\n"" ""mov $ 1f, %%rax\n"" ""push %%rax\n"" ""rex64 ljmp *(%%rcx)\n"" ""1:\n"" : ""=a"" (res) : ""c"" (&desc), ""b"" (cs_sel) : ""memory"", ""cc""); printf(""func_lret3="" FMTLX ""\n"", res); } #endif #else asm volatile (""push %%cs ; call %1"" : ""=a"" (res) : ""m"" (func_lret): ""memory"", ""cc""); printf(""func_lret="" FMTLX ""\n"", res); asm volatile (""pushf ; push %%cs ; call %1"" : ""=a"" (res) : ""m"" (func_iret): ""memory"", ""cc""); printf(""func_iret="" FMTLX ""\n"", res); #endif #if defined(__x86_64__) /* specific popl test */ asm volatile (""push $12345432 ; push $0x9abcdef ; pop (%%rsp) ; pop %0"" : ""=g"" (res)); printf(""popl esp="" FMTLX ""\n"", res); #else /* specific popl test */ asm volatile (""pushl $12345432 ; pushl $0x9abcdef ; popl (%%esp) ; popl %0"" : ""=g"" (res)); printf(""popl esp="" FMTLX ""\n"", res); /* specific popw test */ asm volatile (""pushl $12345432 ; pushl $0x9abcdef ; popw (%%esp) ; addl $2, %%esp ; popl %0"" : ""=g"" (res)); printf(""popw esp="" FMTLX ""\n"", res); #endif }","No, it is non-vulnerable."396394,"static int pci_rtl8139_init(PCIDevice *dev) { RTL8139State * s = DO_UPCAST(RTL8139State, dev, dev); uint8_t *pci_conf; pci_conf = s->dev.config; pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK); pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8139); pci_conf[PCI_REVISION_ID] = RTL8139_PCI_REVID; /* >=0x20 is for 8139C+ */ pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET); pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin 0 */ /* TODO: start of capability list, but no capability * list bit in status register, and offset 0xdc seems unused. */ pci_conf[PCI_CAPABILITY_LIST] = 0xdc; /* I/O handler for memory-mapped I/O */ s->rtl8139_mmio_io_addr = cpu_register_io_memory(rtl8139_mmio_read, rtl8139_mmio_write, s, DEVICE_LITTLE_ENDIAN); pci_register_bar(&s->dev, 0, 0x100, PCI_BASE_ADDRESS_SPACE_IO, rtl8139_ioport_map); pci_register_bar_simple(&s->dev, 1, 0x100, 0, s->rtl8139_mmio_io_addr); qemu_macaddr_default_if_unset(&s->conf.macaddr); /* prepare eeprom */ s->eeprom.contents[0] = 0x8129; #if 1 /* PCI vendor and device ID should be mirrored here */ s->eeprom.contents[1] = PCI_VENDOR_ID_REALTEK; s->eeprom.contents[2] = PCI_DEVICE_ID_REALTEK_8139; #endif s->eeprom.contents[7] = s->conf.macaddr.a[0] | s->conf.macaddr.a[1] << 8; s->eeprom.contents[8] = s->conf.macaddr.a[2] | s->conf.macaddr.a[3] << 8; s->eeprom.contents[9] = s->conf.macaddr.a[4] | s->conf.macaddr.a[5] << 8; s->nic = qemu_new_nic(&net_rtl8139_info, &s->conf, dev->qdev.info->name, dev->qdev.id, s); qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a); s->cplus_txbuffer = NULL; s->cplus_txbuffer_len = 0; s->cplus_txbuffer_offset = 0; s->TimerExpire = 0; s->timer = qemu_new_timer_ns(vm_clock, rtl8139_timer, s); rtl8139_set_next_tctr_time(s, qemu_get_clock_ns(vm_clock)); add_boot_device_path(s->conf.bootindex, &dev->qdev, ""/ethernet-phy@0""); return 0; }","No, it is non-vulnerable."397395,"void ff_rv40dsp_init_neon(RV34DSPContext *c, DSPContext* dsp) { c->put_pixels_tab[0][ 1] = ff_put_rv40_qpel16_mc10_neon; c->put_pixels_tab[0][ 3] = ff_put_rv40_qpel16_mc30_neon; c->put_pixels_tab[0][ 4] = ff_put_rv40_qpel16_mc01_neon; c->put_pixels_tab[0][ 5] = ff_put_rv40_qpel16_mc11_neon; c->put_pixels_tab[0][ 6] = ff_put_rv40_qpel16_mc21_neon; c->put_pixels_tab[0][ 7] = ff_put_rv40_qpel16_mc31_neon; c->put_pixels_tab[0][ 9] = ff_put_rv40_qpel16_mc12_neon; c->put_pixels_tab[0][10] = ff_put_rv40_qpel16_mc22_neon; c->put_pixels_tab[0][11] = ff_put_rv40_qpel16_mc32_neon; c->put_pixels_tab[0][12] = ff_put_rv40_qpel16_mc03_neon; c->put_pixels_tab[0][13] = ff_put_rv40_qpel16_mc13_neon; c->put_pixels_tab[0][14] = ff_put_rv40_qpel16_mc23_neon; c->put_pixels_tab[0][15] = ff_put_rv40_qpel16_mc33_neon; c->avg_pixels_tab[0][ 1] = ff_avg_rv40_qpel16_mc10_neon; c->avg_pixels_tab[0][ 3] = ff_avg_rv40_qpel16_mc30_neon; c->avg_pixels_tab[0][ 4] = ff_avg_rv40_qpel16_mc01_neon; c->avg_pixels_tab[0][ 5] = ff_avg_rv40_qpel16_mc11_neon; c->avg_pixels_tab[0][ 6] = ff_avg_rv40_qpel16_mc21_neon; c->avg_pixels_tab[0][ 7] = ff_avg_rv40_qpel16_mc31_neon; c->avg_pixels_tab[0][ 9] = ff_avg_rv40_qpel16_mc12_neon; c->avg_pixels_tab[0][10] = ff_avg_rv40_qpel16_mc22_neon; c->avg_pixels_tab[0][11] = ff_avg_rv40_qpel16_mc32_neon; c->avg_pixels_tab[0][12] = ff_avg_rv40_qpel16_mc03_neon; c->avg_pixels_tab[0][13] = ff_avg_rv40_qpel16_mc13_neon; c->avg_pixels_tab[0][14] = ff_avg_rv40_qpel16_mc23_neon; c->avg_pixels_tab[0][15] = ff_avg_rv40_qpel16_mc33_neon; c->put_pixels_tab[1][ 1] = ff_put_rv40_qpel8_mc10_neon; c->put_pixels_tab[1][ 3] = ff_put_rv40_qpel8_mc30_neon; c->put_pixels_tab[1][ 4] = ff_put_rv40_qpel8_mc01_neon; c->put_pixels_tab[1][ 5] = ff_put_rv40_qpel8_mc11_neon; c->put_pixels_tab[1][ 6] = ff_put_rv40_qpel8_mc21_neon; c->put_pixels_tab[1][ 7] = ff_put_rv40_qpel8_mc31_neon; c->put_pixels_tab[1][ 9] = ff_put_rv40_qpel8_mc12_neon; c->put_pixels_tab[1][10] = ff_put_rv40_qpel8_mc22_neon; c->put_pixels_tab[1][11] = ff_put_rv40_qpel8_mc32_neon; c->put_pixels_tab[1][12] = ff_put_rv40_qpel8_mc03_neon; c->put_pixels_tab[1][13] = ff_put_rv40_qpel8_mc13_neon; c->put_pixels_tab[1][14] = ff_put_rv40_qpel8_mc23_neon; c->put_pixels_tab[1][15] = ff_put_rv40_qpel8_mc33_neon; c->avg_pixels_tab[1][ 1] = ff_avg_rv40_qpel8_mc10_neon; c->avg_pixels_tab[1][ 3] = ff_avg_rv40_qpel8_mc30_neon; c->avg_pixels_tab[1][ 4] = ff_avg_rv40_qpel8_mc01_neon; c->avg_pixels_tab[1][ 5] = ff_avg_rv40_qpel8_mc11_neon; c->avg_pixels_tab[1][ 6] = ff_avg_rv40_qpel8_mc21_neon; c->avg_pixels_tab[1][ 7] = ff_avg_rv40_qpel8_mc31_neon; c->avg_pixels_tab[1][ 9] = ff_avg_rv40_qpel8_mc12_neon; c->avg_pixels_tab[1][10] = ff_avg_rv40_qpel8_mc22_neon; c->avg_pixels_tab[1][11] = ff_avg_rv40_qpel8_mc32_neon; c->avg_pixels_tab[1][12] = ff_avg_rv40_qpel8_mc03_neon; c->avg_pixels_tab[1][13] = ff_avg_rv40_qpel8_mc13_neon; c->avg_pixels_tab[1][14] = ff_avg_rv40_qpel8_mc23_neon; c->avg_pixels_tab[1][15] = ff_avg_rv40_qpel8_mc33_neon; c->put_chroma_pixels_tab[0] = ff_put_rv40_chroma_mc8_neon; c->put_chroma_pixels_tab[1] = ff_put_rv40_chroma_mc4_neon; c->avg_chroma_pixels_tab[0] = ff_avg_rv40_chroma_mc8_neon; c->avg_chroma_pixels_tab[1] = ff_avg_rv40_chroma_mc4_neon; c->rv40_weight_pixels_tab[0][0] = ff_rv40_weight_func_16_neon; c->rv40_weight_pixels_tab[0][1] = ff_rv40_weight_func_8_neon; c->rv40_loop_filter_strength[0] = ff_rv40_h_loop_filter_strength_neon; c->rv40_loop_filter_strength[1] = ff_rv40_v_loop_filter_strength_neon; c->rv40_weak_loop_filter[0] = ff_rv40_h_weak_loop_filter_neon; c->rv40_weak_loop_filter[1] = ff_rv40_v_weak_loop_filter_neon; }","No, it is non-vulnerable."398396,"VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb, void *opaque) { VMChangeStateEntry *e; e = qemu_mallocz(sizeof (*e)); e->cb = cb; e->opaque = opaque; LIST_INSERT_HEAD(&vm_change_state_head, e, entries); return e; }","No, it is non-vulnerable."399397,"static int ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile, AVCodecContext *avctx) { int mbn, blk, num_blocks, blk_size, ret, is_intra, mc_type = 0; int mv_x = 0, mv_y = 0; int32_t prev_dc; uint32_t cbp, quant, buf_offs; IVIMbInfo *mb; ivi_mc_func mc_with_delta_func, mc_no_delta_func; const uint8_t *scale_tab; /* init intra prediction for the DC coefficient */ prev_dc = 0; blk_size = band->blk_size; /* number of blocks per mb */ num_blocks = (band->mb_size != blk_size) ? 4 : 1; if (blk_size == 8) { mc_with_delta_func = ff_ivi_mc_8x8_delta; mc_no_delta_func = ff_ivi_mc_8x8_no_delta; } else { mc_with_delta_func = ff_ivi_mc_4x4_delta; mc_no_delta_func = ff_ivi_mc_4x4_no_delta; } for (mbn = 0, mb = tile->mbs; mbn < tile->num_MBs; mb++, mbn++) { is_intra = !mb->type; cbp = mb->cbp; buf_offs = mb->buf_offs; quant = band->glob_quant + mb->q_delta; if (avctx->codec_id == AV_CODEC_ID_INDEO4) quant = av_clip(quant, 0, 31); else quant = av_clip(quant, 0, 23); scale_tab = is_intra ? band->intra_scale : band->inter_scale; if (scale_tab) quant = scale_tab[quant]; if (!is_intra) { mv_x = mb->mv_x; mv_y = mb->mv_y; if (band->is_halfpel) { mc_type = ((mv_y & 1) << 1) | (mv_x & 1); mv_x >>= 1; mv_y >>= 1; /* convert halfpel vectors into fullpel ones */ } if (mb->type) { int dmv_x, dmv_y, cx, cy; dmv_x = mb->mv_x >> band->is_halfpel; dmv_y = mb->mv_y >> band->is_halfpel; cx = mb->mv_x & band->is_halfpel; cy = mb->mv_y & band->is_halfpel; if (mb->xpos + dmv_x < 0 || mb->xpos + dmv_x + band->mb_size + cx > band->pitch || mb->ypos + dmv_y < 0 || mb->ypos + dmv_y + band->mb_size + cy > band->aheight) { return AVERROR_INVALIDDATA; } } } for (blk = 0; blk < num_blocks; blk++) { /* adjust block position in the buffer according to its number */ if (blk & 1) { buf_offs += blk_size; } else if (blk == 2) { buf_offs -= blk_size; buf_offs += blk_size * band->pitch; } if (cbp & 1) { /* block coded ? */ ret = ivi_decode_coded_blocks(gb, band, mc_with_delta_func, mv_x, mv_y, &prev_dc, is_intra, mc_type, quant, buf_offs, avctx); if (ret < 0) return ret; } else { /* block not coded */ /* for intra blocks apply the dc slant transform */ /* for inter - perform the motion compensation without delta */ if (is_intra) { if (band->dc_transform) band->dc_transform(&prev_dc, band->buf + buf_offs, band->pitch, blk_size); } else { ret = ivi_mc(mc_no_delta_func, band->buf, band->ref_buf, buf_offs, mv_x, mv_y, band->pitch, mc_type); if (ret < 0) return ret; } } cbp >>= 1; }// for blk }// for mbn align_get_bits(gb); return 0; }","No, it is non-vulnerable."400398,"static void rtas_read_pci_config(sPAPREnvironment *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { uint32_t val, size, addr; PCIDevice *dev = find_dev(spapr, 0, rtas_ld(args, 0)); if (!dev) { rtas_st(rets, 0, -1); return; } size = rtas_ld(args, 1); addr = rtas_pci_cfgaddr(rtas_ld(args, 0)); val = pci_host_config_read_common(dev, addr, pci_config_size(dev), size); rtas_st(rets, 0, 0); rtas_st(rets, 1, val); }","No, it is non-vulnerable."401399,"void qmp_dump_guest_memory(bool paging, const char *file, bool has_begin, int64_t begin, bool has_length, int64_t length, Error **errp) { const char *p; int fd = -1; DumpState *s; int ret; if (has_begin && !has_length) { error_set(errp, QERR_MISSING_PARAMETER, ""length""); return; } if (!has_begin && has_length) { error_set(errp, QERR_MISSING_PARAMETER, ""begin""); return; } #if !defined(WIN32) if (strstart(file, ""fd:"", &p)) { fd = monitor_get_fd(cur_mon, p, errp); if (fd == -1) { return; } } #endif if (strstart(file, ""file:"", &p)) { fd = qemu_open(p, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR); if (fd < 0) { error_setg_file_open(errp, errno, p); return; } } if (fd == -1) { error_set(errp, QERR_INVALID_PARAMETER, ""protocol""); return; } s = g_malloc(sizeof(DumpState)); ret = dump_init(s, fd, paging, has_begin, begin, length, errp); if (ret < 0) { g_free(s); return; } if (create_vmcore(s) < 0 && !error_is_set(s->errp)) { error_set(errp, QERR_IO_ERROR); } g_free(s); }","No, it is non-vulnerable."402400,static bool bdrv_requests_pending(BlockDriverState *bs) { if (!QLIST_EMPTY(&bs->tracked_requests)) { return true; } if (!qemu_co_queue_empty(&bs->throttled_reqs[0])) { return true; } if (!qemu_co_queue_empty(&bs->throttled_reqs[1])) { return true; } if (bs->file && bdrv_requests_pending(bs->file)) { return true; } if (bs->backing_hd && bdrv_requests_pending(bs->backing_hd)) { return true; } return false; },"No, it is non-vulnerable."403401,"void checkasm_check_fixed_dsp(void) { LOCAL_ALIGNED_32(int32_t, src0, [BUF_SIZE]); LOCAL_ALIGNED_32(int32_t, src1, [BUF_SIZE]); LOCAL_ALIGNED_32(int32_t, src2, [BUF_SIZE]); AVFixedDSPContext *fdsp = avpriv_alloc_fixed_dsp(1); randomize_buffers(); if (check_func(fdsp->vector_fmul, ""vector_fmul"")) check_vector_fmul(src0, src1); if (check_func(fdsp->vector_fmul_add, ""vector_fmul_add"")) check_vector_fmul_add(src0, src1, src2); if (check_func(fdsp->vector_fmul_reverse, ""vector_fmul_reverse"")) check_vector_fmul(src0, src1); if (check_func(fdsp->vector_fmul_window, ""vector_fmul_window"")) check_vector_fmul_window(src0, src1, src2); if (check_func(fdsp->vector_fmul_window_scaled, ""vector_fmul_window_scaled"")) check_vector_fmul_window_scaled(src0, src1, src2); report(""vector_fmul""); if (check_func(fdsp->butterflies_fixed, ""butterflies_fixed"")) check_butterflies(src0, src1); report(""butterflies_fixed""); if (check_func(fdsp->scalarproduct_fixed, ""scalarproduct_fixed"")) check_scalarproduct_fixed(src0, src1); report(""scalarproduct_fixed""); av_freep(&fdsp); }","No, it is non-vulnerable."404402,"static void etsec_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->realize = etsec_realize; dc->reset = etsec_reset; dc->props = etsec_properties; }","Yes, it is vulnerable."405403,"int ff_read_riff_info(AVFormatContext *s, int64_t size) { int64_t start, end, cur; AVIOContext *pb = s->pb; start = avio_tell(pb); end = start + size; while ((cur = avio_tell(pb)) >= 0 && cur <= end - 8 /* = tag + size */) { uint32_t chunk_code; int64_t chunk_size; char key[5] = {0}; char *value; chunk_code = avio_rl32(pb); chunk_size = avio_rl32(pb); if (chunk_size > end || end - chunk_size < cur || chunk_size == UINT_MAX) { avio_seek(pb, -9, SEEK_CUR); chunk_code = avio_rl32(pb); chunk_size = avio_rl32(pb); if (chunk_size > end || end - chunk_size < cur || chunk_size == UINT_MAX) { av_log(s, AV_LOG_WARNING, ""too big INFO subchunk\n""); return AVERROR_INVALIDDATA; } } chunk_size += (chunk_size & 1); if (!chunk_code) { if (chunk_size) avio_skip(pb, chunk_size); continue; } value = av_mallocz(chunk_size + 1); if (!value) { av_log(s, AV_LOG_ERROR, ""out of memory, unable to read INFO tag\n""); return AVERROR(ENOMEM); } AV_WL32(key, chunk_code); if (avio_read(pb, value, chunk_size) != chunk_size) { av_log(s, AV_LOG_WARNING, ""premature end of file while reading INFO tag\n""); } av_dict_set(&s->metadata, key, value, AV_DICT_DONT_STRDUP_VAL); } return 0; }","No, it is non-vulnerable."406404,"void ff_mpeg_flush(AVCodecContext *avctx){ int i; MpegEncContext *s = avctx->priv_data; if(s==NULL || s->picture==NULL) return; for (i = 0; i < MAX_PICTURE_COUNT; i++) ff_mpeg_unref_picture(s, &s->picture[i]); s->current_picture_ptr = s->last_picture_ptr = s->next_picture_ptr = NULL; ff_mpeg_unref_picture(s, &s->current_picture); ff_mpeg_unref_picture(s, &s->last_picture); ff_mpeg_unref_picture(s, &s->next_picture); s->mb_x= s->mb_y= 0; s->parse_context.state= -1; s->parse_context.frame_start_found= 0; s->parse_context.overread= 0; s->parse_context.overread_index= 0; s->parse_context.index= 0; s->parse_context.last_index= 0; s->bitstream_buffer_size=0; s->pp_time=0; }","No, it is non-vulnerable."407405,"static int bdrv_qed_is_allocated(BlockDriverState *bs, int64_t sector_num, int nb_sectors, int *pnum) { BDRVQEDState *s = bs->opaque; uint64_t pos = (uint64_t)sector_num * BDRV_SECTOR_SIZE; size_t len = (size_t)nb_sectors * BDRV_SECTOR_SIZE; QEDIsAllocatedCB cb = { .is_allocated = -1, .pnum = pnum, }; QEDRequest request = { .l2_table = NULL }; async_context_push(); qed_find_cluster(s, &request, pos, len, qed_is_allocated_cb, &cb); while (cb.is_allocated == -1) { qemu_aio_wait(); } async_context_pop(); qed_unref_l2_cache_entry(request.l2_table); return cb.is_allocated; }","No, it is non-vulnerable."408406,"static int rwpipe_read_ppm_header( rwpipe *rw, int *width, int *height ) { char line[ 3 ]; FILE *in = rwpipe_reader( rw ); int max; fgets( line, 3, in ); if ( !strncmp( line, ""P6"", 2 ) ) { *width = rwpipe_read_number( rw ); *height = rwpipe_read_number( rw ); max = rwpipe_read_number( rw ); return max != 255 || *width <= 0 || *height <= 0; } return 1; }","No, it is non-vulnerable."409407,"static int vhost_user_get_u64(struct vhost_dev *dev, int request, uint64_t *u64) { VhostUserMsg msg = { .request = request, .flags = VHOST_USER_VERSION, }; if (vhost_user_one_time_request(request) && dev->vq_index != 0) { return 0; } vhost_user_write(dev, &msg, NULL, 0); if (vhost_user_read(dev, &msg) < 0) { return 0; } if (msg.request != request) { error_report(""Received unexpected msg type. Expected %d received %d"", request, msg.request); return -1; } if (msg.size != sizeof(m.u64)) { error_report(""Received bad msg size.""); return -1; } *u64 = msg.u64; return 0; }","Yes, it is vulnerable."410408,"static int crc_write_header(struct AVFormatContext *s) { CRCState *crc = s->priv_data; /* init CRC */ crc->crcval = adler32(0, NULL, 0); return 0; }","No, it is non-vulnerable."411409,"ObjectClass *object_class_dynamic_cast_assert(ObjectClass *class, const char *typename, const char *file, int line, const char *func) { ObjectClass *ret = object_class_dynamic_cast(class, typename); if (!ret && class) { fprintf(stderr, ""%s:%d:%s: Object %p is not an instance of type %s\n"", file, line, func, class, typename); abort(); } return ret; }","Yes, it is vulnerable."412410,"static void nvme_set_bootindex(Object *obj, Visitor *v, void *opaque, const char *name, Error **errp) { NvmeCtrl *s = NVME(obj); int32_t boot_index; Error *local_err = NULL; visit_type_int32(v, &boot_index, name, &local_err); if (local_err) { goto out; } /* check whether bootindex is present in fw_boot_order list */ check_boot_index(boot_index, &local_err); if (local_err) { goto out; } /* change bootindex to a new one */ s->conf.bootindex = boot_index; out: if (local_err) { error_propagate(errp, local_err); } }","Yes, it is vulnerable."413411,PPC_OP(divwu) { if (T1 == 0) { T0 = 0; } else { T0 /= T1; } RETURN(); },"Yes, it is vulnerable."414412,"static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos, int *outFilterSize, int xInc, int srcW, int dstW, int filterAlign, int one, int flags, int cpu_flags, SwsVector *srcFilter, SwsVector *dstFilter, double param[2], int is_horizontal) { int i; int filterSize; int filter2Size; int minFilterSize; int64_t *filter = NULL; int64_t *filter2 = NULL; const int64_t fone = 1LL << 54; int ret = -1; emms_c(); // FIXME should not be required but IS (even for non-MMX versions) // NOTE: the +3 is for the MMX(+1) / SSE(+3) scaler which reads over the end FF_ALLOC_OR_GOTO(NULL, *filterPos, (dstW + 3) * sizeof(**filterPos), fail); if (FFABS(xInc - 0x10000) < 10) { // unscaled int i; filterSize = 1; FF_ALLOCZ_OR_GOTO(NULL, filter, dstW * sizeof(*filter) * filterSize, fail); for (i = 0; i < dstW; i++) { filter[i * filterSize] = fone; (*filterPos)[i] = i; } } else if (flags & SWS_POINT) { // lame looking point sampling mode int i; int xDstInSrc; filterSize = 1; FF_ALLOC_OR_GOTO(NULL, filter, dstW * sizeof(*filter) * filterSize, fail); xDstInSrc = xInc / 2 - 0x8000; for (i = 0; i < dstW; i++) { int xx = (xDstInSrc - ((filterSize - 1) << 15) + (1 << 15)) >> 16; (*filterPos)[i] = xx; filter[i] = fone; xDstInSrc += xInc; } } else if ((xInc <= (1 << 16) && (flags & SWS_AREA)) || (flags & SWS_FAST_BILINEAR)) { // bilinear upscale int i; int xDstInSrc; filterSize = 2; FF_ALLOC_OR_GOTO(NULL, filter, dstW * sizeof(*filter) * filterSize, fail); xDstInSrc = xInc / 2 - 0x8000; for (i = 0; i < dstW; i++) { int xx = (xDstInSrc - ((filterSize - 1) << 15) + (1 << 15)) >> 16; int j; (*filterPos)[i] = xx; // bilinear upscale / linear interpolate / area averaging for (j = 0; j < filterSize; j++) { int64_t coeff = fone - FFABS((xx << 16) - xDstInSrc) * (fone >> 16); if (coeff < 0) coeff = 0; filter[i * filterSize + j] = coeff; xx++; } xDstInSrc += xInc; } } else { int64_t xDstInSrc; int sizeFactor; if (flags & SWS_BICUBIC) sizeFactor = 4; else if (flags & SWS_X) sizeFactor = 8; else if (flags & SWS_AREA) sizeFactor = 1; // downscale only, for upscale it is bilinear else if (flags & SWS_GAUSS) sizeFactor = 8; // infinite ;) else if (flags & SWS_LANCZOS) sizeFactor = param[0] != SWS_PARAM_DEFAULT ? ceil(2 * param[0]) : 6; else if (flags & SWS_SINC) sizeFactor = 20; // infinite ;) else if (flags & SWS_SPLINE) sizeFactor = 20; // infinite ;) else if (flags & SWS_BILINEAR) sizeFactor = 2; else { sizeFactor = 0; // GCC warning killer assert(0); } if (xInc <= 1 << 16) filterSize = 1 + sizeFactor; // upscale else filterSize = 1 + (sizeFactor * srcW + dstW - 1) / dstW; filterSize = FFMIN(filterSize, srcW - 2); filterSize = FFMAX(filterSize, 1); FF_ALLOC_OR_GOTO(NULL, filter, dstW * sizeof(*filter) * filterSize, fail); xDstInSrc = xInc - 0x10000; for (i = 0; i < dstW; i++) { int xx = (xDstInSrc - ((filterSize - 2) << 16)) / (1 << 17); int j; (*filterPos)[i] = xx; for (j = 0; j < filterSize; j++) { int64_t d = (FFABS(((int64_t)xx << 17) - xDstInSrc)) << 13; double floatd; int64_t coeff; if (xInc > 1 << 16) d = d * dstW / srcW; floatd = d * (1.0 / (1 << 30)); if (flags & SWS_BICUBIC) { int64_t B = (param[0] != SWS_PARAM_DEFAULT ? param[0] : 0) * (1 << 24); int64_t C = (param[1] != SWS_PARAM_DEFAULT ? param[1] : 0.6) * (1 << 24); if (d >= 1LL << 31) { coeff = 0.0; } else { int64_t dd = (d * d) >> 30; int64_t ddd = (dd * d) >> 30; if (d < 1LL << 30) coeff = (12 * (1 << 24) - 9 * B - 6 * C) * ddd + (-18 * (1 << 24) + 12 * B + 6 * C) * dd + (6 * (1 << 24) - 2 * B) * (1 << 30); else coeff = (-B - 6 * C) * ddd + (6 * B + 30 * C) * dd + (-12 * B - 48 * C) * d + (8 * B + 24 * C) * (1 << 30); } coeff *= fone >> (30 + 24); } #if 0 else if (flags & SWS_X) { double p = param ? param * 0.01 : 0.3; coeff = d ? sin(d * M_PI) / (d * M_PI) : 1.0; coeff *= pow(2.0, -p * d * d); } #endif else if (flags & SWS_X) { double A = param[0] != SWS_PARAM_DEFAULT ? param[0] : 1.0; double c; if (floatd < 1.0) c = cos(floatd * M_PI); else c = -1.0; if (c < 0.0) c = -pow(-c, A); else c = pow(c, A); coeff = (c * 0.5 + 0.5) * fone; } else if (flags & SWS_AREA) { int64_t d2 = d - (1 << 29); if (d2 * xInc < -(1LL << (29 + 16))) coeff = 1.0 * (1LL << (30 + 16)); else if (d2 * xInc < (1LL << (29 + 16))) coeff = -d2 * xInc + (1LL << (29 + 16)); else coeff = 0.0; coeff *= fone >> (30 + 16); } else if (flags & SWS_GAUSS) { double p = param[0] != SWS_PARAM_DEFAULT ? param[0] : 3.0; coeff = (pow(2.0, -p * floatd * floatd)) * fone; } else if (flags & SWS_SINC) { coeff = (d ? sin(floatd * M_PI) / (floatd * M_PI) : 1.0) * fone; } else if (flags & SWS_LANCZOS) { double p = param[0] != SWS_PARAM_DEFAULT ? param[0] : 3.0; coeff = (d ? sin(floatd * M_PI) * sin(floatd * M_PI / p) / (floatd * floatd * M_PI * M_PI / p) : 1.0) * fone; if (floatd > p) coeff = 0; } else if (flags & SWS_BILINEAR) { coeff = (1 << 30) - d; if (coeff < 0) coeff = 0; coeff *= fone >> 30; } else if (flags & SWS_SPLINE) { double p = -2.196152422706632; coeff = getSplineCoeff(1.0, 0.0, p, -p - 1.0, floatd) * fone; } else { coeff = 0.0; // GCC warning killer assert(0); } filter[i * filterSize + j] = coeff; xx++; } xDstInSrc += 2 * xInc; } } /* apply src & dst Filter to filter -> filter2 * av_free(filter); */ assert(filterSize > 0); filter2Size = filterSize; if (srcFilter) filter2Size += srcFilter->length - 1; if (dstFilter) filter2Size += dstFilter->length - 1; assert(filter2Size > 0); FF_ALLOCZ_OR_GOTO(NULL, filter2, filter2Size * dstW * sizeof(*filter2), fail); for (i = 0; i < dstW; i++) { int j, k; if (srcFilter) { for (k = 0; k < srcFilter->length; k++) { for (j = 0; j < filterSize; j++) filter2[i * filter2Size + k + j] += srcFilter->coeff[k] * filter[i * filterSize + j]; } } else { for (j = 0; j < filterSize; j++) filter2[i * filter2Size + j] = filter[i * filterSize + j]; } // FIXME dstFilter (*filterPos)[i] += (filterSize - 1) / 2 - (filter2Size - 1) / 2; } av_freep(&filter); /* try to reduce the filter-size (step1 find size and shift left) */ // Assume it is near normalized (*0.5 or *2.0 is OK but * 0.001 is not). minFilterSize = 0; for (i = dstW - 1; i >= 0; i--) { int min = filter2Size; int j; int64_t cutOff = 0.0; /* get rid of near zero elements on the left by shifting left */ for (j = 0; j < filter2Size; j++) { int k; cutOff += FFABS(filter2[i * filter2Size]); if (cutOff > SWS_MAX_REDUCE_CUTOFF * fone) break; /* preserve monotonicity because the core can't handle the * filter otherwise */ if (i < dstW - 1 && (*filterPos)[i] >= (*filterPos)[i + 1]) break; // move filter coefficients left for (k = 1; k < filter2Size; k++) filter2[i * filter2Size + k - 1] = filter2[i * filter2Size + k]; filter2[i * filter2Size + k - 1] = 0; (*filterPos)[i]++; } cutOff = 0; /* count near zeros on the right */ for (j = filter2Size - 1; j > 0; j--) { cutOff += FFABS(filter2[i * filter2Size + j]); if (cutOff > SWS_MAX_REDUCE_CUTOFF * fone) break; min--; } if (min > minFilterSize) minFilterSize = min; } if (PPC_ALTIVEC(cpu_flags)) { // we can handle the special case 4, so we don't want to go the full 8 if (minFilterSize < 5) filterAlign = 4; /* We really don't want to waste our time doing useless computation, so * fall back on the scalar C code for very small filters. * Vectorizing is worth it only if you have a decent-sized vector. */ if (minFilterSize < 3) filterAlign = 1; } if (INLINE_MMX(cpu_flags)) { // special case for unscaled vertical filtering if (minFilterSize == 1 && filterAlign == 2) filterAlign = 1; } assert(minFilterSize > 0); filterSize = (minFilterSize + (filterAlign - 1)) & (~(filterAlign - 1)); assert(filterSize > 0); filter = av_malloc(filterSize * dstW * sizeof(*filter)); if (filterSize >= MAX_FILTER_SIZE * 16 / ((flags & SWS_ACCURATE_RND) ? APCK_SIZE : 16) || !filter) goto fail; *outFilterSize = filterSize; if (flags & SWS_PRINT_INFO) av_log(NULL, AV_LOG_VERBOSE, ""SwScaler: reducing / aligning filtersize %d -> %d\n"", filter2Size, filterSize); /* try to reduce the filter-size (step2 reduce it) */ for (i = 0; i < dstW; i++) { int j; for (j = 0; j < filterSize; j++) { if (j >= filter2Size) filter[i * filterSize + j] = 0; else filter[i * filterSize + j] = filter2[i * filter2Size + j]; if ((flags & SWS_BITEXACT) && j >= minFilterSize) filter[i * filterSize + j] = 0; } } // FIXME try to align filterPos if possible // fix borders if (is_horizontal) { for (i = 0; i < dstW; i++) { int j; if ((*filterPos)[i] < 0) { // move filter coefficients left to compensate for filterPos for (j = 1; j < filterSize; j++) { int left = FFMAX(j + (*filterPos)[i], 0); filter[i * filterSize + left] += filter[i * filterSize + j]; filter[i * filterSize + j] = 0; } (*filterPos)[i] = 0; } if ((*filterPos)[i] + filterSize > srcW) { int shift = (*filterPos)[i] + filterSize - srcW; // move filter coefficients right to compensate for filterPos for (j = filterSize - 2; j >= 0; j--) { int right = FFMIN(j + shift, filterSize - 1); filter[i * filterSize + right] += filter[i * filterSize + j]; filter[i * filterSize + j] = 0; } (*filterPos)[i] = srcW - filterSize; } } } // Note the +1 is for the MMX scaler which reads over the end /* align at 16 for AltiVec (needed by hScale_altivec_real) */ FF_ALLOCZ_OR_GOTO(NULL, *outFilter, *outFilterSize * (dstW + 3) * sizeof(int16_t), fail); /* normalize & store in outFilter */ for (i = 0; i < dstW; i++) { int j; int64_t error = 0; int64_t sum = 0; for (j = 0; j < filterSize; j++) { sum += filter[i * filterSize + j]; } sum = (sum + one / 2) / one; for (j = 0; j < *outFilterSize; j++) { int64_t v = filter[i * filterSize + j] + error; int intV = ROUNDED_DIV(v, sum); (*outFilter)[i * (*outFilterSize) + j] = intV; error = v - intV * sum; } } (*filterPos)[dstW + 0] = (*filterPos)[dstW + 1] = (*filterPos)[dstW + 2] = (*filterPos)[dstW - 1]; /* the MMX/SSE scaler will * read over the end */ for (i = 0; i < *outFilterSize; i++) { int k = (dstW - 1) * (*outFilterSize) + i; (*outFilter)[k + 1 * (*outFilterSize)] = (*outFilter)[k + 2 * (*outFilterSize)] = (*outFilter)[k + 3 * (*outFilterSize)] = (*outFilter)[k]; } ret = 0; fail: av_free(filter); av_free(filter2); return ret; }","Yes, it is vulnerable."415413,"void *rom_add_blob(const char *name, const void *blob, size_t len, hwaddr addr, const char *fw_file_name, FWCfgReadCallback fw_callback, void *callback_opaque) { Rom *rom; void *data = NULL; rom = g_malloc0(sizeof(*rom)); rom->name = g_strdup(name); rom->addr = addr; rom->romsize = len; rom->datasize = len; rom->data = g_malloc0(rom->datasize); memcpy(rom->data, blob, len); rom_insert(rom); if (fw_file_name && fw_cfg) { char devpath[100]; snprintf(devpath, sizeof(devpath), ""/rom@%s"", fw_file_name); if (rom_file_has_mr) { data = rom_set_mr(rom, OBJECT(fw_cfg), devpath); } else { data = rom->data; } fw_cfg_add_file_callback(fw_cfg, fw_file_name, fw_callback, callback_opaque, data, rom->romsize); } return data; }","Yes, it is vulnerable."416414,"static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table, unsigned int index, unsigned int n, bool flush) { unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1; unsigned int start, end, i; QEDTable *new_table; struct iovec iov; QEMUIOVector qiov; size_t len_bytes; int ret; trace_qed_write_table(s, offset, table, index, n); /* Calculate indices of the first and one after last elements */ start = index & ~sector_mask; end = (index + n + sector_mask) & ~sector_mask; len_bytes = (end - start) * sizeof(uint64_t); new_table = qemu_blockalign(s->bs, len_bytes); iov = (struct iovec) { .iov_base = new_table->offsets, .iov_len = len_bytes, }; qemu_iovec_init_external(&qiov, &iov, 1); /* Byteswap table */ for (i = start; i < end; i++) { uint64_t le_offset = cpu_to_le64(table->offsets[i]); new_table->offsets[i - start] = le_offset; } /* Adjust for offset into table */ offset += start * sizeof(uint64_t); ret = bdrv_pwritev(s->bs->file, offset, &qiov); trace_qed_write_table_cb(s, table, flush, ret); if (ret < 0) { goto out; } if (flush) { qed_acquire(s); ret = bdrv_flush(s->bs); qed_release(s); if (ret < 0) { goto out; } } ret = 0; out: qemu_vfree(new_table); return ret; }","No, it is non-vulnerable."417415,"static void vnc_init_basic_info(SocketAddress *addr, VncBasicInfo *info, Error **errp) { switch (addr->type) { case SOCKET_ADDRESS_KIND_INET: info->host = g_strdup(addr->u.inet->host); info->service = g_strdup(addr->u.inet->port); if (addr->u.inet->ipv6) { info->family = NETWORK_ADDRESS_FAMILY_IPV6; } else { info->family = NETWORK_ADDRESS_FAMILY_IPV4; } break; case SOCKET_ADDRESS_KIND_UNIX: info->host = g_strdup(""""); info->service = g_strdup(addr->u.q_unix->path); info->family = NETWORK_ADDRESS_FAMILY_UNIX; break; default: error_setg(errp, ""Unsupported socket kind %d"", addr->type); break; } return; }","No, it is non-vulnerable."418416,"static void disable_interrupt(EEPRO100State * s) { if (s->int_stat) { logout(""interrupt disabled\n""); qemu_irq_lower(s->pci_dev->irq[0]); s->int_stat = 0; } }","No, it is non-vulnerable."419417,"void cpu_physical_memory_rw(target_phys_addr_t addr, uint8_t *buf, int len, int is_write) { int l, io_index; uint8_t *ptr; uint32_t val; target_phys_addr_t page; unsigned long pd; PhysPageDesc *p; while (len > 0) { page = addr & TARGET_PAGE_MASK; l = (page + TARGET_PAGE_SIZE) - addr; if (l > len) l = len; p = phys_page_find(page >> TARGET_PAGE_BITS); if (!p) { pd = IO_MEM_UNASSIGNED; } else { pd = p->phys_offset; } if (is_write) { if ((pd & ~TARGET_PAGE_MASK) != IO_MEM_RAM) { io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1); if (p) addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset; /* XXX: could force cpu_single_env to NULL to avoid potential bugs */ if (l >= 4 && ((addr & 3) == 0)) { /* 32 bit write access */ val = ldl_p(buf); io_mem_write[io_index][2](io_mem_opaque[io_index], addr, val); l = 4; } else if (l >= 2 && ((addr & 1) == 0)) { /* 16 bit write access */ val = lduw_p(buf); io_mem_write[io_index][1](io_mem_opaque[io_index], addr, val); l = 2; } else { /* 8 bit write access */ val = ldub_p(buf); io_mem_write[io_index][0](io_mem_opaque[io_index], addr, val); l = 1; } } else { unsigned long addr1; addr1 = (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK); /* RAM case */ ptr = phys_ram_base + addr1; memcpy(ptr, buf, l); if (!cpu_physical_memory_is_dirty(addr1)) { /* invalidate code */ tb_invalidate_phys_page_range(addr1, addr1 + l, 0); /* set dirty bit */ phys_ram_dirty[addr1 >> TARGET_PAGE_BITS] |= (0xff & ~CODE_DIRTY_FLAG); } } } else { if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) { /* I/O case */ io_index = (pd >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1); if (p) addr = (addr & ~TARGET_PAGE_MASK) + p->region_offset; if (l >= 4 && ((addr & 3) == 0)) { /* 32 bit read access */ val = io_mem_read[io_index][2](io_mem_opaque[io_index], addr); stl_p(buf, val); l = 4; } else if (l >= 2 && ((addr & 1) == 0)) { /* 16 bit read access */ val = io_mem_read[io_index][1](io_mem_opaque[io_index], addr); stw_p(buf, val); l = 2; } else { /* 8 bit read access */ val = io_mem_read[io_index][0](io_mem_opaque[io_index], addr); stb_p(buf, val); l = 1; } } else { /* RAM case */ ptr = phys_ram_base + (pd & TARGET_PAGE_MASK) + (addr & ~TARGET_PAGE_MASK); memcpy(buf, ptr, l); } } len -= l; buf += l; addr += l; } }","Yes, it is vulnerable."420418,"static int av_dict_set_fxp(AVDictionary **pm, const char *key, uint64_t value, unsigned int digits, int flags) { char valuestr[44]; snprintf(valuestr, sizeof(valuestr), ""%""PRId64"".%0*""PRId64, value / PRECISION, digits, ( value % PRECISION ) / ( PRECISION / uintpow(10,digits) )); return av_dict_set(pm, key, valuestr, flags); }","Yes, it is vulnerable."421419,"int av_packet_ref(AVPacket *dst, const AVPacket *src) { int ret; ret = av_packet_copy_props(dst, src); if (ret < 0) return ret; if (!src->buf) { ret = packet_alloc(&dst->buf, src->size); if (ret < 0) goto fail; memcpy(dst->buf->data, src->data, src->size); dst->data = dst->buf->data; } else { dst->buf = av_buffer_ref(src->buf); if (!dst->buf) { ret = AVERROR(ENOMEM); goto fail; } dst->data = src->data; } dst->size = src->size; return 0; fail: av_packet_free_side_data(dst); return ret; }","Yes, it is vulnerable."422420,"int ff_h264_pred_weight_table(GetBitContext *gb, const SPS *sps, const int *ref_count, int slice_type_nos, H264PredWeightTable *pwt, int picture_structure, void *logctx) { int list, i, j; int luma_def, chroma_def; pwt->use_weight = 0; pwt->use_weight_chroma = 0; pwt->luma_log2_weight_denom = get_ue_golomb(gb); if (sps->chroma_format_idc) pwt->chroma_log2_weight_denom = get_ue_golomb(gb); if (pwt->luma_log2_weight_denom > 7U) { av_log(logctx, AV_LOG_ERROR, ""luma_log2_weight_denom %d is out of range\n"", pwt->luma_log2_weight_denom); pwt->luma_log2_weight_denom = 0; } if (pwt->chroma_log2_weight_denom > 7U) { av_log(logctx, AV_LOG_ERROR, ""chroma_log2_weight_denom %d is out of range\n"", pwt->chroma_log2_weight_denom); pwt->chroma_log2_weight_denom = 0; } luma_def = 1 << pwt->luma_log2_weight_denom; chroma_def = 1 << pwt->chroma_log2_weight_denom; for (list = 0; list < 2; list++) { pwt->luma_weight_flag[list] = 0; pwt->chroma_weight_flag[list] = 0; for (i = 0; i < ref_count[list]; i++) { int luma_weight_flag, chroma_weight_flag; luma_weight_flag = get_bits1(gb); if (luma_weight_flag) { pwt->luma_weight[i][list][0] = get_se_golomb(gb); pwt->luma_weight[i][list][1] = get_se_golomb(gb); if ((int8_t)pwt->luma_weight[i][list][0] != pwt->luma_weight[i][list][0] || (int8_t)pwt->luma_weight[i][list][1] != pwt->luma_weight[i][list][1]) goto out_range_weight; if (pwt->luma_weight[i][list][0] != luma_def || pwt->luma_weight[i][list][1] != 0) { pwt->use_weight = 1; pwt->luma_weight_flag[list] = 1; } } else { pwt->luma_weight[i][list][0] = luma_def; pwt->luma_weight[i][list][1] = 0; } if (sps->chroma_format_idc) { chroma_weight_flag = get_bits1(gb); if (chroma_weight_flag) { int j; for (j = 0; j < 2; j++) { pwt->chroma_weight[i][list][j][0] = get_se_golomb(gb); pwt->chroma_weight[i][list][j][1] = get_se_golomb(gb); if ((int8_t)pwt->chroma_weight[i][list][j][0] != pwt->chroma_weight[i][list][j][0] || (int8_t)pwt->chroma_weight[i][list][j][1] != pwt->chroma_weight[i][list][j][1]) goto out_range_weight; if (pwt->chroma_weight[i][list][j][0] != chroma_def || pwt->chroma_weight[i][list][j][1] != 0) { pwt->use_weight_chroma = 1; pwt->chroma_weight_flag[list] = 1; } } } else { int j; for (j = 0; j < 2; j++) { pwt->chroma_weight[i][list][j][0] = chroma_def; pwt->chroma_weight[i][list][j][1] = 0; } } } // for MBAFF if (picture_structure == PICT_FRAME) { pwt->luma_weight[16 + 2 * i][list][0] = pwt->luma_weight[16 + 2 * i + 1][list][0] = pwt->luma_weight[i][list][0]; pwt->luma_weight[16 + 2 * i][list][1] = pwt->luma_weight[16 + 2 * i + 1][list][1] = pwt->luma_weight[i][list][1]; for (j = 0; j < 2; j++) { pwt->chroma_weight[16 + 2 * i][list][j][0] = pwt->chroma_weight[16 + 2 * i + 1][list][j][0] = pwt->chroma_weight[i][list][j][0]; pwt->chroma_weight[16 + 2 * i][list][j][1] = pwt->chroma_weight[16 + 2 * i + 1][list][j][1] = pwt->chroma_weight[i][list][j][1]; } } } if (slice_type_nos != AV_PICTURE_TYPE_B) break; } pwt->use_weight = pwt->use_weight || pwt->use_weight_chroma; return 0; out_range_weight: avpriv_request_sample(logctx, ""Out of range weight\n""); return AVERROR_INVALIDDATA; }","Yes, it is vulnerable."423421,"static int libschroedinger_encode_init(AVCodecContext *avccontext) { FfmpegSchroEncoderParams* p_schro_params = avccontext->priv_data; SchroVideoFormatEnum preset; /* Initialize the libraries that libschroedinger depends on. */ schro_init(); /* Create an encoder object. */ p_schro_params->encoder = schro_encoder_new(); if (!p_schro_params->encoder) { av_log(avccontext, AV_LOG_ERROR, ""Unrecoverable Error: schro_encoder_new failed. ""); return -1; } /* Initialize the format. */ preset = ff_get_schro_video_format_preset(avccontext); p_schro_params->format = schro_encoder_get_video_format(p_schro_params->encoder); schro_video_format_set_std_video_format (p_schro_params->format, preset); p_schro_params->format->width = avccontext->width; p_schro_params->format->height = avccontext->height; if (SetSchroChromaFormat(avccontext) == -1) return -1; if (ff_get_schro_frame_format(p_schro_params->format->chroma_format, &p_schro_params->frame_format) == -1) { av_log (avccontext, AV_LOG_ERROR, ""This codec currently supports only planar YUV 4:2:0, 4:2:2"" "" and 4:4:4 formats.\n""); return -1; } p_schro_params->format->frame_rate_numerator = avccontext->time_base.den; p_schro_params->format->frame_rate_denominator = avccontext->time_base.num; p_schro_params->frame_size = avpicture_get_size(avccontext->pix_fmt, avccontext->width, avccontext->height); avccontext->coded_frame = &p_schro_params->picture; if (avccontext->gop_size == 0){ schro_encoder_setting_set_double (p_schro_params->encoder, ""gop_structure"", SCHRO_ENCODER_GOP_INTRA_ONLY); if (avccontext->coder_type == FF_CODER_TYPE_VLC) { schro_encoder_setting_set_double (p_schro_params->encoder, ""enable_noarith"", 1); } } else { schro_encoder_setting_set_double (p_schro_params->encoder, ""gop_structure"", SCHRO_ENCODER_GOP_BIREF); avccontext->has_b_frames = 1; } /* FIXME - Need to handle SCHRO_ENCODER_RATE_CONTROL_LOW_DELAY. */ if (avccontext->flags & CODEC_FLAG_QSCALE) { if (avccontext->global_quality == 0) { /* lossless coding */ schro_encoder_setting_set_double (p_schro_params->encoder, ""rate_control"", SCHRO_ENCODER_RATE_CONTROL_LOSSLESS); } else { int noise_threshold; schro_encoder_setting_set_double (p_schro_params->encoder, ""rate_control"", SCHRO_ENCODER_RATE_CONTROL_CONSTANT_NOISE_THRESHOLD); noise_threshold = avccontext->global_quality/FF_QP2LAMBDA; if (noise_threshold > 100) noise_threshold = 100; schro_encoder_setting_set_double (p_schro_params->encoder, ""noise_threshold"", noise_threshold); } } else { schro_encoder_setting_set_double ( p_schro_params->encoder, ""rate_control"", SCHRO_ENCODER_RATE_CONTROL_CONSTANT_BITRATE); schro_encoder_setting_set_double (p_schro_params->encoder, ""bitrate"", avccontext->bit_rate); } if (avccontext->flags & CODEC_FLAG_INTERLACED_ME) { /* All material can be coded as interlaced or progressive irrespective of the type of source material. */ schro_encoder_setting_set_double (p_schro_params->encoder, ""interlaced_coding"", 1); } /* FIXME: Signal range hardcoded to 8-bit data until both libschroedinger * and libdirac support other bit-depth data. */ schro_video_format_set_std_signal_range(p_schro_params->format, SCHRO_SIGNAL_RANGE_8BIT_VIDEO); /* Hardcode motion vector precision to quarter pixel. */ schro_encoder_setting_set_double (p_schro_params->encoder, ""mv_precision"", 2); /* Set the encoder format. */ schro_encoder_set_video_format(p_schro_params->encoder, p_schro_params->format); /* Set the debug level. */ schro_debug_set_level (avccontext->debug); schro_encoder_start (p_schro_params->encoder); /* Initialize the encoded frame queue. */ ff_dirac_schro_queue_init (&p_schro_params->enc_frame_queue); return 0 ; }","Yes, it is vulnerable."424422,"int h263_decode_mb(MpegEncContext *s, DCTELEM block[6][64]) { int cbpc, cbpy, i, cbp, pred_x, pred_y, mx, my, dquant; unsigned int val; INT16 *mot_val; static INT8 quant_tab[4] = { -1, -2, 1, 2 }; /* Check for GOB Start Code */ val = show_bits(&s->gb, 16); if (val == 0) { /* We have a GBSC probably with GSTUFF */ #ifdef DEBUG unsigned int gn, gfid; #endif //skip_bits(&s->gb, 16); /* Drop the zeros */ while (get_bits1(&s->gb) == 0); /* Seek the '1' bit */ #ifdef DEBUG fprintf(stderr,""\nGOB Start Code at MB %d\n"", (s->mb_y * s->mb_width) + s->mb_x); gn = get_bits(&s->gb, 5); /* GN */ gfid = get_bits(&s->gb, 2); /* GFID */ #else skip_bits(&s->gb, 5); /* GN */ skip_bits(&s->gb, 2); /* GFID */ #endif s->qscale = get_bits(&s->gb, 5); /* GQUANT */ #ifdef DEBUG fprintf(stderr, ""\nGN: %u GFID: %u Quant: %u\n"", gn, gfid, s->qscale); #endif } if (s->pict_type == P_TYPE) { if (get_bits1(&s->gb)) { /* skip mb */ s->mb_intra = 0; for(i=0;i<6;i++) s->block_last_index[i] = -1; s->mv_dir = MV_DIR_FORWARD; s->mv_type = MV_TYPE_16X16; s->mv[0][0][0] = 0; s->mv[0][0][1] = 0; s->mb_skiped = 1; return 0; } cbpc = get_vlc(&s->gb, &inter_MCBPC_vlc); //fprintf(stderr, ""\tCBPC: %d"", cbpc); if (cbpc < 0) return -1; dquant = cbpc & 8; s->mb_intra = ((cbpc & 4) != 0); } else { cbpc = get_vlc(&s->gb, &intra_MCBPC_vlc); if (cbpc < 0) return -1; dquant = cbpc & 4; s->mb_intra = 1; } if (!s->mb_intra) { cbpy = get_vlc(&s->gb, &cbpy_vlc); cbp = (cbpc & 3) | ((cbpy ^ 0xf) << 2); if (dquant) { s->qscale += quant_tab[get_bits(&s->gb, 2)]; if (s->qscale < 1) s->qscale = 1; else if (s->qscale > 31) s->qscale = 31; } s->mv_dir = MV_DIR_FORWARD; if ((cbpc & 16) == 0) { /* 16x16 motion prediction */ s->mv_type = MV_TYPE_16X16; h263_pred_motion(s, 0, &pred_x, &pred_y); if (s->umvplus_dec) mx = h263p_decode_umotion(s, pred_x); else mx = h263_decode_motion(s, pred_x); if (mx >= 0xffff) return -1; if (s->umvplus_dec) my = h263p_decode_umotion(s, pred_y); else my = h263_decode_motion(s, pred_y); if (my >= 0xffff) return -1; s->mv[0][0][0] = mx; s->mv[0][0][1] = my; if (s->umvplus_dec && (mx - pred_x) == 1 && (my - pred_y) == 1) skip_bits1(&s->gb); /* Bit stuffing to prevent PSC */ } else { s->mv_type = MV_TYPE_8X8; for(i=0;i<4;i++) { mot_val = h263_pred_motion(s, i, &pred_x, &pred_y); if (s->umvplus_dec) mx = h263p_decode_umotion(s, pred_x); else mx = h263_decode_motion(s, pred_x); if (mx >= 0xffff) return -1; if (s->umvplus_dec) my = h263p_decode_umotion(s, pred_y); else my = h263_decode_motion(s, pred_y); if (my >= 0xffff) return -1; s->mv[0][i][0] = mx; s->mv[0][i][1] = my; if (s->umvplus_dec && (mx - pred_x) == 1 && (my - pred_y) == 1) skip_bits1(&s->gb); /* Bit stuffing to prevent PSC */ mot_val[0] = mx; mot_val[1] = my; } } } else { s->ac_pred = 0; if (s->h263_pred) { s->ac_pred = get_bits1(&s->gb); } cbpy = get_vlc(&s->gb, &cbpy_vlc); cbp = (cbpc & 3) | (cbpy << 2); if (dquant) { s->qscale += quant_tab[get_bits(&s->gb, 2)]; if (s->qscale < 1) s->qscale = 1; else if (s->qscale > 31) s->qscale = 31; } } /* decode each block */ if (s->h263_pred) { for (i = 0; i < 6; i++) { if (mpeg4_decode_block(s, block[i], i, (cbp >> (5 - i)) & 1) < 0) return -1; } } else { for (i = 0; i < 6; i++) { if (h263_decode_block(s, block[i], i, (cbp >> (5 - i)) & 1) < 0) return -1; } } return 0; }","Yes, it is vulnerable."425423,"VirtIODevice *virtio_serial_init(DeviceState *dev, virtio_serial_conf *conf) { VirtIOSerial *vser; VirtIODevice *vdev; uint32_t i, max_supported_ports; if (!conf->max_virtserial_ports) return NULL; /* Each port takes 2 queues, and one pair is for the control queue */ max_supported_ports = VIRTIO_PCI_QUEUE_MAX / 2 - 1; if (conf->max_virtserial_ports > max_supported_ports) { error_report(""maximum ports supported: %u"", max_supported_ports); return NULL; } vdev = virtio_common_init(""virtio-serial"", VIRTIO_ID_CONSOLE, sizeof(struct virtio_console_config), sizeof(VirtIOSerial)); vser = DO_UPCAST(VirtIOSerial, vdev, vdev); /* Spawn a new virtio-serial bus on which the ports will ride as devices */ vser->bus = virtser_bus_new(dev); vser->bus->vser = vser; QTAILQ_INIT(&vser->ports); vser->bus->max_nr_ports = conf->max_virtserial_ports; vser->ivqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *)); vser->ovqs = qemu_malloc(conf->max_virtserial_ports * sizeof(VirtQueue *)); /* Add a queue for host to guest transfers for port 0 (backward compat) */ vser->ivqs[0] = virtio_add_queue(vdev, 128, handle_input); /* Add a queue for guest to host transfers for port 0 (backward compat) */ vser->ovqs[0] = virtio_add_queue(vdev, 128, handle_output); /* TODO: host to guest notifications can get dropped * if the queue fills up. Implement queueing in host, * this might also make it possible to reduce the control * queue size: as guest preposts buffers there, * this will save 4Kbyte of guest memory per entry. */ /* control queue: host to guest */ vser->c_ivq = virtio_add_queue(vdev, 32, control_in); /* control queue: guest to host */ vser->c_ovq = virtio_add_queue(vdev, 32, control_out); for (i = 1; i < vser->bus->max_nr_ports; i++) { /* Add a per-port queue for host to guest transfers */ vser->ivqs[i] = virtio_add_queue(vdev, 128, handle_input); /* Add a per-per queue for guest to host transfers */ vser->ovqs[i] = virtio_add_queue(vdev, 128, handle_output); } vser->config.max_nr_ports = tswap32(conf->max_virtserial_ports); vser->ports_map = qemu_mallocz(((conf->max_virtserial_ports + 31) / 32) * sizeof(vser->ports_map[0])); /* * Reserve location 0 for a console port for backward compat * (old kernel, new qemu) */ mark_port_added(vser, 0); vser->vdev.get_features = get_features; vser->vdev.get_config = get_config; vser->vdev.set_config = set_config; vser->qdev = dev; /* * Register for the savevm section with the virtio-console name * to preserve backward compat */ register_savevm(dev, ""virtio-console"", -1, 3, virtio_serial_save, virtio_serial_load, vser); return vdev; }","Yes, it is vulnerable."426424,"static void kempf_restore_buf(const uint8_t *src, int len, uint8_t *dst, int stride, const uint8_t *jpeg_tile, int tile_stride, int width, int height, const uint8_t *pal, int npal, int tidx) { GetBitContext gb; int i, j, nb, col; init_get_bits8(&gb, src, len); if (npal <= 2) nb = 1; else if (npal <= 4) nb = 2; else if (npal <= 16) nb = 4; else nb = 8; for (j = 0; j < height; j++, dst += stride, jpeg_tile += tile_stride) { if (get_bits(&gb, 8)) continue; for (i = 0; i < width; i++) { col = get_bits(&gb, nb); if (col != tidx) memcpy(dst + i * 3, pal + col * 3, 3); else memcpy(dst + i * 3, jpeg_tile + i * 3, 3); } } }","No, it is non-vulnerable."427425,"static JavaVM *get_java_vm(const char *name, void *log_ctx) { JavaVM *vm = NULL; jsize nb_vm = 0; void *handle = NULL; jint (*get_created_java_vms) (JavaVM ** vmBuf, jsize bufLen, jsize *nVMs) = NULL; handle = dlopen(name, RTLD_LOCAL); if (!handle) { return NULL; } get_created_java_vms = (jint (*)(JavaVM **, jsize, jsize *)) dlsym(handle, ""JNI_GetCreatedJavaVMs""); if (!get_created_java_vms) { av_log(log_ctx, AV_LOG_ERROR, ""Could not find JNI_GetCreatedJavaVMs symbol in library '%s'\n"", name); goto done; } if (get_created_java_vms(&vm, 1, &nb_vm) != JNI_OK) { av_log(log_ctx, AV_LOG_ERROR, ""Could not get created Java virtual machines\n""); goto done; } done: if (handle) { dlclose(handle); } return vm; }","No, it is non-vulnerable."428426,"static int mpegts_push_data(MpegTSFilter *filter, const uint8_t *buf, int buf_size, int is_start, int64_t pos) { PESContext *pes = filter->u.pes_filter.opaque; MpegTSContext *ts = pes->ts; const uint8_t *p; int len, code; if(!ts->pkt) return 0; if (is_start) { if (pes->state == MPEGTS_PAYLOAD && pes->data_index > 0) { new_pes_packet(pes, ts->pkt); ts->stop_parse = 1; } pes->state = MPEGTS_HEADER; pes->data_index = 0; pes->ts_packet_pos = pos; } p = buf; while (buf_size > 0) { switch(pes->state) { case MPEGTS_HEADER: len = PES_START_SIZE - pes->data_index; if (len > buf_size) len = buf_size; memcpy(pes->header + pes->data_index, p, len); pes->data_index += len; p += len; buf_size -= len; if (pes->data_index == PES_START_SIZE) { /* we got all the PES or section header. We can now decide */ #if 0 av_hex_dump_log(pes->stream, AV_LOG_DEBUG, pes->header, pes->data_index); #endif if (pes->header[0] == 0x00 && pes->header[1] == 0x00 && pes->header[2] == 0x01) { /* it must be an mpeg2 PES stream */ code = pes->header[3] | 0x100; dprintf(pes->stream, ""pid=%x pes_code=%#x\n"", pes->pid, code); if ((pes->st && pes->st->discard == AVDISCARD_ALL) || code == 0x1be) /* padding_stream */ goto skip; /* stream not present in PMT */ if (!pes->st) pes->st = new_pes_av_stream(pes, 0, code); if (!pes->st) return AVERROR(ENOMEM); pes->total_size = AV_RB16(pes->header + 4); /* NOTE: a zero total size means the PES size is unbounded */ if (!pes->total_size) pes->total_size = MAX_PES_PAYLOAD; /* allocate pes buffer */ pes->buffer = av_malloc(pes->total_size+FF_INPUT_BUFFER_PADDING_SIZE); if (!pes->buffer) return AVERROR(ENOMEM); if (code != 0x1bc && code != 0x1bf && /* program_stream_map, private_stream_2 */ code != 0x1f0 && code != 0x1f1 && /* ECM, EMM */ code != 0x1ff && code != 0x1f2 && /* program_stream_directory, DSMCC_stream */ code != 0x1f8) { /* ITU-T Rec. H.222.1 type E stream */ pes->state = MPEGTS_PESHEADER_FILL; pes->pes_header_size = pes->header[8] + 9; } else { pes->state = MPEGTS_PAYLOAD; pes->data_index = 0; } } else { /* otherwise, it should be a table */ /* skip packet */ skip: pes->state = MPEGTS_SKIP; continue; } } break; /**********************************************/ /* PES packing parsing */ case MPEGTS_PESHEADER_FILL: len = pes->pes_header_size - pes->data_index; if (len < 0) return -1; if (len > buf_size) len = buf_size; memcpy(pes->header + pes->data_index, p, len); pes->data_index += len; p += len; buf_size -= len; if (pes->data_index == pes->pes_header_size) { const uint8_t *r; unsigned int flags; flags = pes->header[7]; r = pes->header + 9; pes->pts = AV_NOPTS_VALUE; pes->dts = AV_NOPTS_VALUE; if ((flags & 0xc0) == 0x80) { pes->dts = pes->pts = get_pts(r); r += 5; } else if ((flags & 0xc0) == 0xc0) { pes->pts = get_pts(r); r += 5; pes->dts = get_pts(r); r += 5; } /* we got the full header. We parse it and get the payload */ pes->state = MPEGTS_PAYLOAD; pes->data_index = 0; } break; case MPEGTS_PAYLOAD: if (buf_size > 0) { if (pes->data_index+buf_size > pes->total_size) { new_pes_packet(pes, ts->pkt); pes->total_size = MAX_PES_PAYLOAD; pes->buffer = av_malloc(pes->total_size+FF_INPUT_BUFFER_PADDING_SIZE); if (!pes->buffer) return AVERROR(ENOMEM); ts->stop_parse = 1; } memcpy(pes->buffer+pes->data_index, p, buf_size); pes->data_index += buf_size; } buf_size = 0; break; case MPEGTS_SKIP: buf_size = 0; break; } } return 0; }","No, it is non-vulnerable."429427,"static int proxy_fstat(FsContext *fs_ctx, int fid_type, V9fsFidOpenState *fs, struct stat *stbuf) { int fd; if (fid_type == P9_FID_DIR) { fd = dirfd(fs->dir); } else { fd = fs->fd; } return fstat(fd, stbuf); }","No, it is non-vulnerable."430428,"static uint64_t cmd646_data_read(void *opaque, target_phys_addr_t addr, unsigned size) { CMD646BAR *cmd646bar = opaque; if (size == 1) { return ide_ioport_read(cmd646bar->bus, addr); } else if (addr == 0) { if (size == 2) { return ide_data_readw(cmd646bar->bus, addr); } else { return ide_data_readl(cmd646bar->bus, addr); } } return ((uint64_t)1 << (size * 8)) - 1; }","No, it is non-vulnerable."431429,"int kvm_arch_insert_sw_breakpoint(CPUState *env, struct kvm_sw_breakpoint *bp) { static const uint8_t int3 = 0xcc; if (cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) || cpu_memory_rw_debug(env, bp->pc, (uint8_t *)&int3, 1, 1)) return -EINVAL; return 0; }","No, it is non-vulnerable."432430,"static av_always_inline void MPV_decode_mb_internal(MpegEncContext *s, DCTELEM block[12][64], int lowres_flag) { int mb_x, mb_y; const int mb_xy = s->mb_y * s->mb_stride + s->mb_x; #ifdef HAVE_XVMC if(s->avctx->xvmc_acceleration){ XVMC_decode_mb(s);//xvmc uses pblocks return; } #endif mb_x = s->mb_x; mb_y = s->mb_y; if(s->avctx->debug&FF_DEBUG_DCT_COEFF) { /* save DCT coefficients */ int i,j; DCTELEM *dct = &s->current_picture.dct_coeff[mb_xy*64*6]; for(i=0; i<6; i++) for(j=0; j<64; j++) *dct++ = block[i][s->dsp.idct_permutation[j]]; } s->current_picture.qscale_table[mb_xy]= s->qscale; /* update DC predictors for P macroblocks */ if (!s->mb_intra) { if (s->h263_pred || s->h263_aic) { if(s->mbintra_table[mb_xy]) ff_clean_intra_table_entries(s); } else { s->last_dc[0] = s->last_dc[1] = s->last_dc[2] = 128 << s->intra_dc_precision; } } else if (s->h263_pred || s->h263_aic) s->mbintra_table[mb_xy]=1; if ((s->flags&CODEC_FLAG_PSNR) || !(s->encoding && (s->intra_only || s->pict_type==B_TYPE) && s->avctx->mb_decision != FF_MB_DECISION_RD)) { //FIXME precalc uint8_t *dest_y, *dest_cb, *dest_cr; int dct_linesize, dct_offset; op_pixels_func (*op_pix)[4]; qpel_mc_func (*op_qpix)[16]; const int linesize= s->current_picture.linesize[0]; //not s->linesize as this would be wrong for field pics const int uvlinesize= s->current_picture.linesize[1]; const int readable= s->pict_type != B_TYPE || s->encoding || s->avctx->draw_horiz_band || lowres_flag; const int block_size= lowres_flag ? 8>>s->avctx->lowres : 8; /* avoid copy if macroblock skipped in last frame too */ /* skip only during decoding as we might trash the buffers during encoding a bit */ if(!s->encoding){ uint8_t *mbskip_ptr = &s->mbskip_table[mb_xy]; const int age= s->current_picture.age; assert(age); if (s->mb_skipped) { s->mb_skipped= 0; assert(s->pict_type!=I_TYPE); (*mbskip_ptr) ++; /* indicate that this time we skipped it */ if(*mbskip_ptr >99) *mbskip_ptr= 99; /* if previous was skipped too, then nothing to do ! */ if (*mbskip_ptr >= age && s->current_picture.reference){ return; } } else if(!s->current_picture.reference){ (*mbskip_ptr) ++; /* increase counter so the age can be compared cleanly */ if(*mbskip_ptr >99) *mbskip_ptr= 99; } else{ *mbskip_ptr = 0; /* not skipped */ } } dct_linesize = linesize << s->interlaced_dct; dct_offset =(s->interlaced_dct)? linesize : linesize*block_size; if(readable){ dest_y= s->dest[0]; dest_cb= s->dest[1]; dest_cr= s->dest[2]; }else{ dest_y = s->b_scratchpad; dest_cb= s->b_scratchpad+16*linesize; dest_cr= s->b_scratchpad+32*linesize; } if (!s->mb_intra) { /* motion handling */ /* decoding or more than one mb_type (MC was already done otherwise) */ if(!s->encoding){ if(lowres_flag){ h264_chroma_mc_func *op_pix = s->dsp.put_h264_chroma_pixels_tab; if (s->mv_dir & MV_DIR_FORWARD) { MPV_motion_lowres(s, dest_y, dest_cb, dest_cr, 0, s->last_picture.data, op_pix); op_pix = s->dsp.avg_h264_chroma_pixels_tab; } if (s->mv_dir & MV_DIR_BACKWARD) { MPV_motion_lowres(s, dest_y, dest_cb, dest_cr, 1, s->next_picture.data, op_pix); } }else{ op_qpix= s->me.qpel_put; if ((!s->no_rounding) || s->pict_type==B_TYPE){ op_pix = s->dsp.put_pixels_tab; }else{ op_pix = s->dsp.put_no_rnd_pixels_tab; } if (s->mv_dir & MV_DIR_FORWARD) { MPV_motion(s, dest_y, dest_cb, dest_cr, 0, s->last_picture.data, op_pix, op_qpix); op_pix = s->dsp.avg_pixels_tab; op_qpix= s->me.qpel_avg; } if (s->mv_dir & MV_DIR_BACKWARD) { MPV_motion(s, dest_y, dest_cb, dest_cr, 1, s->next_picture.data, op_pix, op_qpix); } } } /* skip dequant / idct if we are really late ;) */ if(s->hurry_up>1) goto skip_idct; if(s->avctx->skip_idct){ if( (s->avctx->skip_idct >= AVDISCARD_NONREF && s->pict_type == B_TYPE) ||(s->avctx->skip_idct >= AVDISCARD_NONKEY && s->pict_type != I_TYPE) || s->avctx->skip_idct >= AVDISCARD_ALL) goto skip_idct; } /* add dct residue */ if(s->encoding || !( s->h263_msmpeg4 || s->codec_id==CODEC_ID_MPEG1VIDEO || s->codec_id==CODEC_ID_MPEG2VIDEO || (s->codec_id==CODEC_ID_MPEG4 && !s->mpeg_quant))){ add_dequant_dct(s, block[0], 0, dest_y , dct_linesize, s->qscale); add_dequant_dct(s, block[1], 1, dest_y + block_size, dct_linesize, s->qscale); add_dequant_dct(s, block[2], 2, dest_y + dct_offset , dct_linesize, s->qscale); add_dequant_dct(s, block[3], 3, dest_y + dct_offset + block_size, dct_linesize, s->qscale); if(!(s->flags&CODEC_FLAG_GRAY)){ if (s->chroma_y_shift){ add_dequant_dct(s, block[4], 4, dest_cb, uvlinesize, s->chroma_qscale); add_dequant_dct(s, block[5], 5, dest_cr, uvlinesize, s->chroma_qscale); }else{ dct_linesize >>= 1; dct_offset >>=1; add_dequant_dct(s, block[4], 4, dest_cb, dct_linesize, s->chroma_qscale); add_dequant_dct(s, block[5], 5, dest_cr, dct_linesize, s->chroma_qscale); add_dequant_dct(s, block[6], 6, dest_cb + dct_offset, dct_linesize, s->chroma_qscale); add_dequant_dct(s, block[7], 7, dest_cr + dct_offset, dct_linesize, s->chroma_qscale); } } } else if(s->codec_id != CODEC_ID_WMV2){ add_dct(s, block[0], 0, dest_y , dct_linesize); add_dct(s, block[1], 1, dest_y + block_size, dct_linesize); add_dct(s, block[2], 2, dest_y + dct_offset , dct_linesize); add_dct(s, block[3], 3, dest_y + dct_offset + block_size, dct_linesize); if(!(s->flags&CODEC_FLAG_GRAY)){ if(s->chroma_y_shift){//Chroma420 add_dct(s, block[4], 4, dest_cb, uvlinesize); add_dct(s, block[5], 5, dest_cr, uvlinesize); }else{ //chroma422 dct_linesize = uvlinesize << s->interlaced_dct; dct_offset =(s->interlaced_dct)? uvlinesize : uvlinesize*8; add_dct(s, block[4], 4, dest_cb, dct_linesize); add_dct(s, block[5], 5, dest_cr, dct_linesize); add_dct(s, block[6], 6, dest_cb+dct_offset, dct_linesize); add_dct(s, block[7], 7, dest_cr+dct_offset, dct_linesize); if(!s->chroma_x_shift){//Chroma444 add_dct(s, block[8], 8, dest_cb+8, dct_linesize); add_dct(s, block[9], 9, dest_cr+8, dct_linesize); add_dct(s, block[10], 10, dest_cb+8+dct_offset, dct_linesize); add_dct(s, block[11], 11, dest_cr+8+dct_offset, dct_linesize); } } }//fi gray } else if (ENABLE_WMV2) { ff_wmv2_add_mb(s, block, dest_y, dest_cb, dest_cr); } } else { /* dct only in intra block */ if(s->encoding || !(s->codec_id==CODEC_ID_MPEG1VIDEO || s->codec_id==CODEC_ID_MPEG2VIDEO)){ put_dct(s, block[0], 0, dest_y , dct_linesize, s->qscale); put_dct(s, block[1], 1, dest_y + block_size, dct_linesize, s->qscale); put_dct(s, block[2], 2, dest_y + dct_offset , dct_linesize, s->qscale); put_dct(s, block[3], 3, dest_y + dct_offset + block_size, dct_linesize, s->qscale); if(!(s->flags&CODEC_FLAG_GRAY)){ if(s->chroma_y_shift){ put_dct(s, block[4], 4, dest_cb, uvlinesize, s->chroma_qscale); put_dct(s, block[5], 5, dest_cr, uvlinesize, s->chroma_qscale); }else{ dct_offset >>=1; dct_linesize >>=1; put_dct(s, block[4], 4, dest_cb, dct_linesize, s->chroma_qscale); put_dct(s, block[5], 5, dest_cr, dct_linesize, s->chroma_qscale); put_dct(s, block[6], 6, dest_cb + dct_offset, dct_linesize, s->chroma_qscale); put_dct(s, block[7], 7, dest_cr + dct_offset, dct_linesize, s->chroma_qscale); } } }else{ s->dsp.idct_put(dest_y , dct_linesize, block[0]); s->dsp.idct_put(dest_y + block_size, dct_linesize, block[1]); s->dsp.idct_put(dest_y + dct_offset , dct_linesize, block[2]); s->dsp.idct_put(dest_y + dct_offset + block_size, dct_linesize, block[3]); if(!(s->flags&CODEC_FLAG_GRAY)){ if(s->chroma_y_shift){ s->dsp.idct_put(dest_cb, uvlinesize, block[4]); s->dsp.idct_put(dest_cr, uvlinesize, block[5]); }else{ dct_linesize = uvlinesize << s->interlaced_dct; dct_offset =(s->interlaced_dct)? uvlinesize : uvlinesize*8; s->dsp.idct_put(dest_cb, dct_linesize, block[4]); s->dsp.idct_put(dest_cr, dct_linesize, block[5]); s->dsp.idct_put(dest_cb + dct_offset, dct_linesize, block[6]); s->dsp.idct_put(dest_cr + dct_offset, dct_linesize, block[7]); if(!s->chroma_x_shift){//Chroma444 s->dsp.idct_put(dest_cb + 8, dct_linesize, block[8]); s->dsp.idct_put(dest_cr + 8, dct_linesize, block[9]); s->dsp.idct_put(dest_cb + 8 + dct_offset, dct_linesize, block[10]); s->dsp.idct_put(dest_cr + 8 + dct_offset, dct_linesize, block[11]); } } }//gray } } skip_idct: if(!readable){ s->dsp.put_pixels_tab[0][0](s->dest[0], dest_y , linesize,16); s->dsp.put_pixels_tab[s->chroma_x_shift][0](s->dest[1], dest_cb, uvlinesize,16 >> s->chroma_y_shift); s->dsp.put_pixels_tab[s->chroma_x_shift][0](s->dest[2], dest_cr, uvlinesize,16 >> s->chroma_y_shift); } } }","No, it is non-vulnerable."433431,"static int compute_send_delay(HTTPContext *c) { int datarate = 8 * get_longterm_datarate(&c->datarate, c->data_count); if (datarate > c->stream->bandwidth * 2000) { return 1000; } return 0; }","Yes, it is vulnerable."434432,void OPPROTO op_check_addo (void) { if (likely(!(((uint32_t)T2 ^ (uint32_t)T1 ^ UINT32_MAX) & ((uint32_t)T2 ^ (uint32_t)T0) & (1UL << 31)))) { xer_ov = 0; } else { xer_so = 1; xer_ov = 1; } RETURN(); },"Yes, it is vulnerable."435433,"static gpointer writeout_thread(gpointer opaque) { TraceRecord *recordptr; union { TraceRecord rec; uint8_t bytes[sizeof(TraceRecord) + sizeof(uint64_t)]; } dropped; unsigned int idx = 0; int dropped_count; size_t unused __attribute__ ((unused)); for (;;) { wait_for_trace_records_available(); if (g_atomic_int_get(&dropped_events)) { dropped.rec.event = DROPPED_EVENT_ID, dropped.rec.timestamp_ns = get_clock(); dropped.rec.length = sizeof(TraceRecord) + sizeof(uint64_t), dropped.rec.reserved = 0; while (1) { dropped_count = g_atomic_int_get(&dropped_events); if (g_atomic_int_compare_and_exchange(&dropped_events, dropped_count, 0)) { break; } } dropped.rec.arguments[0] = dropped_count; unused = fwrite(&dropped.rec, dropped.rec.length, 1, trace_fp); } while (get_trace_record(idx, &recordptr)) { unused = fwrite(recordptr, recordptr->length, 1, trace_fp); writeout_idx += recordptr->length; free(recordptr); /* dont use g_free, can deadlock when traced */ idx = writeout_idx % TRACE_BUF_LEN; } fflush(trace_fp); } return NULL; }","Yes, it is vulnerable."436434,"static int handle_renames_and_mkdirs(BDRVVVFATState* s) { int i; #ifdef DEBUG fprintf(stderr, ""handle_renames\n""); for (i = 0; i < s->commits.next; i++) { commit_t* commit = array_get(&(s->commits), i); fprintf(stderr, ""%d, %s (%d, %d)\n"", i, commit->path ? commit->path : ""(null)"", commit->param.rename.cluster, commit->action); } #endif for (i = 0; i < s->commits.next;) { commit_t* commit = array_get(&(s->commits), i); if (commit->action == ACTION_RENAME) { mapping_t* mapping = find_mapping_for_cluster(s, commit->param.rename.cluster); char* old_path = mapping->path; assert(commit->path); mapping->path = commit->path; if (rename(old_path, mapping->path)) return -2; if (mapping->mode & MODE_DIRECTORY) { int l1 = strlen(mapping->path); int l2 = strlen(old_path); int diff = l1 - l2; direntry_t* direntry = array_get(&(s->directory), mapping->info.dir.first_dir_index); uint32_t c = mapping->begin; int i = 0; /* recurse */ while (!fat_eof(s, c)) { do { direntry_t* d = direntry + i; if (is_file(d) || (is_directory(d) && !is_dot(d))) { mapping_t* m = find_mapping_for_cluster(s, begin_of_direntry(d)); int l = strlen(m->path); char* new_path = g_malloc(l + diff + 1); assert(!strncmp(m->path, mapping->path, l2)); pstrcpy(new_path, l + diff + 1, mapping->path); pstrcpy(new_path + l1, l + diff + 1 - l1, m->path + l2); schedule_rename(s, m->begin, new_path); } i++; } while((i % (0x10 * s->sectors_per_cluster)) != 0); c = fat_get(s, c); } } free(old_path); array_remove(&(s->commits), i); continue; } else if (commit->action == ACTION_MKDIR) { mapping_t* mapping; int j, parent_path_len; #ifdef __MINGW32__ if (mkdir(commit->path)) return -5; #else if (mkdir(commit->path, 0755)) return -5; #endif mapping = insert_mapping(s, commit->param.mkdir.cluster, commit->param.mkdir.cluster + 1); if (mapping == NULL) return -6; mapping->mode = MODE_DIRECTORY; mapping->read_only = 0; mapping->path = commit->path; j = s->directory.next; assert(j); insert_direntries(s, s->directory.next, 0x10 * s->sectors_per_cluster); mapping->info.dir.first_dir_index = j; parent_path_len = strlen(commit->path) - strlen(get_basename(commit->path)) - 1; for (j = 0; j < s->mapping.next; j++) { mapping_t* m = array_get(&(s->mapping), j); if (m->first_mapping_index < 0 && m != mapping && !strncmp(m->path, mapping->path, parent_path_len) && strlen(m->path) == parent_path_len) break; } assert(j < s->mapping.next); mapping->info.dir.parent_mapping_index = j; array_remove(&(s->commits), i); continue; } i++; } return 0; }","Yes, it is vulnerable."437435,"AUXBus *aux_init_bus(DeviceState *parent, const char *name) { AUXBus *bus; bus = AUX_BUS(qbus_create(TYPE_AUX_BUS, parent, name)); bus->bridge = AUXTOI2C(qdev_create(BUS(bus), TYPE_AUXTOI2C)); /* Memory related. */ bus->aux_io = g_malloc(sizeof(*bus->aux_io)); memory_region_init(bus->aux_io, OBJECT(bus), ""aux-io"", (1 << 20)); address_space_init(&bus->aux_addr_space, bus->aux_io, ""aux-io""); return bus; }","Yes, it is vulnerable."438436,"static int vc1_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size, n_slices = 0, i, ret; VC1Context *v = avctx->priv_data; MpegEncContext *s = &v->s; AVFrame *pict = data; uint8_t *buf2 = NULL; const uint8_t *buf_start = buf; int mb_height, n_slices1; struct { uint8_t *buf; GetBitContext gb; int mby_start; } *slices = NULL, *tmp; /* no supplementary picture */ if (buf_size == 0 || (buf_size == 4 && AV_RB32(buf) == VC1_CODE_ENDOFSEQ)) { /* special case for last picture */ if (s->low_delay == 0 && s->next_picture_ptr) { if ((ret = av_frame_ref(pict, s->next_picture_ptr->f)) < 0) return ret; s->next_picture_ptr = NULL; *got_frame = 1; return 0; //for advanced profile we may need to parse and unescape data if (avctx->codec_id == AV_CODEC_ID_VC1 || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) { int buf_size2 = 0; buf2 = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE); if (IS_MARKER(AV_RB32(buf))) { /* frame starts with marker and needs to be parsed */ const uint8_t *start, *end, *next; int size; next = buf; for (start = buf, end = buf + buf_size; next < end; start = next) { next = find_next_marker(start + 4, end); size = next - start - 4; if (size <= 0) continue; switch (AV_RB32(start)) { case VC1_CODE_FRAME: if (avctx->hwaccel) buf_start = start; buf_size2 = vc1_unescape_buffer(start + 4, size, buf2); break; case VC1_CODE_FIELD: { int buf_size3; tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1)); if (!tmp) slices = tmp; slices[n_slices].buf = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!slices[n_slices].buf) buf_size3 = vc1_unescape_buffer(start + 4, size, slices[n_slices].buf); init_get_bits(&slices[n_slices].gb, slices[n_slices].buf, buf_size3 << 3); /* assuming that the field marker is at the exact middle, hope it's correct */ slices[n_slices].mby_start = s->mb_height >> 1; n_slices1 = n_slices - 1; // index of the last slice of the first field n_slices++; break; case VC1_CODE_ENTRYPOINT: /* it should be before frame data */ buf_size2 = vc1_unescape_buffer(start + 4, size, buf2); init_get_bits(&s->gb, buf2, buf_size2 * 8); ff_vc1_decode_entry_point(avctx, v, &s->gb); break; case VC1_CODE_SLICE: { int buf_size3; tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1)); if (!tmp) slices = tmp; slices[n_slices].buf = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!slices[n_slices].buf) buf_size3 = vc1_unescape_buffer(start + 4, size, slices[n_slices].buf); init_get_bits(&slices[n_slices].gb, slices[n_slices].buf, buf_size3 << 3); slices[n_slices].mby_start = get_bits(&slices[n_slices].gb, 9); n_slices++; break; } else if (v->interlace && ((buf[0] & 0xC0) == 0xC0)) { /* WVC1 interlaced stores both fields divided by marker */ const uint8_t *divider; int buf_size3; divider = find_next_marker(buf, buf + buf_size); if ((divider == (buf + buf_size)) || AV_RB32(divider) != VC1_CODE_FIELD) { av_log(avctx, AV_LOG_ERROR, ""Error in WVC1 interlaced frame\n""); } else { // found field marker, unescape second field tmp = av_realloc(slices, sizeof(*slices) * (n_slices+1)); if (!tmp) slices = tmp; slices[n_slices].buf = av_mallocz(buf_size + AV_INPUT_BUFFER_PADDING_SIZE); if (!slices[n_slices].buf) buf_size3 = vc1_unescape_buffer(divider + 4, buf + buf_size - divider - 4, slices[n_slices].buf); init_get_bits(&slices[n_slices].gb, slices[n_slices].buf, buf_size3 << 3); slices[n_slices].mby_start = s->mb_height >> 1; n_slices1 = n_slices - 1; n_slices++; buf_size2 = vc1_unescape_buffer(buf, divider - buf, buf2); } else { buf_size2 = vc1_unescape_buffer(buf, buf_size, buf2); init_get_bits(&s->gb, buf2, buf_size2*8); } else init_get_bits(&s->gb, buf, buf_size*8); if (v->res_sprite) { v->new_sprite = !get_bits1(&s->gb); v->two_sprites = get_bits1(&s->gb); /* res_sprite means a Windows Media Image stream, AV_CODEC_ID_*IMAGE means we're using the sprite compositor. These are intentionally kept separate so you can get the raw sprites by using the wmv3 decoder for WMVP or the vc1 one for WVP2 */ if (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) { if (v->new_sprite) { // switch AVCodecContext parameters to those of the sprites avctx->width = avctx->coded_width = v->sprite_width; avctx->height = avctx->coded_height = v->sprite_height; } else { goto image; if (s->context_initialized && (s->width != avctx->coded_width || s->height != avctx->coded_height)) { ff_vc1_decode_end(avctx); if (!s->context_initialized) { if (ff_msmpeg4_decode_init(avctx) < 0) if (ff_vc1_decode_init_alloc_tables(v) < 0) { ff_mpv_common_end(s); s->low_delay = !avctx->has_b_frames || v->res_sprite; if (v->profile == PROFILE_ADVANCED) { s->h_edge_pos = avctx->coded_width; s->v_edge_pos = avctx->coded_height; // do parse frame header v->pic_header_flag = 0; v->first_pic_header_flag = 1; if (v->profile < PROFILE_ADVANCED) { if (ff_vc1_parse_frame_header(v, &s->gb) < 0) { } else { if (ff_vc1_parse_frame_header_adv(v, &s->gb) < 0) { v->first_pic_header_flag = 0; if ((avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) && s->pict_type != AV_PICTURE_TYPE_I) { av_log(v->s.avctx, AV_LOG_ERROR, ""Sprite decoder: expected I-frame\n""); // for skipping the frame s->current_picture.f->pict_type = s->pict_type; s->current_picture.f->key_frame = s->pict_type == AV_PICTURE_TYPE_I; /* skip B-frames if we don't have reference frames */ if (!s->last_picture_ptr && (s->pict_type == AV_PICTURE_TYPE_B || s->droppable)) { goto end; if ((avctx->skip_frame >= AVDISCARD_NONREF && s->pict_type == AV_PICTURE_TYPE_B) || (avctx->skip_frame >= AVDISCARD_NONKEY && s->pict_type != AV_PICTURE_TYPE_I) || avctx->skip_frame >= AVDISCARD_ALL) { goto end; if (s->next_p_frame_damaged) { if (s->pict_type == AV_PICTURE_TYPE_B) goto end; else s->next_p_frame_damaged = 0; if (ff_mpv_frame_start(s, avctx) < 0) { // process pulldown flags s->current_picture_ptr->f->repeat_pict = 0; // Pulldown flags are only valid when 'broadcast' has been set. // So ticks_per_frame will be 2 if (v->rff) { // repeat field s->current_picture_ptr->f->repeat_pict = 1; } else if (v->rptfrm) { // repeat frames s->current_picture_ptr->f->repeat_pict = v->rptfrm * 2; s->me.qpel_put = s->qdsp.put_qpel_pixels_tab; s->me.qpel_avg = s->qdsp.avg_qpel_pixels_tab; if (avctx->hwaccel) { if (avctx->hwaccel->start_frame(avctx, buf, buf_size) < 0) if (avctx->hwaccel->decode_slice(avctx, buf_start, (buf + buf_size) - buf_start) < 0) if (avctx->hwaccel->end_frame(avctx) < 0) } else { int header_ret = 0; ff_mpeg_er_frame_start(s); v->bits = buf_size * 8; v->end_mb_x = s->mb_width; if (v->field_mode) { s->current_picture.f->linesize[0] <<= 1; s->current_picture.f->linesize[1] <<= 1; s->current_picture.f->linesize[2] <<= 1; s->linesize <<= 1; s->uvlinesize <<= 1; mb_height = s->mb_height >> v->field_mode; if (!mb_height) { av_log(v->s.avctx, AV_LOG_ERROR, ""Invalid mb_height.\n""); for (i = 0; i <= n_slices; i++) { if (i > 0 && slices[i - 1].mby_start >= mb_height) { if (v->field_mode <= 0) { av_log(v->s.avctx, AV_LOG_ERROR, ""Slice %d starts beyond "" ""picture boundary (%d >= %d)\n"", i, slices[i - 1].mby_start, mb_height); continue; v->second_field = 1; v->blocks_off = s->mb_width * s->mb_height << 1; v->mb_off = s->mb_stride * s->mb_height >> 1; } else { v->second_field = 0; v->blocks_off = 0; v->mb_off = 0; if (i) { v->pic_header_flag = 0; if (v->field_mode && i == n_slices1 + 2) { if ((header_ret = ff_vc1_parse_frame_header_adv(v, &s->gb)) < 0) { av_log(v->s.avctx, AV_LOG_ERROR, ""Field header damaged\n""); if (avctx->err_recognition & AV_EF_EXPLODE) continue; } else if (get_bits1(&s->gb)) { v->pic_header_flag = 1; if ((header_ret = ff_vc1_parse_frame_header_adv(v, &s->gb)) < 0) { av_log(v->s.avctx, AV_LOG_ERROR, ""Slice header damaged\n""); if (avctx->err_recognition & AV_EF_EXPLODE) continue; if (header_ret < 0) continue; s->start_mb_y = (i == 0) ? 0 : FFMAX(0, slices[i-1].mby_start % mb_height); if (!v->field_mode || v->second_field) s->end_mb_y = (i == n_slices ) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height); else s->end_mb_y = (i <= n_slices1 + 1) ? mb_height : FFMIN(mb_height, slices[i].mby_start % mb_height); ff_vc1_decode_blocks(v); if (i != n_slices) s->gb = slices[i].gb; if (v->field_mode) { v->second_field = 0; s->current_picture.f->linesize[0] >>= 1; s->current_picture.f->linesize[1] >>= 1; s->current_picture.f->linesize[2] >>= 1; s->linesize >>= 1; s->uvlinesize >>= 1; if (v->s.pict_type != AV_PICTURE_TYPE_BI && v->s.pict_type != AV_PICTURE_TYPE_B) { FFSWAP(uint8_t *, v->mv_f_next[0], v->mv_f[0]); FFSWAP(uint8_t *, v->mv_f_next[1], v->mv_f[1]); ff_dlog(s->avctx, ""Consumed %i/%i bits\n"", get_bits_count(&s->gb), s->gb.size_in_bits); // if (get_bits_count(&s->gb) > buf_size * 8) // return -1; if (!v->field_mode) ff_er_frame_end(&s->er); ff_mpv_frame_end(s); if (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE || avctx->codec_id == AV_CODEC_ID_VC1IMAGE) { image: avctx->width = avctx->coded_width = v->output_width; avctx->height = avctx->coded_height = v->output_height; if (avctx->skip_frame >= AVDISCARD_NONREF) goto end; #if CONFIG_WMV3IMAGE_DECODER || CONFIG_VC1IMAGE_DECODER if (vc1_decode_sprites(v, &s->gb)) #endif if ((ret = av_frame_ref(pict, v->sprite_output_frame)) < 0) *got_frame = 1; } else { if (s->pict_type == AV_PICTURE_TYPE_B || s->low_delay) { if ((ret = av_frame_ref(pict, s->current_picture_ptr->f)) < 0) ff_print_debug_info(s, s->current_picture_ptr); *got_frame = 1; } else if (s->last_picture_ptr) { if ((ret = av_frame_ref(pict, s->last_picture_ptr->f)) < 0) ff_print_debug_info(s, s->last_picture_ptr); *got_frame = 1; end: av_free(buf2); for (i = 0; i < n_slices; i++) av_free(slices[i].buf); av_free(slices); return buf_size; err: av_free(buf2); for (i = 0; i < n_slices; i++) av_free(slices[i].buf); av_free(slices); return -1;","Yes, it is vulnerable."439437,"static void qdev_print_devinfo(DeviceClass *dc) { error_printf(""name \""%s\"""", object_class_get_name(OBJECT_CLASS(dc))); if (dc->bus_type) { error_printf("", bus %s"", dc->bus_type); } if (qdev_class_has_alias(dc)) { error_printf("", alias \""%s\"""", qdev_class_get_alias(dc)); } if (dc->desc) { error_printf("", desc \""%s\"""", dc->desc); } if (dc->no_user) { error_printf("", no-user""); } error_printf(""\n""); }","Yes, it is vulnerable."440438,"static void switch_tss(int tss_selector, uint32_t e1, uint32_t e2, int source) { int tss_limit, tss_limit_max, type, old_tss_limit_max, old_type, v1, v2, i; uint8_t *tss_base; uint32_t new_regs[8], new_segs[6]; uint32_t new_eflags, new_eip, new_cr3, new_ldt, new_trap; uint32_t old_eflags, eflags_mask; SegmentCache *dt; int index; uint8_t *ptr; type = (e2 >> DESC_TYPE_SHIFT) & 0xf; #ifdef DEBUG_PCALL if (loglevel) fprintf(logfile, ""switch_tss: sel=0x%04x type=%d src=%d\n"", tss_selector, type, source); #endif /* if task gate, we read the TSS segment and we load it */ if (type == 5) { if (!(e2 & DESC_P_MASK)) raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc); tss_selector = e1 >> 16; if (tss_selector & 4) raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc); if (load_segment(&e1, &e2, tss_selector) != 0) raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc); if (e2 & DESC_S_MASK) raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc); type = (e2 >> DESC_TYPE_SHIFT) & 0xf; if ((type & 7) != 1) raise_exception_err(EXCP0D_GPF, tss_selector & 0xfffc); } if (!(e2 & DESC_P_MASK)) raise_exception_err(EXCP0B_NOSEG, tss_selector & 0xfffc); if (type & 8) tss_limit_max = 103; else tss_limit_max = 43; tss_limit = get_seg_limit(e1, e2); tss_base = get_seg_base(e1, e2); if ((tss_selector & 4) != 0 || tss_limit < tss_limit_max) raise_exception_err(EXCP0A_TSS, tss_selector & 0xfffc); old_type = (env->tr.flags >> DESC_TYPE_SHIFT) & 0xf; if (old_type & 8) old_tss_limit_max = 103; else old_tss_limit_max = 43; /* read all the registers from the new TSS */ if (type & 8) { /* 32 bit */ new_cr3 = ldl_kernel(tss_base + 0x1c); new_eip = ldl_kernel(tss_base + 0x20); new_eflags = ldl_kernel(tss_base + 0x24); for(i = 0; i < 8; i++) new_regs[i] = ldl_kernel(tss_base + (0x28 + i * 4)); for(i = 0; i < 6; i++) new_segs[i] = lduw_kernel(tss_base + (0x48 + i * 4)); new_ldt = lduw_kernel(tss_base + 0x60); new_trap = ldl_kernel(tss_base + 0x64); } else { /* 16 bit */ new_cr3 = 0; new_eip = lduw_kernel(tss_base + 0x0e); new_eflags = lduw_kernel(tss_base + 0x10); for(i = 0; i < 8; i++) new_regs[i] = lduw_kernel(tss_base + (0x12 + i * 2)) | 0xffff0000; for(i = 0; i < 4; i++) new_segs[i] = lduw_kernel(tss_base + (0x22 + i * 4)); new_ldt = lduw_kernel(tss_base + 0x2a); new_segs[R_FS] = 0; new_segs[R_GS] = 0; new_trap = 0; } /* NOTE: we must avoid memory exceptions during the task switch, so we make dummy accesses before */ /* XXX: it can still fail in some cases, so a bigger hack is necessary to valid the TLB after having done the accesses */ v1 = ldub_kernel(env->tr.base); v2 = ldub(env->tr.base + old_tss_limit_max); stb_kernel(env->tr.base, v1); stb_kernel(env->tr.base + old_tss_limit_max, v2); /* clear busy bit (it is restartable) */ if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_IRET) { uint8_t *ptr; uint32_t e2; ptr = env->gdt.base + (env->tr.selector << 3); e2 = ldl_kernel(ptr + 4); e2 &= ~DESC_TSS_BUSY_MASK; stl_kernel(ptr + 4, e2); } old_eflags = compute_eflags(); if (source == SWITCH_TSS_IRET) old_eflags &= ~NT_MASK; /* save the current state in the old TSS */ if (type & 8) { /* 32 bit */ stl_kernel(env->tr.base + 0x20, env->eip); stl_kernel(env->tr.base + 0x24, old_eflags); for(i = 0; i < 8; i++) stl_kernel(env->tr.base + (0x28 + i * 4), env->regs[i]); for(i = 0; i < 6; i++) stw_kernel(env->tr.base + (0x48 + i * 4), env->segs[i].selector); } else { /* 16 bit */ stw_kernel(env->tr.base + 0x0e, new_eip); stw_kernel(env->tr.base + 0x10, old_eflags); for(i = 0; i < 8; i++) stw_kernel(env->tr.base + (0x12 + i * 2), env->regs[i]); for(i = 0; i < 4; i++) stw_kernel(env->tr.base + (0x22 + i * 4), env->segs[i].selector); } /* now if an exception occurs, it will occurs in the next task context */ if (source == SWITCH_TSS_CALL) { stw_kernel(tss_base, env->tr.selector); new_eflags |= NT_MASK; } /* set busy bit */ if (source == SWITCH_TSS_JMP || source == SWITCH_TSS_CALL) { uint8_t *ptr; uint32_t e2; ptr = env->gdt.base + (tss_selector << 3); e2 = ldl_kernel(ptr + 4); e2 |= DESC_TSS_BUSY_MASK; stl_kernel(ptr + 4, e2); } /* set the new CPU state */ /* from this point, any exception which occurs can give problems */ env->cr[0] |= CR0_TS_MASK; env->tr.selector = tss_selector; env->tr.base = tss_base; env->tr.limit = tss_limit; env->tr.flags = e2 & ~DESC_TSS_BUSY_MASK; if ((type & 8) && (env->cr[0] & CR0_PG_MASK)) { env->cr[3] = new_cr3; cpu_x86_update_cr3(env); } /* load all registers without an exception, then reload them with possible exception */ env->eip = new_eip; eflags_mask = TF_MASK | AC_MASK | ID_MASK | IF_MASK | IOPL_MASK | VM_MASK | RF_MASK | NT_MASK; if (!(type & 8)) eflags_mask &= 0xffff; load_eflags(new_eflags, eflags_mask); for(i = 0; i < 8; i++) env->regs[i] = new_regs[i]; if (new_eflags & VM_MASK) { for(i = 0; i < 6; i++) load_seg_vm(i, new_segs[i]); /* in vm86, CPL is always 3 */ cpu_x86_set_cpl(env, 3); } else { /* CPL is set the RPL of CS */ cpu_x86_set_cpl(env, new_segs[R_CS] & 3); /* first just selectors as the rest may trigger exceptions */ for(i = 0; i < 6; i++) cpu_x86_load_seg_cache(env, i, new_segs[i], NULL, 0, 0); } env->ldt.selector = new_ldt & ~4; env->ldt.base = NULL; env->ldt.limit = 0; env->ldt.flags = 0; /* load the LDT */ if (new_ldt & 4) raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc); if ((new_ldt & 0xfffc) != 0) { dt = &env->gdt; index = new_ldt & ~7; if ((index + 7) > dt->limit) raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc); ptr = dt->base + index; e1 = ldl_kernel(ptr); e2 = ldl_kernel(ptr + 4); if ((e2 & DESC_S_MASK) || ((e2 >> DESC_TYPE_SHIFT) & 0xf) != 2) raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc); if (!(e2 & DESC_P_MASK)) raise_exception_err(EXCP0A_TSS, new_ldt & 0xfffc); load_seg_cache_raw_dt(&env->ldt, e1, e2); } /* load the segments */ if (!(new_eflags & VM_MASK)) { tss_load_seg(R_CS, new_segs[R_CS]); tss_load_seg(R_SS, new_segs[R_SS]); tss_load_seg(R_ES, new_segs[R_ES]); tss_load_seg(R_DS, new_segs[R_DS]); tss_load_seg(R_FS, new_segs[R_FS]); tss_load_seg(R_GS, new_segs[R_GS]); } /* check that EIP is in the CS segment limits */ if (new_eip > env->segs[R_CS].limit) { raise_exception_err(EXCP0D_GPF, 0); } }","No, it is non-vulnerable."441439,"uint32_t HELPER(neon_acgt_f32)(uint32_t a, uint32_t b) { float32 f0 = float32_abs(make_float32(a)); float32 f1 = float32_abs(make_float32(b)); if (float32_compare_quiet(f0, f1, NFS) == float_relation_greater) { return ~0; } return 0; }","No, it is non-vulnerable."442440,"sosendto(struct socket *so, struct mbuf *m) { Slirp *slirp = so->slirp; int ret; struct sockaddr_in addr; DEBUG_CALL(""sosendto""); DEBUG_ARG(""so = %p"", so); DEBUG_ARG(""m = %p"", m); addr.sin_family = AF_INET; if ((so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) == slirp->vnetwork_addr.s_addr) { /* It's an alias */ if (so->so_faddr.s_addr == slirp->vnameserver_addr.s_addr) { if (get_dns_addr(&addr.sin_addr) < 0) addr.sin_addr = loopback_addr; } else { addr.sin_addr = loopback_addr; } } else addr.sin_addr = so->so_faddr; addr.sin_port = so->so_fport; DEBUG_MISC((dfd, "" sendto()ing, addr.sin_port=%d, addr.sin_addr.s_addr=%.16s\n"", ntohs(addr.sin_port), inet_ntoa(addr.sin_addr))); /* Don't care what port we get */ ret = sendto(so->s, m->m_data, m->m_len, 0, (struct sockaddr *)&addr, sizeof (struct sockaddr)); if (ret < 0) return -1; /* * Kill the socket if there's no reply in 4 minutes, * but only if it's an expirable socket */ if (so->so_expire) so->so_expire = curtime + SO_EXPIRE; so->so_state &= SS_PERSISTENT_MASK; so->so_state |= SS_ISFCONNECTED; /* So that it gets select()ed */ return 0; }","No, it is non-vulnerable."443441,"void ff_hevc_hls_filter(HEVCContext *s, int x, int y, int ctb_size) { deblocking_filter_CTB(s, x, y); if (s->sps->sao_enabled) { int x_end = x >= s->sps->width - ctb_size; int y_end = y >= s->sps->height - ctb_size; if (y && x) sao_filter_CTB(s, x - ctb_size, y - ctb_size); if (x && y_end) sao_filter_CTB(s, x - ctb_size, y); if (y && x_end) { sao_filter_CTB(s, x, y - ctb_size); if (s->threads_type & FF_THREAD_FRAME ) ff_thread_report_progress(&s->ref->tf, y - ctb_size, 0); } if (x_end && y_end) { sao_filter_CTB(s, x , y); if (s->threads_type & FF_THREAD_FRAME ) ff_thread_report_progress(&s->ref->tf, y, 0); } } else { if (y && x >= s->sps->width - ctb_size) if (s->threads_type & FF_THREAD_FRAME ) ff_thread_report_progress(&s->ref->tf, y, 0); } }","No, it is non-vulnerable."444442,"static int advanced_decode_picture_primary_header(VC9Context *v) { GetBitContext *gb = &v->s.gb; static const int type_table[4] = { P_TYPE, B_TYPE, I_TYPE, BI_TYPE }; int type, i; if (v->interlace) { v->fcm = get_bits(gb, 1); if (v->fcm) v->fcm = 2+get_bits(gb, 1); } type = get_prefix(gb, 0, 4); if (type > 4 || type < 0) return FRAME_SKIPED; v->s.pict_type = type_table[type]; av_log(v->s.avctx, AV_LOG_INFO, ""AP Frame Type: %i\n"", v->s.pict_type); if (v->tfcntrflag) v->tfcntr = get_bits(gb, 8); if (v->broadcast) { if (!v->interlace) v->rptfrm = get_bits(gb, 2); else { v->tff = get_bits(gb, 1); v->rff = get_bits(gb, 1); } } if (v->panscanflag) { #if 0 for (i=0; i<v->numpanscanwin; i++) { v->topleftx[i] = get_bits(gb, 16); v->toplefty[i] = get_bits(gb, 16); v->bottomrightx[i] = get_bits(gb, 16); v->bottomrighty[i] = get_bits(gb, 16); } #else skip_bits(gb, 16*4*v->numpanscanwin); #endif } v->s.no_rounding = !get_bits(gb, 1); v->uvsamp = get_bits(gb, 1); if (v->finterpflag == 1) v->interpfrm = get_bits(gb, 1); switch(v->s.pict_type) { case I_TYPE: if (decode_i_picture_header(v) < 0) return -1; case P_TYPE: if (decode_p_picture_primary_header(v) < 0) return -1; case BI_TYPE: case B_TYPE: if (decode_b_picture_primary_header(v) < 0) return FRAME_SKIPED; default: break; } return 0; }","Yes, it is vulnerable."445443,static double get_video_clock(VideoState *is) { if (is->paused) { return is->video_current_pts; } else { return is->video_current_pts + (av_gettime() - is->video_current_pts_time) / 1000000.0; } },"Yes, it is vulnerable."446444,"long do_rt_sigreturn(CPUSH4State *regs) { struct target_rt_sigframe *frame; abi_ulong frame_addr; sigset_t blocked; target_ulong r0; frame_addr = regs->gregs[15]; trace_user_do_rt_sigreturn(regs, frame_addr); if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { goto badframe; } target_to_host_sigset(&blocked, &frame->uc.tuc_sigmask); do_sigprocmask(SIG_SETMASK, &blocked, NULL); restore_sigcontext(regs, &frame->uc.tuc_mcontext, &r0); if (do_sigaltstack(frame_addr + offsetof(struct target_rt_sigframe, uc.tuc_stack), 0, get_sp_from_cpustate(regs)) == -EFAULT) { goto badframe; } unlock_user_struct(frame, frame_addr, 0); return r0; badframe: unlock_user_struct(frame, frame_addr, 0); force_sig(TARGET_SIGSEGV); return 0; }","No, it is non-vulnerable."447445,"static void patch_reloc(uint8_t *code_ptr, int type, intptr_t value, intptr_t addend) { uint32_t insn; value += addend; switch (type) { case R_SPARC_32: if (value != (uint32_t)value) { tcg_abort(); } *(uint32_t *)code_ptr = value; break; case R_SPARC_WDISP16: value -= (intptr_t)code_ptr; if (!check_fit_tl(value >> 2, 16)) { tcg_abort(); } insn = *(uint32_t *)code_ptr; insn &= ~INSN_OFF16(-1); insn |= INSN_OFF16(value); *(uint32_t *)code_ptr = insn; break; case R_SPARC_WDISP19: value -= (intptr_t)code_ptr; if (!check_fit_tl(value >> 2, 19)) { tcg_abort(); } insn = *(uint32_t *)code_ptr; insn &= ~INSN_OFF19(-1); insn |= INSN_OFF19(value); *(uint32_t *)code_ptr = insn; break; default: tcg_abort(); } }","No, it is non-vulnerable."448446,"static int v9fs_synth_unlinkat(FsContext *ctx, V9fsPath *dir, const char *name, int flags) { errno = EPERM; return -1; }","No, it is non-vulnerable."449447,"void json_start_object(QJSON *json, const char *name) { json_emit_element(json, name); qstring_append(json->str, ""{ ""); json->omit_comma = true; }","No, it is non-vulnerable."450448,"START_TEST(qdict_get_int_test) { int ret; const int value = 100; const char *key = ""int""; qdict_put(tests_dict, key, qint_from_int(value)); ret = qdict_get_int(tests_dict, key); fail_unless(ret == value); }","No, it is non-vulnerable."451449,"static void float64_maddsub_update_excp(CPUPPCState *env, float64 arg1, float64 arg2, float64 arg3, unsigned int madd_flags) { if (unlikely((float64_is_infinity(arg1) && float64_is_zero(arg2)) || (float64_is_zero(arg1) && float64_is_infinity(arg2)))) { /* Multiplication of zero by infinity */ arg1 = float_invalid_op_excp(env, POWERPC_EXCP_FP_VXIMZ, 1); } else if (unlikely(float64_is_signaling_nan(arg1, &env->fp_status) || float64_is_signaling_nan(arg2, &env->fp_status) || float64_is_signaling_nan(arg3, &env->fp_status))) { /* sNaN operation */ float_invalid_op_excp(env, POWERPC_EXCP_FP_VXSNAN, 1); } else if ((float64_is_infinity(arg1) || float64_is_infinity(arg2)) && float64_is_infinity(arg3)) { uint8_t aSign, bSign, cSign; aSign = float64_is_neg(arg1); bSign = float64_is_neg(arg2); cSign = float64_is_neg(arg3); if (madd_flags & float_muladd_negate_c) { cSign ^= 1; } if (aSign ^ bSign ^ cSign) { float_invalid_op_excp(env, POWERPC_EXCP_FP_VXISI, 1); } } }","No, it is non-vulnerable."452450,"static uint32_t check_alarm(RTCState *s) { uint8_t alarm_hour, alarm_min, alarm_sec; uint8_t cur_hour, cur_min, cur_sec; alarm_sec = rtc_from_bcd(s, s->cmos_data[RTC_SECONDS_ALARM]); alarm_min = rtc_from_bcd(s, s->cmos_data[RTC_MINUTES_ALARM]); alarm_hour = rtc_from_bcd(s, s->cmos_data[RTC_HOURS_ALARM]); alarm_hour = convert_hour(s, alarm_hour); cur_sec = rtc_from_bcd(s, s->cmos_data[RTC_SECONDS]); cur_min = rtc_from_bcd(s, s->cmos_data[RTC_MINUTES]); cur_hour = rtc_from_bcd(s, s->cmos_data[RTC_HOURS]); cur_hour = convert_hour(s, cur_hour); if (((s->cmos_data[RTC_SECONDS_ALARM] & 0xc0) == 0xc0 || alarm_sec == cur_sec) && ((s->cmos_data[RTC_MINUTES_ALARM] & 0xc0) == 0xc0 || alarm_min == cur_min) && ((s->cmos_data[RTC_HOURS_ALARM] & 0xc0) == 0xc0 || alarm_hour == cur_hour)) { return 1; } return 0; }","No, it is non-vulnerable."453451,"static int get_dns_addr(struct in_addr *pdns_addr) { char buff[512]; char buff2[257]; FILE *f; int found = 0; struct in_addr tmp_addr; f = fopen(""/etc/resolv.conf"", ""r""); if (!f) return -1; #ifdef DEBUG lprint(""IP address of your DNS(s): ""); #endif while (fgets(buff, 512, f) != NULL) { if (sscanf(buff, ""nameserver%*[ \t]%256s"", buff2) == 1) { if (!inet_aton(buff2, &tmp_addr)) continue; if (tmp_addr.s_addr == loopback_addr.s_addr) tmp_addr = our_addr; /* If it's the first one, set it to dns_addr */ if (!found) *pdns_addr = tmp_addr; #ifdef DEBUG else lprint("", ""); #endif if (++found > 3) { #ifdef DEBUG lprint(""(more)""); #endif break; } #ifdef DEBUG else lprint(""%s"", inet_ntoa(tmp_addr)); #endif } } fclose(f); if (!found) return -1; return 0; }","No, it is non-vulnerable."454452,"static bool aio_epoll_try_enable(AioContext *ctx) { AioHandler *node; struct epoll_event event; QLIST_FOREACH(node, &ctx->aio_handlers, node) { int r; if (node->deleted || !node->pfd.events) { continue; } event.events = epoll_events_from_pfd(node->pfd.events); event.data.ptr = node; r = epoll_ctl(ctx->epollfd, EPOLL_CTL_ADD, node->pfd.fd, &event); if (r) { return false; } } ctx->epoll_enabled = true; return true; }","No, it is non-vulnerable."455453,"static int bt_parse(const char *opt) { const char *endp, *p; int vlan; if (strstart(opt, ""hci"", &endp)) { if (!*endp || *endp == ',') { if (*endp) if (!strstart(endp, "",vlan="", 0)) opt = endp + 1; return bt_hci_parse(opt); } } else if (strstart(opt, ""vhci"", &endp)) { if (!*endp || *endp == ',') { if (*endp) { if (strstart(endp, "",vlan="", &p)) { vlan = strtol(p, (char **) &endp, 0); if (*endp) { fprintf(stderr, ""qemu: bad scatternet '%s'\n"", p); return 1; } } else { fprintf(stderr, ""qemu: bad parameter '%s'\n"", endp + 1); return 1; } } else vlan = 0; bt_vhci_add(vlan); return 0; } } else if (strstart(opt, ""device:"", &endp)) return !bt_device_add(endp); fprintf(stderr, ""qemu: bad bluetooth parameter '%s'\n"", opt); return 1; }","No, it is non-vulnerable."456454,"static void omap_mpui_io_write(void *opaque, target_phys_addr_t addr, uint64_t value, unsigned size) { /* FIXME: infinite loop */ omap_badwidth_write16(opaque, addr, value); }","No, it is non-vulnerable."457455,"static int ipvideo_decode_block_opcode_0xC(IpvideoContext *s) { int x, y; /* 16-color block encoding: each 2x2 block is a different color */ CHECK_STREAM_PTR(16); for (y = 0; y < 8; y += 2) { for (x = 0; x < 8; x += 2) { s->pixel_ptr[x ] = s->pixel_ptr[x + 1 ] = s->pixel_ptr[x + s->stride] = s->pixel_ptr[x + 1 + s->stride] = *s->stream_ptr++; } s->pixel_ptr += s->stride * 2; } /* report success */ return 0; }","No, it is non-vulnerable."458456,"static void term_handle_command(char *cmdline) { char *p, *pstart; int argc; const char *args[MAX_ARGS + 1]; term_cmd_t *cmd; #ifdef DEBUG term_printf(""command='%s'\n"", cmdline); #endif /* split command in words */ argc = 0; p = cmdline; for(;;) { while (isspace(*p)) p++; if (*p == '\0') break; pstart = p; while (*p != '\0' && !isspace(*p)) p++; args[argc] = pstart; argc++; if (argc >= MAX_ARGS) break; if (*p == '\0') break; *p++ = '\0'; } args[argc] = NULL; #ifdef DEBUG for(i=0;i<argc;i++) { term_printf("" '%s'"", args[i]); } term_printf(""\n""); #endif if (argc <= 0) return; for(cmd = term_cmds; cmd->name != NULL; cmd++) { if (compare_cmd(args[0], cmd->name)) goto found; } term_printf(""unknown command: '%s'\n"", args[0]); return; found: cmd->handler(argc, args); }","No, it is non-vulnerable."459457,"static void m5206_mbar_writew(void *opaque, target_phys_addr_t offset, uint32_t value) { m5206_mbar_state *s = (m5206_mbar_state *)opaque; int width; offset &= 0x3ff; if (offset > 0x200) { hw_error(""Bad MBAR write offset 0x%x"", (int)offset); } width = m5206_mbar_width[offset >> 2]; if (width > 2) { uint32_t tmp; tmp = m5206_mbar_readl(opaque, offset & ~3); if (offset & 3) { tmp = (tmp & 0xffff0000) | value; } else { tmp = (tmp & 0x0000ffff) | (value << 16); } m5206_mbar_writel(opaque, offset & ~3, tmp); return; } else if (width < 2) { m5206_mbar_writeb(opaque, offset, value >> 8); m5206_mbar_writeb(opaque, offset + 1, value & 0xff); return; } m5206_mbar_write(s, offset, value, 2); }","Yes, it is vulnerable."460458,"static void test_ivshmem_server(bool msi) { IVState state1, state2, *s1, *s2; ServerThread thread; IvshmemServer server; int ret, vm1, vm2; int nvectors = 2; guint64 end_time = g_get_monotonic_time() + 5 * G_TIME_SPAN_SECOND; ret = ivshmem_server_init(&server, tmpserver, tmpshm, true, TMPSHMSIZE, nvectors, g_test_verbose()); g_assert_cmpint(ret, ==, 0); ret = ivshmem_server_start(&server); g_assert_cmpint(ret, ==, 0); setup_vm_with_server(&state1, nvectors, msi); s1 = &state1; setup_vm_with_server(&state2, nvectors, msi); s2 = &state2; /* check state before server sends stuff */ g_assert_cmpuint(in_reg(s1, IVPOSITION), ==, 0xffffffff); g_assert_cmpuint(in_reg(s2, IVPOSITION), ==, 0xffffffff); g_assert_cmpuint(qtest_readb(s1->qtest, (uintptr_t)s1->mem_base), ==, 0x00); thread.server = &server; ret = pipe(thread.pipe); g_assert_cmpint(ret, ==, 0); thread.thread = g_thread_new(""ivshmem-server"", server_thread, &thread); g_assert(thread.thread != NULL); /* waiting for devices to become operational */ while (g_get_monotonic_time() < end_time) { g_usleep(1000); if ((int)in_reg(s1, IVPOSITION) >= 0 && (int)in_reg(s2, IVPOSITION) >= 0) { break; } } /* check got different VM ids */ vm1 = in_reg(s1, IVPOSITION); vm2 = in_reg(s2, IVPOSITION); g_assert_cmpuint(vm1, !=, vm2); /* check number of MSI-X vectors */ global_qtest = s1->qtest; if (msi) { ret = qpci_msix_table_size(s1->dev); g_assert_cmpuint(ret, ==, nvectors); } /* TODO test behavior before MSI-X is enabled */ /* ping vm2 -> vm1 on vector 0 */ if (msi) { ret = qpci_msix_pending(s1->dev, 0); g_assert_cmpuint(ret, ==, 0); } else { g_assert_cmpuint(in_reg(s1, INTRSTATUS), ==, 0); } out_reg(s2, DOORBELL, vm1 << 16); do { g_usleep(10000); ret = msi ? qpci_msix_pending(s1->dev, 0) : in_reg(s1, INTRSTATUS); } while (ret == 0 && g_get_monotonic_time() < end_time); g_assert_cmpuint(ret, !=, 0); /* ping vm1 -> vm2 on vector 1 */ global_qtest = s2->qtest; if (msi) { ret = qpci_msix_pending(s2->dev, 1); g_assert_cmpuint(ret, ==, 0); } else { g_assert_cmpuint(in_reg(s2, INTRSTATUS), ==, 0); } out_reg(s1, DOORBELL, vm2 << 16 | 1); do { g_usleep(10000); ret = msi ? qpci_msix_pending(s2->dev, 1) : in_reg(s2, INTRSTATUS); } while (ret == 0 && g_get_monotonic_time() < end_time); g_assert_cmpuint(ret, !=, 0); cleanup_vm(s2); cleanup_vm(s1); if (qemu_write_full(thread.pipe[1], ""q"", 1) != 1) { g_error(""qemu_write_full: %s"", g_strerror(errno)); } g_thread_join(thread.thread); ivshmem_server_close(&server); close(thread.pipe[1]); close(thread.pipe[0]); }","Yes, it is vulnerable."461459,"int qemu_peek_byte(QEMUFile *f, int offset) { int index = f->buf_index + offset; assert(!qemu_file_is_writable(f)); assert(offset < IO_BUF_SIZE); if (index >= f->buf_size) { qemu_fill_buffer(f); index = f->buf_index + offset; if (index >= f->buf_size) { return 0; } } return f->buf[index]; }","Yes, it is vulnerable."462460,"static void FUNCC(pred8x8_horizontal)(uint8_t *_src, int stride){ int i; pixel *src = (pixel*)_src; stride /= sizeof(pixel); for(i=0; i<8; i++){ ((pixel4*)(src+i*stride))[0]= ((pixel4*)(src+i*stride))[1]= PIXEL_SPLAT_X4(src[-1+i*stride]); } }","Yes, it is vulnerable."463461,"monitor_protocol_event_queue(MonitorEvent event, QObject *data) { MonitorEventState *evstate; int64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME); assert(event < QEVENT_MAX); qemu_mutex_lock(&monitor_event_state_lock); evstate = &(monitor_event_state[event]); trace_monitor_protocol_event_queue(event, data, evstate->rate, evstate->last, now); /* Rate limit of 0 indicates no throttling */ if (!evstate->rate) { monitor_protocol_event_emit(event, data); evstate->last = now; } else { int64_t delta = now - evstate->last; if (evstate->data || delta < evstate->rate) { /* If there's an existing event pending, replace * it with the new event, otherwise schedule a * timer for delayed emission */ if (evstate->data) { qobject_decref(evstate->data); } else { int64_t then = evstate->last + evstate->rate; timer_mod_ns(evstate->timer, then); } evstate->data = data; qobject_incref(evstate->data); } else { monitor_protocol_event_emit(event, data); evstate->last = now; } } qemu_mutex_unlock(&monitor_event_state_lock); }","Yes, it is vulnerable."464462,"static int qemu_gluster_create(const char *filename, QemuOpts *opts, Error **errp) { struct glfs *glfs; struct glfs_fd *fd; int ret = 0; int prealloc = 0; int64_t total_size = 0; char *tmp = NULL; GlusterConf *gconf = g_malloc0(sizeof(GlusterConf)); glfs = qemu_gluster_init(gconf, filename, errp); if (!glfs) { ret = -errno; goto out; } total_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0) / BDRV_SECTOR_SIZE; tmp = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC); if (!tmp || !strcmp(tmp, ""off"")) { prealloc = 0; } else if (!strcmp(tmp, ""full"") && gluster_supports_zerofill()) { prealloc = 1; } else { error_setg(errp, ""Invalid preallocation mode: '%s'"" "" or GlusterFS doesn't support zerofill API"", tmp); ret = -EINVAL; goto out; } fd = glfs_creat(glfs, gconf->image, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, S_IRUSR | S_IWUSR); if (!fd) { ret = -errno; } else { if (!glfs_ftruncate(fd, total_size * BDRV_SECTOR_SIZE)) { if (prealloc && qemu_gluster_zerofill(fd, 0, total_size * BDRV_SECTOR_SIZE)) { ret = -errno; } } else { ret = -errno; } if (glfs_close(fd) != 0) { ret = -errno; } } out: g_free(tmp); qemu_gluster_gconf_free(gconf); if (glfs) { glfs_fini(glfs); } return ret; }","Yes, it is vulnerable."465463,"void *qemu_memalign(size_t alignment, size_t size) { if (!size) { abort(); } return oom_check(VirtualAlloc(NULL, size, MEM_COMMIT, PAGE_READWRITE)); }","Yes, it is vulnerable."466464,"static void decode_parameters(SiprParameters* parms, GetBitContext *pgb, const SiprModeParam *p) { int i, j; parms->ma_pred_switch = get_bits(pgb, p->ma_predictor_bits); for (i = 0; i < 5; i++) parms->vq_indexes[i] = get_bits(pgb, p->vq_indexes_bits[i]); for (i = 0; i < p->subframe_count; i++) { parms->pitch_delay[i] = get_bits(pgb, p->pitch_delay_bits[i]); parms->gp_index[i] = get_bits(pgb, p->gp_index_bits); for (j = 0; j < p->number_of_fc_indexes; j++) parms->fc_indexes[i][j] = get_bits(pgb, p->fc_index_bits[j]); parms->gc_index[i] = get_bits(pgb, p->gc_index_bits); } }","No, it is non-vulnerable."467465,"static void slow_bar_writel(void *opaque, target_phys_addr_t addr, uint32_t val) { AssignedDevRegion *d = opaque; uint32_t *out = (uint32_t *)(d->u.r_virtbase + addr); DEBUG(""slow_bar_writel addr=0x"" TARGET_FMT_plx "" val=0x%08x\n"", addr, val); *out = val; }","No, it is non-vulnerable."468466,"SCSIDevice *scsi_bus_legacy_add_drive(SCSIBus *bus, DriveInfo *dinfo, int unit) { const char *driver; DeviceState *dev; driver = bdrv_is_sg(dinfo->bdrv) ? ""scsi-generic"" : ""scsi-disk""; dev = qdev_create(&bus->qbus, driver); qdev_prop_set_uint32(dev, ""scsi-id"", unit); qdev_prop_set_drive(dev, ""drive"", dinfo); if (qdev_init(dev) < 0) return NULL; return DO_UPCAST(SCSIDevice, qdev, dev); }","No, it is non-vulnerable."469467,"static void xen_log_stop(MemoryListener *listener, MemoryRegionSection *section) { XenIOState *state = container_of(listener, XenIOState, memory_listener); state->log_for_dirtybit = NULL; /* Disable dirty bit tracking */ xc_hvm_track_dirty_vram(xen_xc, xen_domid, 0, 0, NULL); }","No, it is non-vulnerable."470468,"static int vtd_int_remap(X86IOMMUState *iommu, MSIMessage *src, MSIMessage *dst, uint16_t sid) { return vtd_interrupt_remap_msi(INTEL_IOMMU_DEVICE(iommu), src, dst); }","No, it is non-vulnerable."471469,"static void core_region_nop(MemoryListener *listener, MemoryRegionSection *section) { cpu_register_physical_memory_log(section, section->readonly); }","No, it is non-vulnerable."472470,"float32 uint64_to_float32( uint64 a STATUS_PARAM ) { int8 shiftCount; if ( a == 0 ) return 0; shiftCount = countLeadingZeros64( a ) - 40; if ( 0 <= shiftCount ) { return packFloat32( 1 > 0, 0x95 - shiftCount, a<<shiftCount ); } else { shiftCount += 7; if ( shiftCount < 0 ) { shift64RightJamming( a, - shiftCount, &a ); } else { a <<= shiftCount; } return roundAndPackFloat32( 1 > 0, 0x9C - shiftCount, a STATUS_VAR ); } }","No, it is non-vulnerable."473471,"static void do_change_vnc(const char *target, const char *arg) { if (strcmp(target, ""passwd"") == 0 || strcmp(target, ""password"") == 0) { char password[9]; if (arg) { strncpy(password, arg, sizeof(password)); password[sizeof(password) - 1] = '\0'; } else monitor_readline(""Password: "", 1, password, sizeof(password)); if (vnc_display_password(NULL, password) < 0) term_printf(""could not set VNC server password\n""); } else { if (vnc_display_open(NULL, target) < 0) term_printf(""could not start VNC server on %s\n"", target); } }","No, it is non-vulnerable."474472,"static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun, int evpd, int pc, Error **errp) { int full_size; struct scsi_task *task = NULL; task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, 64); if (task == NULL || task->status != SCSI_STATUS_GOOD) { goto fail; } full_size = scsi_datain_getfullsize(task); if (full_size > task->datain.size) { scsi_free_scsi_task(task); /* we need more data for the full list */ task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, full_size); if (task == NULL || task->status != SCSI_STATUS_GOOD) { goto fail; } } return task; fail: error_setg(errp, ""iSCSI: Inquiry command failed : %s"", iscsi_get_error(iscsi)); if (task) { scsi_free_scsi_task(task); return NULL; } return NULL; }","No, it is non-vulnerable."475473,av_cold void rgb2rgb_init_x86(void) { #if HAVE_INLINE_ASM int cpu_flags = av_get_cpu_flags(); if (cpu_flags & AV_CPU_FLAG_MMX) rgb2rgb_init_MMX(); if (HAVE_AMD3DNOW && cpu_flags & AV_CPU_FLAG_3DNOW) rgb2rgb_init_3DNOW(); if (HAVE_MMXEXT && cpu_flags & AV_CPU_FLAG_MMXEXT) rgb2rgb_init_MMX2(); if (HAVE_SSE && cpu_flags & AV_CPU_FLAG_SSE2) rgb2rgb_init_SSE2(); #endif /* HAVE_INLINE_ASM */ },"No, it is non-vulnerable."476474,"static int mp3_header_compress(AVBitStreamFilterContext *bsfc, AVCodecContext *avctx, const char *args, uint8_t **poutbuf, int *poutbuf_size, const uint8_t *buf, int buf_size, int keyframe){ uint32_t header; int mode_extension; if(avctx->strict_std_compliance > FF_COMPLIANCE_EXPERIMENTAL){ av_log(avctx, AV_LOG_ERROR, ""not standards compliant\n""); return -1; } header = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3]; mode_extension= (header>>4)&3; if(ff_mpa_check_header(header) < 0 || (header&0x70000) != 0x30000){ *poutbuf= (uint8_t *) buf; *poutbuf_size= buf_size; av_log(avctx, AV_LOG_INFO, ""cannot compress %08X\n"", header); return 0; } *poutbuf_size= buf_size - 4; *poutbuf= av_malloc(buf_size - 4 + FF_INPUT_BUFFER_PADDING_SIZE); memcpy(*poutbuf, buf + 4, buf_size - 4 + FF_INPUT_BUFFER_PADDING_SIZE); if(avctx->channels==2){ if((header & (3<<19)) != 3<<19){ (*poutbuf)[1] &= 0x3F; (*poutbuf)[1] |= mode_extension<<6; FFSWAP(int, (*poutbuf)[1], (*poutbuf)[2]); }else{ (*poutbuf)[1] &= 0x8F; (*poutbuf)[1] |= mode_extension<<4; } } return 1; }","No, it is non-vulnerable."477475,"static void virtio_net_add_queue(VirtIONet *n, int index) { VirtIODevice *vdev = VIRTIO_DEVICE(n); n->vqs[index].rx_vq = virtio_add_queue(vdev, 256, virtio_net_handle_rx); if (n->net_conf.tx && !strcmp(n->net_conf.tx, ""timer"")) { n->vqs[index].tx_vq = virtio_add_queue(vdev, 256, virtio_net_handle_tx_timer); n->vqs[index].tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, virtio_net_tx_timer, &n->vqs[index]); } else { n->vqs[index].tx_vq = virtio_add_queue(vdev, 256, virtio_net_handle_tx_bh); n->vqs[index].tx_bh = qemu_bh_new(virtio_net_tx_bh, &n->vqs[index]); } n->vqs[index].tx_waiting = 0; n->vqs[index].n = n; }","Yes, it is vulnerable."478476,"static int grackle_pci_host_init(PCIDevice *d) { pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_MOTOROLA); pci_config_set_device_id(d->config, PCI_DEVICE_ID_MOTOROLA_MPC106); d->config[0x08] = 0x00; // revision d->config[0x09] = 0x01; pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST); return 0; }","No, it is non-vulnerable."479477,"static void icp_realize(DeviceState *dev, Error **errp) { ICPState *icp = ICP(dev); ICPStateClass *icpc = ICP_GET_CLASS(dev); Object *obj; Error *err = NULL; obj = object_property_get_link(OBJECT(dev), ICP_PROP_XICS, &err); if (!obj) { error_setg(errp, ""%s: required link '"" ICP_PROP_XICS ""' not found: %s"", __func__, error_get_pretty(err)); return; } icp->xics = XICS_FABRIC(obj); if (icpc->realize) { icpc->realize(dev, errp); } qemu_register_reset(icp_reset, dev); }","No, it is non-vulnerable."480478,"static void test_visitor_in_native_list_int(TestInputVisitorData *data, const void *unused) { test_native_list_integer_helper(data, unused, USER_DEF_NATIVE_LIST_UNION_KIND_INTEGER); }","No, it is non-vulnerable."481479,"static void test_qemu_strtoull_max(void) { char *str = g_strdup_printf(""%llu"", ULLONG_MAX); char f = 'X'; const char *endptr = &f; uint64_t res = 999; int err; err = qemu_strtoull(str, &endptr, 0, &res); g_assert_cmpint(err, ==, 0); g_assert_cmpint(res, ==, ULLONG_MAX); g_assert(endptr == str + strlen(str)); g_free(str); }","No, it is non-vulnerable."482480,"static inline void* array_get_next(array_t* array) { unsigned int next = array->next; void* result; if (array_ensure_allocated(array, next) < 0) return NULL; array->next = next + 1; result = array_get(array, next); return result; }","No, it is non-vulnerable."483481,"static int raw_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf, int nb_sectors) { return bdrv_read(bs->file, sector_num, buf, nb_sectors); }","No, it is non-vulnerable."484482,"static uint32_t omap2_gpio_module_readp(void *opaque, target_phys_addr_t addr) { return omap2_gpio_module_readp(opaque, addr) >> ((addr & 3) << 3); }","Yes, it is vulnerable."485483,"static void guest_fsfreeze_cleanup(void) { int64_t ret; Error *err = NULL; if (ga_is_frozen(ga_state) == GUEST_FSFREEZE_STATUS_FROZEN) { ret = qmp_guest_fsfreeze_thaw(&err); if (ret < 0 || err) { slog(""failed to clean up frozen filesystems""); } } }","Yes, it is vulnerable."486484,"static int set_segment_filename(AVFormatContext *s) { SegmentContext *seg = s->priv_data; AVFormatContext *oc = seg->avf; size_t size; if (seg->segment_idx_wrap) seg->segment_idx %= seg->segment_idx_wrap; if (seg->use_strftime) { time_t now0; struct tm *tm, tmpbuf; time(&now0); tm = localtime_r(&now0, &tmpbuf); if (!strftime(oc->filename, sizeof(oc->filename), s->filename, tm)) { av_log(oc, AV_LOG_ERROR, ""Could not get segment filename with strftime\n""); return AVERROR(EINVAL); } } else if (av_get_frame_filename(oc->filename, sizeof(oc->filename), s->filename, seg->segment_idx) < 0) { av_log(oc, AV_LOG_ERROR, ""Invalid segment filename template '%s'\n"", s->filename); return AVERROR(EINVAL); } /* copy modified name in list entry */ size = strlen(av_basename(oc->filename)) + 1; if (seg->entry_prefix) size += strlen(seg->entry_prefix); seg->cur_entry.filename = av_mallocz(size); if (!seg->cur_entry.filename) return AVERROR(ENOMEM); snprintf(seg->cur_entry.filename, size, ""%s%s"", seg->entry_prefix ? seg->entry_prefix : """", av_basename(oc->filename)); return 0; }","Yes, it is vulnerable."487485,"petalogix_s3adsp1800_init(MachineState *machine) { ram_addr_t ram_size = machine->ram_size; DeviceState *dev; MicroBlazeCPU *cpu; DriveInfo *dinfo; int i; hwaddr ddr_base = MEMORY_BASEADDR; MemoryRegion *phys_lmb_bram = g_new(MemoryRegion, 1); MemoryRegion *phys_ram = g_new(MemoryRegion, 1); qemu_irq irq[32]; MemoryRegion *sysmem = get_system_memory(); cpu = MICROBLAZE_CPU(object_new(TYPE_MICROBLAZE_CPU)); object_property_set_bool(OBJECT(cpu), true, ""realized"", &error_abort); /* Attach emulated BRAM through the LMB. */ memory_region_init_ram(phys_lmb_bram, NULL, ""petalogix_s3adsp1800.lmb_bram"", LMB_BRAM_SIZE, &error_abort); vmstate_register_ram_global(phys_lmb_bram); memory_region_add_subregion(sysmem, 0x00000000, phys_lmb_bram); memory_region_init_ram(phys_ram, NULL, ""petalogix_s3adsp1800.ram"", ram_size, &error_abort); vmstate_register_ram_global(phys_ram); memory_region_add_subregion(sysmem, ddr_base, phys_ram); dinfo = drive_get(IF_PFLASH, 0, 0); pflash_cfi01_register(FLASH_BASEADDR, NULL, ""petalogix_s3adsp1800.flash"", FLASH_SIZE, dinfo ? blk_by_legacy_dinfo(dinfo) : NULL, (64 * 1024), FLASH_SIZE >> 16, 1, 0x89, 0x18, 0x0000, 0x0, 1); dev = qdev_create(NULL, ""xlnx.xps-intc""); qdev_prop_set_uint32(dev, ""kind-of-intr"", 1 << ETHLITE_IRQ | 1 << UARTLITE_IRQ); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, INTC_BASEADDR); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(DEVICE(cpu), MB_CPU_IRQ)); for (i = 0; i < 32; i++) { irq[i] = qdev_get_gpio_in(dev, i); } sysbus_create_simple(""xlnx.xps-uartlite"", UARTLITE_BASEADDR, irq[UARTLITE_IRQ]); /* 2 timers at irq 2 @ 62 Mhz. */ dev = qdev_create(NULL, ""xlnx.xps-timer""); qdev_prop_set_uint32(dev, ""one-timer-only"", 0); qdev_prop_set_uint32(dev, ""clock-frequency"", 62 * 1000000); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, TIMER_BASEADDR); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[TIMER_IRQ]); qemu_check_nic_model(&nd_table[0], ""xlnx.xps-ethernetlite""); dev = qdev_create(NULL, ""xlnx.xps-ethernetlite""); qdev_set_nic_properties(dev, &nd_table[0]); qdev_prop_set_uint32(dev, ""tx-ping-pong"", 0); qdev_prop_set_uint32(dev, ""rx-ping-pong"", 0); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, ETHLITE_BASEADDR); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, irq[ETHLITE_IRQ]); microblaze_load_kernel(cpu, ddr_base, ram_size, machine->initrd_filename, BINARY_DEVICE_TREE_FILE, NULL); }","Yes, it is vulnerable."488486,"static ssize_t flush_buf(VirtIOSerialPort *port, const uint8_t *buf, ssize_t len) { VirtConsole *vcon = VIRTIO_CONSOLE(port); ssize_t ret; if (!vcon->chr) { /* If there's no backend, we can just say we consumed all data. */ return len; } ret = qemu_chr_fe_write(vcon->chr, buf, len); trace_virtio_console_flush_buf(port->id, len, ret); if (ret < len) { VirtIOSerialPortClass *k = VIRTIO_SERIAL_PORT_GET_CLASS(port); /* * Ideally we'd get a better error code than just -1, but * that's what the chardev interface gives us right now. If * we had a finer-grained message, like -EPIPE, we could close * this connection. if (ret < 0) ret = 0; if (!k->is_console) { virtio_serial_throttle_port(port, true); if (!vcon->watch) { vcon->watch = qemu_chr_fe_add_watch(vcon->chr, G_IO_OUT|G_IO_HUP, chr_write_unblocked, vcon); } } } return ret; }","Yes, it is vulnerable."489487,"static void tcp_chr_read(void *opaque) { CharDriverState *chr = opaque; TCPCharDriver *s = chr->opaque; uint8_t buf[READ_BUF_LEN]; int len, size; if (!s->connected || s->max_size <= 0) return; len = sizeof(buf); if (len > s->max_size) len = s->max_size; size = tcp_chr_recv(chr, (void *)buf, len); if (size == 0) { /* connection closed */ s->connected = 0; if (s->listen_fd >= 0) { qemu_set_fd_handler(s->listen_fd, tcp_chr_accept, NULL, chr); } qemu_set_fd_handler(s->fd, NULL, NULL, NULL); closesocket(s->fd); s->fd = -1; qemu_chr_event(chr, CHR_EVENT_CLOSED); } else if (size > 0) { if (s->do_telnetopt) tcp_chr_process_IAC_bytes(chr, s, buf, &size); if (size > 0) qemu_chr_read(chr, buf, size); if (s->msgfd != -1) { close(s->msgfd); s->msgfd = -1; } } }","Yes, it is vulnerable."490488,"static int hwmap_filter_frame(AVFilterLink *link, AVFrame *input) { AVFilterContext *avctx = link->dst; AVFilterLink *outlink = avctx->outputs[0]; HWMapContext *ctx = avctx->priv; AVFrame *map = NULL; int err; av_log(ctx, AV_LOG_DEBUG, ""Filter input: %s, %ux%u (%""PRId64"").\n"", av_get_pix_fmt_name(input->format), input->width, input->height, input->pts); map = av_frame_alloc(); if (!map) { err = AVERROR(ENOMEM); goto fail; } map->format = outlink->format; map->hw_frames_ctx = av_buffer_ref(ctx->hwframes_ref); if (!map->hw_frames_ctx) { err = AVERROR(ENOMEM); goto fail; } if (ctx->map_backwards && !input->hw_frames_ctx) { // If we mapped backwards from hardware to software, we need // to attach the hardware frame context to the input frame to // make the mapping visible to av_hwframe_map(). input->hw_frames_ctx = av_buffer_ref(ctx->hwframes_ref); if (!input->hw_frames_ctx) { err = AVERROR(ENOMEM); goto fail; } } err = av_hwframe_map(map, input, ctx->mode); if (err < 0) { av_log(avctx, AV_LOG_ERROR, ""Failed to map frame: %d.\n"", err); goto fail; } err = av_frame_copy_props(map, input); if (err < 0) goto fail; av_frame_free(&input); av_log(ctx, AV_LOG_DEBUG, ""Filter output: %s, %ux%u (%""PRId64"").\n"", av_get_pix_fmt_name(map->format), map->width, map->height, map->pts); return ff_filter_frame(outlink, map); fail: av_frame_free(&input); av_frame_free(&map); return err; }","Yes, it is vulnerable."491489,void virtio_panic(const char *string) { sclp_print(string); disabled_wait(); while (1) { } },"Yes, it is vulnerable."492490,"static int opus_decode_packet(AVCodecContext *avctx, void *data, int *got_frame_ptr, AVPacket *avpkt) { OpusContext *c = avctx->priv_data; AVFrame *frame = data; const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; int coded_samples = 0; int decoded_samples = 0; int i, ret; for (i = 0; i < c->nb_streams; i++) { OpusStreamContext *s = &c->streams[i]; s->out[0] = s->out[1] = NULL; } /* decode the header of the first sub-packet to find out the sample count */ if (buf) { OpusPacket *pkt = &c->streams[0].packet; ret = ff_opus_parse_packet(pkt, buf, buf_size, c->nb_streams > 1); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Error parsing the packet header.\n""); return ret; } coded_samples += pkt->frame_count * pkt->frame_duration; c->streams[0].silk_samplerate = get_silk_samplerate(pkt->config); } frame->nb_samples = coded_samples + c->streams[0].delayed_samples; /* no input or buffered data => nothing to do */ if (!frame->nb_samples) { *got_frame_ptr = 0; return 0; } /* setup the data buffers */ ret = ff_get_buffer(avctx, frame, 0); if (ret < 0) return ret; frame->nb_samples = 0; for (i = 0; i < avctx->channels; i++) { ChannelMap *map = &c->channel_maps[i]; if (!map->copy) c->streams[map->stream_idx].out[map->channel_idx] = (float*)frame->extended_data[i]; } for (i = 0; i < c->nb_streams; i++) c->streams[i].out_size = frame->linesize[0]; /* decode each sub-packet */ for (i = 0; i < c->nb_streams; i++) { OpusStreamContext *s = &c->streams[i]; if (i && buf) { ret = ff_opus_parse_packet(&s->packet, buf, buf_size, i != c->nb_streams - 1); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Error parsing the packet header.\n""); return ret; } if (coded_samples != s->packet.frame_count * s->packet.frame_duration) { av_log(avctx, AV_LOG_ERROR, ""Mismatching coded sample count in substream %d.\n"", i); return AVERROR_INVALIDDATA; } s->silk_samplerate = get_silk_samplerate(s->packet.config); } ret = opus_decode_subpacket(&c->streams[i], buf, s->packet.data_size, coded_samples); if (ret < 0) return ret; if (decoded_samples && ret != decoded_samples) { av_log(avctx, AV_LOG_ERROR, ""Different numbers of decoded samples "" ""in a multi-channel stream\n""); return AVERROR_INVALIDDATA; } decoded_samples = ret; buf += s->packet.packet_size; buf_size -= s->packet.packet_size; } for (i = 0; i < avctx->channels; i++) { ChannelMap *map = &c->channel_maps[i]; /* handle copied channels */ if (map->copy) { memcpy(frame->extended_data[i], frame->extended_data[map->copy_idx], frame->linesize[0]); } else if (map->silence) { memset(frame->extended_data[i], 0, frame->linesize[0]); } if (c->gain_i) { c->fdsp->vector_fmul_scalar((float*)frame->extended_data[i], (float*)frame->extended_data[i], c->gain, FFALIGN(decoded_samples, 8)); } } frame->nb_samples = decoded_samples; *got_frame_ptr = !!decoded_samples; return avpkt->size; }","Yes, it is vulnerable."493491,bool migrate_zero_blocks(void) { MigrationState *s; s = migrate_get_current(); return s->enabled_capabilities[MIGRATION_CAPABILITY_ZERO_BLOCKS]; },"Yes, it is vulnerable."494492,"static void av_always_inline filter_mb_dir(H264Context *h, int mb_x, int mb_y, uint8_t *img_y, uint8_t *img_cb, uint8_t *img_cr, unsigned int linesize, unsigned int uvlinesize, int mb_xy, int mb_type, int mvy_limit, int first_vertical_edge_done, int dir) { MpegEncContext * const s = &h->s; int edge; const int mbm_xy = dir == 0 ? mb_xy -1 : h->top_mb_xy; const int mbm_type = s->current_picture.mb_type[mbm_xy]; int (*ref2frm) [64] = h->ref2frm[ h->slice_num &(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2); int (*ref2frmm)[64] = h->ref2frm[ h->slice_table[mbm_xy]&(MAX_SLICES-1) ][0] + (MB_MBAFF ? 20 : 2); int start = h->slice_table[mbm_xy] == 0xFFFF ? 1 : 0; const int edges = (mb_type & (MB_TYPE_16x16|MB_TYPE_SKIP)) == (MB_TYPE_16x16|MB_TYPE_SKIP) ? 1 : 4; // how often to recheck mv-based bS when iterating between edges const int mask_edge = (mb_type & (MB_TYPE_16x16 | (MB_TYPE_16x8 << dir))) ? 3 : (mb_type & (MB_TYPE_8x16 >> dir)) ? 1 : 0; // how often to recheck mv-based bS when iterating along each edge const int mask_par0 = mb_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir)); if (first_vertical_edge_done) { start = 1; } if (h->deblocking_filter==2 && h->slice_table[mbm_xy] != h->slice_table[mb_xy]) start = 1; if (FRAME_MBAFF && (dir == 1) && ((mb_y&1) == 0) && start == 0 && !IS_INTERLACED(mb_type) && IS_INTERLACED(mbm_type) ) { // This is a special case in the norm where the filtering must // be done twice (one each of the field) even if we are in a // frame macroblock. // static const int nnz_idx[4] = {4,5,6,3}; unsigned int tmp_linesize = 2 * linesize; unsigned int tmp_uvlinesize = 2 * uvlinesize; int mbn_xy = mb_xy - 2 * s->mb_stride; int qp; int i, j; int16_t bS[4]; for(j=0; j<2; j++, mbn_xy += s->mb_stride){ if( IS_INTRA(mb_type) || IS_INTRA(s->current_picture.mb_type[mbn_xy]) ) { bS[0] = bS[1] = bS[2] = bS[3] = 3; } else { const uint8_t *mbn_nnz = h->non_zero_count[mbn_xy]; for( i = 0; i < 4; i++ ) { if( h->non_zero_count_cache[scan8[0]+i] != 0 || mbn_nnz[nnz_idx[i]] != 0 ) bS[i] = 2; else bS[i] = 1; } } // Do not use s->qscale as luma quantizer because it has not the same // value in IPCM macroblocks. qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1; tprintf(s->avctx, ""filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d"", mb_x, mb_y, dir, edge, qp, tmp_linesize, tmp_uvlinesize); { int i; for (i = 0; i < 4; i++) tprintf(s->avctx, "" bS[%d]:%d"", i, bS[i]); tprintf(s->avctx, ""\n""); } filter_mb_edgeh( h, &img_y[j*linesize], tmp_linesize, bS, qp ); filter_mb_edgech( h, &img_cb[j*uvlinesize], tmp_uvlinesize, bS, ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); filter_mb_edgech( h, &img_cr[j*uvlinesize], tmp_uvlinesize, bS, ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); } start = 1; } /* Calculate bS */ for( edge = start; edge < edges; edge++ ) { /* mbn_xy: neighbor macroblock */ const int mbn_xy = edge > 0 ? mb_xy : mbm_xy; const int mbn_type = s->current_picture.mb_type[mbn_xy]; int (*ref2frmn)[64] = edge > 0 ? ref2frm : ref2frmm; int16_t bS[4]; int qp; if( (edge&1) && IS_8x8DCT(mb_type) ) continue; if( IS_INTRA(mb_type) || IS_INTRA(mbn_type) ) { int value; if (edge == 0) { if ( (!IS_INTERLACED(mb_type) && !IS_INTERLACED(mbm_type)) || ((FRAME_MBAFF || (s->picture_structure != PICT_FRAME)) && (dir == 0)) ) { value = 4; } else { value = 3; } } else { value = 3; } bS[0] = bS[1] = bS[2] = bS[3] = value; } else { int i, l; int mv_done; if( edge & mask_edge ) { bS[0] = bS[1] = bS[2] = bS[3] = 0; mv_done = 1; } else if( FRAME_MBAFF && IS_INTERLACED(mb_type ^ mbn_type)) { bS[0] = bS[1] = bS[2] = bS[3] = 1; mv_done = 1; } else if( mask_par0 && (edge || (mbn_type & (MB_TYPE_16x16 | (MB_TYPE_8x16 >> dir)))) ) { int b_idx= 8 + 4 + edge * (dir ? 8:1); int bn_idx= b_idx - (dir ? 8:1); int v = 0; for( l = 0; !v && l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) { v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] || FFABS( h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] ) >= 4 || FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit; } if(h->slice_type_nos == FF_B_TYPE && v){ v=0; for( l = 0; !v && l < 2; l++ ) { int ln= 1-l; v |= ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] || FFABS( h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] ) >= 4 || FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit; } } bS[0] = bS[1] = bS[2] = bS[3] = v; mv_done = 1; } else mv_done = 0; for( i = 0; i < 4; i++ ) { int x = dir == 0 ? edge : i; int y = dir == 0 ? i : edge; int b_idx= 8 + 4 + x + 8*y; int bn_idx= b_idx - (dir ? 8:1); if( h->non_zero_count_cache[b_idx] != 0 || h->non_zero_count_cache[bn_idx] != 0 ) { bS[i] = 2; } else if(!mv_done) { bS[i] = 0; for( l = 0; l < 1 + (h->slice_type_nos == FF_B_TYPE); l++ ) { if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[l][h->ref_cache[l][bn_idx]] || FFABS( h->mv_cache[l][b_idx][0] - h->mv_cache[l][bn_idx][0] ) >= 4 || FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[l][bn_idx][1] ) >= mvy_limit ) { bS[i] = 1; break; } } if(h->slice_type_nos == FF_B_TYPE && bS[i]){ bS[i] = 0; for( l = 0; l < 2; l++ ) { int ln= 1-l; if( ref2frm[l][h->ref_cache[l][b_idx]] != ref2frmn[ln][h->ref_cache[ln][bn_idx]] || FFABS( h->mv_cache[l][b_idx][0] - h->mv_cache[ln][bn_idx][0] ) >= 4 || FFABS( h->mv_cache[l][b_idx][1] - h->mv_cache[ln][bn_idx][1] ) >= mvy_limit ) { bS[i] = 1; break; } } } } } if(bS[0]+bS[1]+bS[2]+bS[3] == 0) continue; } /* Filter edge */ // Do not use s->qscale as luma quantizer because it has not the same // value in IPCM macroblocks. qp = ( s->current_picture.qscale_table[mb_xy] + s->current_picture.qscale_table[mbn_xy] + 1 ) >> 1; //tprintf(s->avctx, ""filter mb:%d/%d dir:%d edge:%d, QPy:%d, QPc:%d, QPcn:%d\n"", mb_x, mb_y, dir, edge, qp, h->chroma_qp, s->current_picture.qscale_table[mbn_xy]); tprintf(s->avctx, ""filter mb:%d/%d dir:%d edge:%d, QPy:%d ls:%d uvls:%d"", mb_x, mb_y, dir, edge, qp, linesize, uvlinesize); { int i; for (i = 0; i < 4; i++) tprintf(s->avctx, "" bS[%d]:%d"", i, bS[i]); tprintf(s->avctx, ""\n""); } if( dir == 0 ) { filter_mb_edgev( h, &img_y[4*edge], linesize, bS, qp ); if( (edge&1) == 0 ) { filter_mb_edgecv( h, &img_cb[2*edge], uvlinesize, bS, ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); filter_mb_edgecv( h, &img_cr[2*edge], uvlinesize, bS, ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); } } else { filter_mb_edgeh( h, &img_y[4*edge*linesize], linesize, bS, qp ); if( (edge&1) == 0 ) { filter_mb_edgech( h, &img_cb[2*edge*uvlinesize], uvlinesize, bS, ( h->chroma_qp[0] + get_chroma_qp( h, 0, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); filter_mb_edgech( h, &img_cr[2*edge*uvlinesize], uvlinesize, bS, ( h->chroma_qp[1] + get_chroma_qp( h, 1, s->current_picture.qscale_table[mbn_xy] ) + 1 ) >> 1); } } } }","No, it is non-vulnerable."495493,"static int ehci_state_executing(EHCIQueue *q) { EHCIPacket *p = QTAILQ_FIRST(&q->packets); int again = 0; assert(p != NULL); assert(p->qtdaddr == q->qtdaddr); ehci_execute_complete(q); if (p->usb_status == USB_RET_ASYNC) { goto out; } if (p->usb_status == USB_RET_PROCERR) { again = -1; goto out; } // 4.10.3 if (!q->async) { int transactCtr = get_field(q->qh.epcap, QH_EPCAP_MULT); transactCtr--; set_field(&q->qh.epcap, transactCtr, QH_EPCAP_MULT); // 4.10.3, bottom of page 82, should exit this state when transaction // counter decrements to 0 } /* 4.10.5 */ if (p->usb_status == USB_RET_NAK) { ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH); } else { ehci_set_state(q->ehci, q->async, EST_WRITEBACK); } again = 1; out: ehci_flush_qh(q); return again; }","No, it is non-vulnerable."496494,"static void qemu_spice_create_update(SimpleSpiceDisplay *ssd) { static const int blksize = 32; int blocks = (surface_width(ssd->ds) + blksize - 1) / blksize; int dirty_top[blocks]; int y, yoff, x, xoff, blk, bw; int bpp = surface_bytes_per_pixel(ssd->ds); uint8_t *guest, *mirror; if (qemu_spice_rect_is_empty(&ssd->dirty)) { return; }; for (blk = 0; blk < blocks; blk++) { dirty_top[blk] = -1; } guest = surface_data(ssd->ds); mirror = (void *)pixman_image_get_data(ssd->mirror); for (y = ssd->dirty.top; y < ssd->dirty.bottom; y++) { yoff = y * surface_stride(ssd->ds); for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) { xoff = x * bpp; blk = x / blksize; bw = MIN(blksize, ssd->dirty.right - x); if (memcmp(guest + yoff + xoff, mirror + yoff + xoff, bw * bpp) == 0) { if (dirty_top[blk] != -1) { QXLRect update = { .top = dirty_top[blk], .bottom = y, .left = x, .right = x + bw, }; qemu_spice_create_one_update(ssd, &update); dirty_top[blk] = -1; } } else { if (dirty_top[blk] == -1) { dirty_top[blk] = y; } } } } for (x = ssd->dirty.left; x < ssd->dirty.right; x += blksize) { blk = x / blksize; bw = MIN(blksize, ssd->dirty.right - x); if (dirty_top[blk] != -1) { QXLRect update = { .top = dirty_top[blk], .bottom = ssd->dirty.bottom, .left = x, .right = x + bw, }; qemu_spice_create_one_update(ssd, &update); dirty_top[blk] = -1; } } memset(&ssd->dirty, 0, sizeof(ssd->dirty)); }","No, it is non-vulnerable."497495,"void tcp_connect(struct socket *inso) { Slirp *slirp = inso->slirp; struct socket *so; struct sockaddr_in addr; socklen_t addrlen = sizeof(struct sockaddr_in); struct tcpcb *tp; int s, opt; DEBUG_CALL(""tcp_connect""); DEBUG_ARG(""inso = %p"", inso); /* * If it's an SS_ACCEPTONCE socket, no need to socreate() * another socket, just use the accept() socket. */ if (inso->so_state & SS_FACCEPTONCE) { /* FACCEPTONCE already have a tcpcb */ so = inso; } else { so = socreate(slirp); if (so == NULL) { /* If it failed, get rid of the pending connection */ closesocket(accept(inso->s, (struct sockaddr *)&addr, &addrlen)); return; } if (tcp_attach(so) < 0) { free(so); /* NOT sofree */ return; } so->so_lfamily = AF_INET; so->so_laddr = inso->so_laddr; so->so_lport = inso->so_lport; } tcp_mss(sototcpcb(so), 0); s = accept(inso->s, (struct sockaddr *)&addr, &addrlen); if (s < 0) { tcp_close(sototcpcb(so)); /* This will sofree() as well */ return; } qemu_set_nonblock(s); socket_set_fast_reuse(s); opt = 1; qemu_setsockopt(s, SOL_SOCKET, SO_OOBINLINE, &opt, sizeof(int)); socket_set_nodelay(s); so->so_ffamily = AF_INET; so->so_fport = addr.sin_port; so->so_faddr = addr.sin_addr; /* Translate connections from localhost to the real hostname */ if (so->so_faddr.s_addr == 0 || (so->so_faddr.s_addr & loopback_mask) == (loopback_addr.s_addr & loopback_mask)) { so->so_faddr = slirp->vhost_addr; } /* Close the accept() socket, set right state */ if (inso->so_state & SS_FACCEPTONCE) { /* If we only accept once, close the accept() socket */ closesocket(so->s); /* Don't select it yet, even though we have an FD */ /* if it's not FACCEPTONCE, it's already NOFDREF */ so->so_state = SS_NOFDREF; } so->s = s; so->so_state |= SS_INCOMING; so->so_iptos = tcp_tos(so); tp = sototcpcb(so); tcp_template(tp); tp->t_state = TCPS_SYN_SENT; tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT; tp->iss = slirp->tcp_iss; slirp->tcp_iss += TCP_ISSINCR/2; tcp_sendseqinit(tp); tcp_output(tp); }","No, it is non-vulnerable."498496,"static int vorbis_parse_setup_hdr_modes(vorbis_context *vc) { GetBitContext *gb=&vc->gb; uint_fast8_t i; vc->mode_count=get_bits(gb, 6)+1; vc->modes=(vorbis_mode *)av_mallocz(vc->mode_count * sizeof(vorbis_mode)); AV_DEBUG("" There are %d modes.\n"", vc->mode_count); for(i=0;i<vc->mode_count;++i) { vorbis_mode *mode_setup=&vc->modes[i]; mode_setup->blockflag=get_bits1(gb); mode_setup->windowtype=get_bits(gb, 16); //FIXME check mode_setup->transformtype=get_bits(gb, 16); //FIXME check mode_setup->mapping=get_bits(gb, 8); //FIXME check AV_DEBUG("" %d mode: blockflag %d, windowtype %d, transformtype %d, mapping %d \n"", i, mode_setup->blockflag, mode_setup->windowtype, mode_setup->transformtype, mode_setup->mapping); } return 0; }","No, it is non-vulnerable."499497,"static void check_exception(sPAPREnvironment *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { uint32_t mask, buf, len; uint64_t xinfo; if ((nargs < 6) || (nargs > 7) || nret != 1) { rtas_st(rets, 0, -3); return; } xinfo = rtas_ld(args, 1); mask = rtas_ld(args, 2); buf = rtas_ld(args, 4); len = rtas_ld(args, 5); if (nargs == 7) { xinfo |= (uint64_t)rtas_ld(args, 6) << 32; } if ((mask & EVENT_MASK_EPOW) && pending_epow) { if (sizeof(*pending_epow) < len) { len = sizeof(*pending_epow); } cpu_physical_memory_write(buf, pending_epow, len); g_free(pending_epow); pending_epow = NULL; rtas_st(rets, 0, 0); } else { rtas_st(rets, 0, 1); } }","No, it is non-vulnerable."500498,"static void nvdimm_build_nfit(GSList *device_list, GArray *table_offsets, GArray *table_data, BIOSLinker *linker) { GArray *structures = nvdimm_build_device_structure(device_list); unsigned int header; acpi_add_table(table_offsets, table_data); /* NFIT header. */ header = table_data->len; acpi_data_push(table_data, sizeof(NvdimmNfitHeader)); /* NVDIMM device structures. */ g_array_append_vals(table_data, structures->data, structures->len); build_header(linker, table_data, (void *)(table_data->data + header), ""NFIT"", sizeof(NvdimmNfitHeader) + structures->len, 1, NULL, NULL); g_array_free(structures, true); }","Yes, it is vulnerable."501499,"const uint8_t *ff_h264_decode_nal(H264Context *h, const uint8_t *src, int *dst_length, int *consumed, int length) { int i, si, di; uint8_t *dst; int bufidx; // src[0]&0x80; // forbidden bit h->nal_ref_idc = src[0] >> 5; h->nal_unit_type = src[0] & 0x1F; src++; length--; #define STARTCODE_TEST \ if (i + 2 < length && src[i + 1] == 0 && src[i + 2] <= 3) { \ if (src[i + 2] != 3) { \ /* startcode, so we must be past the end */ \ length = i; \ } \ break; \ } #if HAVE_FAST_UNALIGNED #define FIND_FIRST_ZERO \ if (i > 0 && !src[i]) \ i--; \ while (src[i]) \ i++ #if HAVE_FAST_64BIT for (i = 0; i + 1 < length; i += 9) { if (!((~AV_RN64A(src + i) & (AV_RN64A(src + i) - 0x0100010001000101ULL)) & 0x8000800080008080ULL)) continue; FIND_FIRST_ZERO; STARTCODE_TEST; i -= 7; } #else for (i = 0; i + 1 < length; i += 5) { if (!((~AV_RN32A(src + i) & (AV_RN32A(src + i) - 0x01000101U)) & 0x80008080U)) continue; FIND_FIRST_ZERO; STARTCODE_TEST; i -= 3; } #endif #else for (i = 0; i + 1 < length; i += 2) { if (src[i]) continue; if (i > 0 && src[i - 1] == 0) i--; STARTCODE_TEST; } #endif if (i >= length - 1) { // no escaped 0 *dst_length = length; *consumed = length + 1; // +1 for the header return src; } // use second escape buffer for inter data bufidx = h->nal_unit_type == NAL_DPC ? 1 : 0; av_fast_malloc(&h->rbsp_buffer[bufidx], &h->rbsp_buffer_size[bufidx], length + FF_INPUT_BUFFER_PADDING_SIZE); dst = h->rbsp_buffer[bufidx]; if (dst == NULL) return NULL; memcpy(dst, src, i); si = di = i; while (si + 2 < length) { // remove escapes (very rare 1:2^22) if (src[si + 2] > 3) { dst[di++] = src[si++]; dst[di++] = src[si++]; } else if (src[si] == 0 && src[si + 1] == 0) { if (src[si + 2] == 3) { // escape dst[di++] = 0; dst[di++] = 0; si += 3; continue; } else // next start code goto nsc; } dst[di++] = src[si++]; } while (si < length) dst[di++] = src[si++]; nsc: memset(dst + di, 0, FF_INPUT_BUFFER_PADDING_SIZE); *dst_length = di; *consumed = si + 1; // +1 for the header /* FIXME store exact number of bits in the getbitcontext * (it is needed for decoding) */ return dst; }","No, it is non-vulnerable."502500,"static coroutine_fn int qcow2_co_writev(BlockDriverState *bs, int64_t sector_num, int remaining_sectors, QEMUIOVector *qiov) { BDRVQcowState *s = bs->opaque; int index_in_cluster; int ret; int cur_nr_sectors; /* number of sectors in current iteration */ uint64_t cluster_offset; QEMUIOVector hd_qiov; uint64_t bytes_done = 0; uint8_t *cluster_data = NULL; QCowL2Meta *l2meta = NULL; trace_qcow2_writev_start_req(qemu_coroutine_self(), sector_num, remaining_sectors); qemu_iovec_init(&hd_qiov, qiov->niov); s->cluster_cache_offset = -1; /* disable compressed cache */ qemu_co_mutex_lock(&s->lock); while (remaining_sectors != 0) { l2meta = NULL; trace_qcow2_writev_start_part(qemu_coroutine_self()); index_in_cluster = sector_num & (s->cluster_sectors - 1); cur_nr_sectors = remaining_sectors; if (s->crypt_method && cur_nr_sectors > QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors - index_in_cluster) { cur_nr_sectors = QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors - index_in_cluster; } ret = qcow2_alloc_cluster_offset(bs, sector_num << 9, &cur_nr_sectors, &cluster_offset, &l2meta); if (ret < 0) { goto fail; } assert((cluster_offset & 511) == 0); qemu_iovec_reset(&hd_qiov); qemu_iovec_concat(&hd_qiov, qiov, bytes_done, cur_nr_sectors * 512); if (s->crypt_method) { if (!cluster_data) { cluster_data = qemu_blockalign(bs, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size); } assert(hd_qiov.size <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size); qemu_iovec_to_buf(&hd_qiov, 0, cluster_data, hd_qiov.size); qcow2_encrypt_sectors(s, sector_num, cluster_data, cluster_data, cur_nr_sectors, 1, &s->aes_encrypt_key); qemu_iovec_reset(&hd_qiov); qemu_iovec_add(&hd_qiov, cluster_data, cur_nr_sectors * 512); } ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset + index_in_cluster * BDRV_SECTOR_SIZE, cur_nr_sectors * BDRV_SECTOR_SIZE); if (ret < 0) { goto fail; } qemu_co_mutex_unlock(&s->lock); BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO); trace_qcow2_writev_data(qemu_coroutine_self(), (cluster_offset >> 9) + index_in_cluster); ret = bdrv_co_writev(bs->file, (cluster_offset >> 9) + index_in_cluster, cur_nr_sectors, &hd_qiov); qemu_co_mutex_lock(&s->lock); if (ret < 0) { goto fail; } while (l2meta != NULL) { QCowL2Meta *next; ret = qcow2_alloc_cluster_link_l2(bs, l2meta); if (ret < 0) { goto fail; } /* Take the request off the list of running requests */ if (l2meta->nb_clusters != 0) { QLIST_REMOVE(l2meta, next_in_flight); } qemu_co_queue_restart_all(&l2meta->dependent_requests); next = l2meta->next; g_free(l2meta); l2meta = next; } remaining_sectors -= cur_nr_sectors; sector_num += cur_nr_sectors; bytes_done += cur_nr_sectors * 512; trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_nr_sectors); } ret = 0; fail: qemu_co_mutex_unlock(&s->lock); while (l2meta != NULL) { QCowL2Meta *next; if (l2meta->nb_clusters != 0) { QLIST_REMOVE(l2meta, next_in_flight); } qemu_co_queue_restart_all(&l2meta->dependent_requests); next = l2meta->next; g_free(l2meta); l2meta = next; } qemu_iovec_destroy(&hd_qiov); qemu_vfree(cluster_data); trace_qcow2_writev_done_req(qemu_coroutine_self(), ret); return ret; }","Yes, it is vulnerable."503501,"do_send_recv(int sockfd, struct iovec *iov, unsigned iov_cnt, bool do_send) { #if defined CONFIG_IOVEC && defined CONFIG_POSIX ssize_t ret; struct msghdr msg; memset(&msg, 0, sizeof(msg)); msg.msg_iov = iov; msg.msg_iovlen = iov_cnt; do { ret = do_send ? sendmsg(sockfd, &msg, 0) : recvmsg(sockfd, &msg, 0); } while (ret < 0 && errno == EINTR); return ret; #else /* else send piece-by-piece */ /*XXX Note: windows has WSASend() and WSARecv() */ unsigned i = 0; ssize_t ret = 0; while (i < iov_cnt) { ssize_t r = do_send ? send(sockfd, iov[i].iov_base, iov[i].iov_len, 0) : recv(sockfd, iov[i].iov_base, iov[i].iov_len, 0); if (r > 0) { ret += r; } else if (!r) { break; } else if (errno == EINTR) { continue; } else { /* else it is some ""other"" error, * only return if there was no data processed. */ if (ret == 0) { ret = -1; } break; } i++; } return ret; #endif }","No, it is non-vulnerable."504502,"START_TEST(keyword_literal) { QObject *obj; QBool *qbool; QString *str; obj = qobject_from_json(""true""); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QBOOL); qbool = qobject_to_qbool(obj); fail_unless(qbool_get_int(qbool) != 0); str = qobject_to_json(obj); fail_unless(strcmp(qstring_get_str(str), ""true"") == 0); QDECREF(str); QDECREF(qbool); obj = qobject_from_json(""false""); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QBOOL); qbool = qobject_to_qbool(obj); fail_unless(qbool_get_int(qbool) == 0); str = qobject_to_json(obj); fail_unless(strcmp(qstring_get_str(str), ""false"") == 0); QDECREF(str); QDECREF(qbool); obj = qobject_from_jsonf(""%i"", false); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QBOOL); qbool = qobject_to_qbool(obj); fail_unless(qbool_get_int(qbool) == 0); QDECREF(qbool); obj = qobject_from_jsonf(""%i"", true); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QBOOL); qbool = qobject_to_qbool(obj); fail_unless(qbool_get_int(qbool) != 0); QDECREF(qbool); }","No, it is non-vulnerable."505503,"static int handle_sigp_single_dst(S390CPU *dst_cpu, uint8_t order, uint64_t param, uint64_t *status_reg) { SigpInfo si = { .param = param, .status_reg = status_reg, }; /* cpu available? */ if (dst_cpu == NULL) { return SIGP_CC_NOT_OPERATIONAL; } /* only resets can break pending orders */ if (dst_cpu->env.sigp_order != 0 && order != SIGP_CPU_RESET && order != SIGP_INITIAL_CPU_RESET) { return SIGP_CC_BUSY; } switch (order) { case SIGP_START: run_on_cpu(CPU(dst_cpu), sigp_start, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_STOP: run_on_cpu(CPU(dst_cpu), sigp_stop, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_RESTART: run_on_cpu(CPU(dst_cpu), sigp_restart, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_STOP_STORE_STATUS: run_on_cpu(CPU(dst_cpu), sigp_stop_and_store_status, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_STORE_STATUS_ADDR: run_on_cpu(CPU(dst_cpu), sigp_store_status_at_address, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_STORE_ADTL_STATUS: run_on_cpu(CPU(dst_cpu), sigp_store_adtl_status, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_SET_PREFIX: run_on_cpu(CPU(dst_cpu), sigp_set_prefix, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_INITIAL_CPU_RESET: run_on_cpu(CPU(dst_cpu), sigp_initial_cpu_reset, RUN_ON_CPU_HOST_PTR(&si)); break; case SIGP_CPU_RESET: run_on_cpu(CPU(dst_cpu), sigp_cpu_reset, RUN_ON_CPU_HOST_PTR(&si)); break; default: set_sigp_status(&si, SIGP_STAT_INVALID_ORDER); } return si.cc; }","No, it is non-vulnerable."506504,"static int decode_ics_info(AACContext *ac, IndividualChannelStream *ics, GetBitContext *gb) { if (get_bits1(gb)) { av_log(ac->avctx, AV_LOG_ERROR, ""Reserved bit set.\n""); return AVERROR_INVALIDDATA; } ics->window_sequence[1] = ics->window_sequence[0]; ics->window_sequence[0] = get_bits(gb, 2); ics->use_kb_window[1] = ics->use_kb_window[0]; ics->use_kb_window[0] = get_bits1(gb); ics->num_window_groups = 1; ics->group_len[0] = 1; if (ics->window_sequence[0] == EIGHT_SHORT_SEQUENCE) { int i; ics->max_sfb = get_bits(gb, 4); for (i = 0; i < 7; i++) { if (get_bits1(gb)) { ics->group_len[ics->num_window_groups - 1]++; } else { ics->num_window_groups++; ics->group_len[ics->num_window_groups - 1] = 1; } } ics->num_windows = 8; ics->swb_offset = ff_swb_offset_128[ac->m4ac.sampling_index]; ics->num_swb = ff_aac_num_swb_128[ac->m4ac.sampling_index]; ics->tns_max_bands = ff_tns_max_bands_128[ac->m4ac.sampling_index]; ics->predictor_present = 0; } else { ics->max_sfb = get_bits(gb, 6); ics->num_windows = 1; ics->swb_offset = ff_swb_offset_1024[ac->m4ac.sampling_index]; ics->num_swb = ff_aac_num_swb_1024[ac->m4ac.sampling_index]; ics->tns_max_bands = ff_tns_max_bands_1024[ac->m4ac.sampling_index]; ics->predictor_present = get_bits1(gb); ics->predictor_reset_group = 0; if (ics->predictor_present) { if (ac->m4ac.object_type == AOT_AAC_MAIN) { if (decode_prediction(ac, ics, gb)) { return AVERROR_INVALIDDATA; } } else if (ac->m4ac.object_type == AOT_AAC_LC) { av_log(ac->avctx, AV_LOG_ERROR, ""Prediction is not allowed in AAC-LC.\n""); return AVERROR_INVALIDDATA; } else { if ((ics->ltp.present = get_bits(gb, 1))) decode_ltp(ac, &ics->ltp, gb, ics->max_sfb); } } } if (ics->max_sfb > ics->num_swb) { av_log(ac->avctx, AV_LOG_ERROR, ""Number of scalefactor bands in group (%d) exceeds limit (%d).\n"", ics->max_sfb, ics->num_swb); return AVERROR_INVALIDDATA; } return 0; }","No, it is non-vulnerable."507505,"long do_rt_sigreturn(CPUAlphaState *env) { abi_ulong frame_addr = env->ir[IR_A0]; struct target_rt_sigframe *frame; sigset_t set; if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { goto badframe; } target_to_host_sigset(&set, &frame->uc.tuc_sigmask); do_sigprocmask(SIG_SETMASK, &set, NULL); if (restore_sigcontext(env, &frame->uc.tuc_mcontext)) { goto badframe; } if (do_sigaltstack(frame_addr + offsetof(struct target_rt_sigframe, uc.tuc_stack), 0, env->ir[IR_SP]) == -EFAULT) { goto badframe; } unlock_user_struct(frame, frame_addr, 0); return env->ir[IR_V0]; badframe: unlock_user_struct(frame, frame_addr, 0); force_sig(TARGET_SIGSEGV); }","Yes, it is vulnerable."508506,"static int mov_read_udta_string(MOVContext *c, AVIOContext *pb, MOVAtom atom) { char tmp_key[5]; char key2[32], language[4] = {0}; char *str = NULL; const char *key = NULL; uint16_t langcode = 0; uint32_t data_type = 0, str_size, str_size_alloc; int (*parse)(MOVContext*, AVIOContext*, unsigned, const char*) = NULL; int raw = 0; int num = 0; switch (atom.type) { case MKTAG( '@','P','R','M'): key = ""premiere_version""; raw = 1; break; case MKTAG( '@','P','R','Q'): key = ""quicktime_version""; raw = 1; break; case MKTAG( 'X','M','P','_'): if (c->export_xmp) { key = ""xmp""; raw = 1; } break; case MKTAG( 'a','A','R','T'): key = ""album_artist""; break; case MKTAG( 'a','k','I','D'): key = ""account_type""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'a','p','I','D'): key = ""account_id""; break; case MKTAG( 'c','a','t','g'): key = ""category""; break; case MKTAG( 'c','p','i','l'): key = ""compilation""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'c','p','r','t'): key = ""copyright""; break; case MKTAG( 'd','e','s','c'): key = ""description""; break; case MKTAG( 'd','i','s','k'): key = ""disc""; parse = mov_metadata_track_or_disc_number; break; case MKTAG( 'e','g','i','d'): key = ""episode_uid""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'g','n','r','e'): key = ""genre""; parse = mov_metadata_gnre; break; case MKTAG( 'h','d','v','d'): key = ""hd_video""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'k','e','y','w'): key = ""keywords""; break; case MKTAG( 'l','d','e','s'): key = ""synopsis""; break; case MKTAG( 'l','o','c','i'): return mov_metadata_loci(c, pb, atom.size); case MKTAG( 'p','c','s','t'): key = ""podcast""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'p','g','a','p'): key = ""gapless_playback""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 'p','u','r','d'): key = ""purchase_date""; break; case MKTAG( 'r','t','n','g'): key = ""rating""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 's','o','a','a'): key = ""sort_album_artist""; break; case MKTAG( 's','o','a','l'): key = ""sort_album""; break; case MKTAG( 's','o','a','r'): key = ""sort_artist""; break; case MKTAG( 's','o','c','o'): key = ""sort_composer""; break; case MKTAG( 's','o','n','m'): key = ""sort_name""; break; case MKTAG( 's','o','s','n'): key = ""sort_show""; break; case MKTAG( 's','t','i','k'): key = ""media_type""; parse = mov_metadata_int8_no_padding; break; case MKTAG( 't','r','k','n'): key = ""track""; parse = mov_metadata_track_or_disc_number; break; case MKTAG( 't','v','e','n'): key = ""episode_id""; break; case MKTAG( 't','v','e','s'): key = ""episode_sort""; parse = mov_metadata_int8_bypass_padding; break; case MKTAG( 't','v','n','n'): key = ""network""; break; case MKTAG( 't','v','s','h'): key = ""show""; break; case MKTAG( 't','v','s','n'): key = ""season_number""; parse = mov_metadata_int8_bypass_padding; break; case MKTAG(0xa9,'A','R','T'): key = ""artist""; break; case MKTAG(0xa9,'P','R','D'): key = ""producer""; break; case MKTAG(0xa9,'a','l','b'): key = ""album""; break; case MKTAG(0xa9,'a','u','t'): key = ""artist""; break; case MKTAG(0xa9,'c','h','p'): key = ""chapter""; break; case MKTAG(0xa9,'c','m','t'): key = ""comment""; break; case MKTAG(0xa9,'c','o','m'): key = ""composer""; break; case MKTAG(0xa9,'c','p','y'): key = ""copyright""; break; case MKTAG(0xa9,'d','a','y'): key = ""date""; break; case MKTAG(0xa9,'d','i','r'): key = ""director""; break; case MKTAG(0xa9,'d','i','s'): key = ""disclaimer""; break; case MKTAG(0xa9,'e','d','1'): key = ""edit_date""; break; case MKTAG(0xa9,'e','n','c'): key = ""encoder""; break; case MKTAG(0xa9,'f','m','t'): key = ""original_format""; break; case MKTAG(0xa9,'g','e','n'): key = ""genre""; break; case MKTAG(0xa9,'g','r','p'): key = ""grouping""; break; case MKTAG(0xa9,'h','s','t'): key = ""host_computer""; break; case MKTAG(0xa9,'i','n','f'): key = ""comment""; break; case MKTAG(0xa9,'l','y','r'): key = ""lyrics""; break; case MKTAG(0xa9,'m','a','k'): key = ""make""; break; case MKTAG(0xa9,'m','o','d'): key = ""model""; break; case MKTAG(0xa9,'n','a','m'): key = ""title""; break; case MKTAG(0xa9,'o','p','e'): key = ""original_artist""; break; case MKTAG(0xa9,'p','r','d'): key = ""producer""; break; case MKTAG(0xa9,'p','r','f'): key = ""performers""; break; case MKTAG(0xa9,'r','e','q'): key = ""playback_requirements""; break; case MKTAG(0xa9,'s','r','c'): key = ""original_source""; break; case MKTAG(0xa9,'s','t','3'): key = ""subtitle""; break; case MKTAG(0xa9,'s','w','r'): key = ""encoder""; break; case MKTAG(0xa9,'t','o','o'): key = ""encoder""; break; case MKTAG(0xa9,'t','r','k'): key = ""track""; break; case MKTAG(0xa9,'u','r','l'): key = ""URL""; break; case MKTAG(0xa9,'w','r','n'): key = ""warning""; break; case MKTAG(0xa9,'w','r','t'): key = ""composer""; break; case MKTAG(0xa9,'x','y','z'): key = ""location""; break; } retry: if (c->itunes_metadata && atom.size > 8) { int data_size = avio_rb32(pb); int tag = avio_rl32(pb); if (tag == MKTAG('d','a','t','a') && data_size <= atom.size) { data_type = avio_rb32(pb); // type avio_rb32(pb); // unknown str_size = data_size - 16; atom.size -= 16; if (atom.type == MKTAG('c', 'o', 'v', 'r')) { int ret = mov_read_covr(c, pb, data_type, str_size); if (ret < 0) { av_log(c->fc, AV_LOG_ERROR, ""Error parsing cover art.\n""); } return ret; } else if (!key && c->found_hdlr_mdta && c->meta_keys) { uint32_t index = AV_RB32(&atom.type); if (index < c->meta_keys_count) { key = c->meta_keys[index]; } else { av_log(c->fc, AV_LOG_WARNING, ""The index of 'data' is out of range: %d >= %d.\n"", index, c->meta_keys_count); } } } else return 0; } else if (atom.size > 4 && key && !c->itunes_metadata && !raw) { str_size = avio_rb16(pb); // string length if (str_size > atom.size) { raw = 1; avio_seek(pb, -2, SEEK_CUR); av_log(c->fc, AV_LOG_WARNING, ""UDTA parsing failed retrying raw\n""); goto retry; } langcode = avio_rb16(pb); ff_mov_lang_to_iso639(langcode, language); atom.size -= 4; } else str_size = atom.size; if (c->export_all && !key) { snprintf(tmp_key, 5, ""%.4s"", (char*)&atom.type); key = tmp_key; } if (!key) return 0; if (atom.size < 0 || str_size >= INT_MAX/2) return AVERROR_INVALIDDATA; // Allocates enough space if data_type is a float32 number, otherwise // worst-case requirement for output string in case of utf8 coded input num = (data_type == 23); str_size_alloc = (num ? 512 : (raw ? str_size : str_size * 2)) + 1; str = av_mallocz(str_size_alloc); if (!str) return AVERROR(ENOMEM); if (parse) parse(c, pb, str_size, key); else { if (!raw && (data_type == 3 || (data_type == 0 && (langcode < 0x400 || langcode == 0x7fff)))) { // MAC Encoded mov_read_mac_string(c, pb, str_size, str, str_size_alloc); } else if (data_type == 23 && str_size >= 4) { // BE float32 float val = av_int2float(avio_rb32(pb)); if (snprintf(str, str_size_alloc, ""%f"", val) >= str_size_alloc) { av_log(c->fc, AV_LOG_ERROR, ""Failed to store the float32 number (%f) in string.\n"", val); return AVERROR_INVALIDDATA; } } else { int ret = ffio_read_size(pb, str, str_size); if (ret < 0) { return ret; } str[str_size] = 0; } c->fc->event_flags |= AVFMT_EVENT_FLAG_METADATA_UPDATED; av_dict_set(&c->fc->metadata, key, str, 0); if (*language && strcmp(language, ""und"")) { snprintf(key2, sizeof(key2), ""%s-%s"", key, language); av_dict_set(&c->fc->metadata, key2, str, 0); } } av_log(c->fc, AV_LOG_TRACE, ""lang \""%3s\"" "", language); av_log(c->fc, AV_LOG_TRACE, ""tag \""%s\"" value \""%s\"" atom \""%.4s\"" %d %""PRId64""\n"", key, str, (char*)&atom.type, str_size_alloc, atom.size); av_freep(&str); return 0; }","Yes, it is vulnerable."509507,"static void cortex_a9_initfn(Object *obj) { ARMCPU *cpu = ARM_CPU(obj); cpu->dtb_compatible = ""arm,cortex-a9""; set_feature(&cpu->env, ARM_FEATURE_V7); set_feature(&cpu->env, ARM_FEATURE_VFP3); set_feature(&cpu->env, ARM_FEATURE_VFP_FP16); set_feature(&cpu->env, ARM_FEATURE_NEON); set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); /* Note that A9 supports the MP extensions even for * A9UP and single-core A9MP (which are both different * and valid configurations; we don't model A9UP). */ set_feature(&cpu->env, ARM_FEATURE_V7MP); set_feature(&cpu->env, ARM_FEATURE_CBAR); cpu->midr = 0x410fc090; cpu->reset_fpsid = 0x41033090; cpu->mvfr0 = 0x11110222; cpu->mvfr1 = 0x01111111; cpu->ctr = 0x80038003; cpu->reset_sctlr = 0x00c50078; cpu->id_pfr0 = 0x1031; cpu->id_pfr1 = 0x11; cpu->id_dfr0 = 0x000; cpu->id_afr0 = 0; cpu->id_mmfr0 = 0x00100103; cpu->id_mmfr1 = 0x20000000; cpu->id_mmfr2 = 0x01230000; cpu->id_mmfr3 = 0x00002111; cpu->id_isar0 = 0x00101111; cpu->id_isar1 = 0x13112111; cpu->id_isar2 = 0x21232041; cpu->id_isar3 = 0x11112131; cpu->id_isar4 = 0x00111142; cpu->dbgdidr = 0x35141000; cpu->clidr = (1 << 27) | (1 << 24) | 3; cpu->ccsidr[0] = 0xe00fe015; /* 16k L1 dcache. */ cpu->ccsidr[1] = 0x200fe015; /* 16k L1 icache. */ define_arm_cp_regs(cpu, cortexa9_cp_reginfo); }","No, it is non-vulnerable."510508,static void bt_hci_reset(struct bt_hci_s *hci) { hci->acl_len = 0; hci->last_cmd = 0; hci->lm.connecting = 0; hci->event_mask[0] = 0xff; hci->event_mask[1] = 0xff; hci->event_mask[2] = 0xff; hci->event_mask[3] = 0xff; hci->event_mask[4] = 0xff; hci->event_mask[5] = 0x1f; hci->event_mask[6] = 0x00; hci->event_mask[7] = 0x00; hci->device.inquiry_scan = 0; hci->device.page_scan = 0; if (hci->device.lmp_name) g_free((void *) hci->device.lmp_name); hci->device.lmp_name = NULL; hci->device.class[0] = 0x00; hci->device.class[1] = 0x00; hci->device.class[2] = 0x00; hci->voice_setting = 0x0000; hci->conn_accept_tout = 0x1f40; hci->lm.inquiry_mode = 0x00; hci->psb_handle = 0x000; hci->asb_handle = 0x000; /* XXX: timer_del(sl->acl_mode_timer); for all links */ timer_del(hci->lm.inquiry_done); timer_del(hci->lm.inquiry_next); timer_del(hci->conn_accept_timer); },"No, it is non-vulnerable."511509,"static void net_tx_pkt_do_sw_csum(struct NetTxPkt *pkt) { struct iovec *iov = &pkt->vec[NET_TX_PKT_L2HDR_FRAG]; uint32_t csum_cntr; uint16_t csum = 0; /* num of iovec without vhdr */ uint32_t iov_len = pkt->payload_frags + NET_TX_PKT_PL_START_FRAG - 1; uint16_t csl; struct ip_header *iphdr; size_t csum_offset = pkt->virt_hdr.csum_start + pkt->virt_hdr.csum_offset; /* Put zero to checksum field */ iov_from_buf(iov, iov_len, csum_offset, &csum, sizeof csum); /* Calculate L4 TCP/UDP checksum */ csl = pkt->payload_len; /* data checksum */ csum_cntr = net_checksum_add_iov(iov, iov_len, pkt->virt_hdr.csum_start, csl); /* add pseudo header to csum */ iphdr = pkt->vec[NET_TX_PKT_L3HDR_FRAG].iov_base; csum_cntr += eth_calc_pseudo_hdr_csum(iphdr, csl); /* Put the checksum obtained into the packet */ csum = cpu_to_be16(net_checksum_finish(csum_cntr)); iov_from_buf(iov, iov_len, csum_offset, &csum, sizeof csum); }","No, it is non-vulnerable."512510,void apic_reset_irq_delivered(void) { trace_apic_reset_irq_delivered(apic_irq_delivered); apic_irq_delivered = 0; },"Yes, it is vulnerable."513511,"static TAPState *net_tap_fd_init(VLANState *vlan, int fd) { TAPState *s; s = qemu_mallocz(sizeof(TAPState)); if (!s) return NULL; s->fd = fd; s->vc = qemu_new_vlan_client(vlan, tap_receive, s); qemu_set_fd_handler(s->fd, tap_send, NULL, s); snprintf(s->vc->info_str, sizeof(s->vc->info_str), ""tap: fd=%d"", fd); return s; }","Yes, it is vulnerable."514512,"static void mov_text_style_cb(void *priv, const char style, int close) { MovTextContext *s = priv; if (!close) { if (!(s->box_flags & STYL_BOX)) { //first style entry s->style_attributes_temp = av_malloc(sizeof(*s->style_attributes_temp)); if (!s->style_attributes_temp) { av_bprint_clear(&s->buffer); s->box_flags &= ~STYL_BOX; } s->style_attributes_temp->style_flag = 0; s->style_attributes_temp->style_start = AV_RB16(&s->text_pos); } else { if (s->style_attributes_temp->style_flag) { //break the style record here and start a new one s->style_attributes_temp->style_end = AV_RB16(&s->text_pos); av_dynarray_add(&s->style_attributes, &s->count, s->style_attributes_temp); s->style_attributes_temp = av_malloc(sizeof(*s->style_attributes_temp)); if (!s->style_attributes_temp) { mov_text_cleanup(s); av_bprint_clear(&s->buffer); s->box_flags &= ~STYL_BOX; } s->style_attributes_temp->style_flag = s->style_attributes[s->count - 1]->style_flag; s->style_attributes_temp->style_start = AV_RB16(&s->text_pos); } else { s->style_attributes_temp->style_flag = 0; s->style_attributes_temp->style_start = AV_RB16(&s->text_pos); } } switch (style){ case 'b': s->style_attributes_temp->style_flag |= STYLE_FLAG_BOLD; break; case 'i': s->style_attributes_temp->style_flag |= STYLE_FLAG_ITALIC; break; case 'u': s->style_attributes_temp->style_flag |= STYLE_FLAG_UNDERLINE; break; } } else { s->style_attributes_temp->style_end = AV_RB16(&s->text_pos); av_dynarray_add(&s->style_attributes, &s->count, s->style_attributes_temp); s->style_attributes_temp = av_malloc(sizeof(*s->style_attributes_temp)); if (!s->style_attributes_temp) { mov_text_cleanup(s); av_bprint_clear(&s->buffer); s->box_flags &= ~STYL_BOX; } s->style_attributes_temp->style_flag = s->style_attributes[s->count - 1]->style_flag; switch (style){ case 'b': s->style_attributes_temp->style_flag &= ~STYLE_FLAG_BOLD; break; case 'i': s->style_attributes_temp->style_flag &= ~STYLE_FLAG_ITALIC; break; case 'u': s->style_attributes_temp->style_flag &= ~STYLE_FLAG_UNDERLINE; break; } if (s->style_attributes_temp->style_flag) { //start of new style record s->style_attributes_temp->style_start = AV_RB16(&s->text_pos); } } s->box_flags |= STYL_BOX; }","Yes, it is vulnerable."515513,"int qcow2_check_metadata_overlap(BlockDriverState *bs, int chk, int64_t offset, int64_t size) { BDRVQcowState *s = bs->opaque; int i, j; if (!size) { return 0; } if (chk & QCOW2_OL_MAIN_HEADER) { if (offset < s->cluster_size) { return QCOW2_OL_MAIN_HEADER; } } /* align range to test to cluster boundaries */ size = align_offset(offset_into_cluster(s, offset) + size, s->cluster_size); offset = start_of_cluster(s, offset); if ((chk & QCOW2_OL_ACTIVE_L1) && s->l1_size) { if (overlaps_with(s->l1_table_offset, s->l1_size * sizeof(uint64_t))) { return QCOW2_OL_ACTIVE_L1; } } if ((chk & QCOW2_OL_REFCOUNT_TABLE) && s->refcount_table_size) { if (overlaps_with(s->refcount_table_offset, s->refcount_table_size * sizeof(uint64_t))) { return QCOW2_OL_REFCOUNT_TABLE; } } if ((chk & QCOW2_OL_SNAPSHOT_TABLE) && s->snapshots_size) { if (overlaps_with(s->snapshots_offset, s->snapshots_size)) { return QCOW2_OL_SNAPSHOT_TABLE; } } if ((chk & QCOW2_OL_INACTIVE_L1) && s->snapshots) { for (i = 0; i < s->nb_snapshots; i++) { if (s->snapshots[i].l1_size && overlaps_with(s->snapshots[i].l1_table_offset, s->snapshots[i].l1_size * sizeof(uint64_t))) { return QCOW2_OL_INACTIVE_L1; } } } if ((chk & QCOW2_OL_ACTIVE_L2) && s->l1_table) { for (i = 0; i < s->l1_size; i++) { if ((s->l1_table[i] & L1E_OFFSET_MASK) && overlaps_with(s->l1_table[i] & L1E_OFFSET_MASK, s->cluster_size)) { return QCOW2_OL_ACTIVE_L2; } } } if ((chk & QCOW2_OL_REFCOUNT_BLOCK) && s->refcount_table) { for (i = 0; i < s->refcount_table_size; i++) { if ((s->refcount_table[i] & REFT_OFFSET_MASK) && overlaps_with(s->refcount_table[i] & REFT_OFFSET_MASK, s->cluster_size)) { return QCOW2_OL_REFCOUNT_BLOCK; } } } if ((chk & QCOW2_OL_INACTIVE_L2) && s->snapshots) { for (i = 0; i < s->nb_snapshots; i++) { uint64_t l1_ofs = s->snapshots[i].l1_table_offset; uint32_t l1_sz = s->snapshots[i].l1_size; uint64_t l1_sz2 = l1_sz * sizeof(uint64_t); uint64_t *l1 = g_malloc(l1_sz2); int ret; ret = bdrv_pread(bs->file, l1_ofs, l1, l1_sz2); if (ret < 0) { g_free(l1); return ret; } for (j = 0; j < l1_sz; j++) { uint64_t l2_ofs = be64_to_cpu(l1[j]) & L1E_OFFSET_MASK; if (l2_ofs && overlaps_with(l2_ofs, s->cluster_size)) { g_free(l1); return QCOW2_OL_INACTIVE_L2; } } g_free(l1); } } return 0; }","Yes, it is vulnerable."516514,"static int compute_pkt_fields2(AVStream *st, AVPacket *pkt){ int delay = FFMAX(st->codec->has_b_frames, !!st->codec->max_b_frames); int num, den, frame_size, i; // av_log(st->codec, AV_LOG_DEBUG, ""av_write_frame: pts:%""PRId64"" dts:%""PRId64"" cur_dts:%""PRId64"" b:%d size:%d st:%d\n"", pkt->pts, pkt->dts, st->cur_dts, delay, pkt->size, pkt->stream_index); /* if(pkt->pts == AV_NOPTS_VALUE && pkt->dts == AV_NOPTS_VALUE) return -1;*/ /* duration field */ if (pkt->duration == 0) { compute_frame_duration(&num, &den, st, NULL, pkt); if (den && num) { pkt->duration = av_rescale(1, num * (int64_t)st->time_base.den, den * (int64_t)st->time_base.num); } } if(pkt->pts == AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE && delay==0) pkt->pts= pkt->dts; //XXX/FIXME this is a temporary hack until all encoders output pts if((pkt->pts == 0 || pkt->pts == AV_NOPTS_VALUE) && pkt->dts == AV_NOPTS_VALUE && !delay){ pkt->dts= // pkt->pts= st->cur_dts; pkt->pts= st->pts.val; } //calculate dts from pts if(pkt->pts != AV_NOPTS_VALUE && pkt->dts == AV_NOPTS_VALUE){ st->pts_buffer[0]= pkt->pts; for(i=1; i<delay+1 && st->pts_buffer[i] == AV_NOPTS_VALUE; i++) st->pts_buffer[i]= (i-delay-1) * pkt->duration; for(i=0; i<delay && st->pts_buffer[i] > st->pts_buffer[i+1]; i++) FFSWAP(int64_t, st->pts_buffer[i], st->pts_buffer[i+1]); pkt->dts= st->pts_buffer[0]; } if(st->cur_dts && st->cur_dts != AV_NOPTS_VALUE && st->cur_dts >= pkt->dts){ av_log(st->codec, AV_LOG_ERROR, ""error, non monotone timestamps %""PRId64"" >= %""PRId64""\n"", st->cur_dts, pkt->dts); return -1; } if(pkt->dts != AV_NOPTS_VALUE && pkt->pts != AV_NOPTS_VALUE && pkt->pts < pkt->dts){ av_log(st->codec, AV_LOG_ERROR, ""error, pts < dts\n""); return -1; } // av_log(NULL, AV_LOG_DEBUG, ""av_write_frame: pts2:%""PRId64"" dts2:%""PRId64""\n"", pkt->pts, pkt->dts); st->cur_dts= pkt->dts; st->pts.val= pkt->dts; /* update pts */ switch (st->codec->codec_type) { case CODEC_TYPE_AUDIO: frame_size = get_audio_frame_size(st->codec, pkt->size); /* HACK/FIXME, we skip the initial 0 size packets as they are most likely equal to the encoder delay, but it would be better if we had the real timestamps from the encoder */ if (frame_size >= 0 && (pkt->size || st->pts.num!=st->pts.den>>1 || st->pts.val)) { av_frac_add(&st->pts, (int64_t)st->time_base.den * frame_size); } break; case CODEC_TYPE_VIDEO: av_frac_add(&st->pts, (int64_t)st->time_base.den * st->codec->time_base.num); break; default: break; } return 0; }","Yes, it is vulnerable."517515,"static int dnxhd_encode_fast(AVCodecContext *avctx, DNXHDEncContext *ctx) { int max_bits = 0; int ret, x, y; if ((ret = dnxhd_find_qscale(ctx)) < 0) return ret; for (y = 0; y < ctx->m.mb_height; y++) { for (x = 0; x < ctx->m.mb_width; x++) { int mb = y * ctx->m.mb_width + x; int rc = (ctx->qscale * ctx->m.mb_num ) + mb; int delta_bits; ctx->mb_qscale[mb] = ctx->qscale; ctx->mb_bits[mb] = ctx->mb_rc[rc].bits; max_bits += ctx->mb_rc[rc].bits; if (!RC_VARIANCE) { delta_bits = ctx->mb_rc[rc].bits - ctx->mb_rc[rc + ctx->m.mb_num].bits; ctx->mb_cmp[mb].mb = mb; ctx->mb_cmp[mb].value = delta_bits ? ((ctx->mb_rc[rc].ssd - ctx->mb_rc[rc + ctx->m.mb_num].ssd) * 100) / delta_bits : INT_MIN; // avoid increasing qscale } } max_bits += 31; // worst padding } if (!ret) { if (RC_VARIANCE) avctx->execute2(avctx, dnxhd_mb_var_thread, NULL, NULL, ctx->m.mb_height); radix_sort(ctx->mb_cmp, ctx->m.mb_num); for (x = 0; x < ctx->m.mb_num && max_bits > ctx->frame_bits; x++) { int mb = ctx->mb_cmp[x].mb; int rc = (ctx->qscale * ctx->m.mb_num ) + mb; max_bits -= ctx->mb_rc[rc].bits - ctx->mb_rc[rc + ctx->m.mb_num].bits; ctx->mb_qscale[mb] = ctx->qscale + 1; ctx->mb_bits[mb] = ctx->mb_rc[rc + ctx->m.mb_num].bits; } } return 0; }","No, it is non-vulnerable."518516,"static int img_read_header(AVFormatContext *s1, AVFormatParameters *ap) { VideoData *s = s1->priv_data; int ret, first_index, last_index; char buf[1024]; ByteIOContext pb1, *f = &pb1; AVStream *st; st = av_new_stream(s1, 0); if (!st) { av_free(s); return -ENOMEM; } if (ap && ap->image_format) s->img_fmt = ap->image_format; strcpy(s->path, s1->filename); s->img_number = 0; /* find format */ if (s1->iformat->flags & AVFMT_NOFILE) s->is_pipe = 0; else s->is_pipe = 1; if (!ap || !ap->frame_rate) { st->codec.frame_rate = 25; st->codec.frame_rate_base = 1; } else { st->codec.frame_rate = ap->frame_rate; st->codec.frame_rate_base = ap->frame_rate_base; } if (!s->is_pipe) { if (find_image_range(&first_index, &last_index, s->path) < 0) goto fail; s->img_number = first_index; /* compute duration */ st->start_time = 0; st->duration = ((int64_t)AV_TIME_BASE * (last_index - first_index + 1) * st->codec.frame_rate_base) / st->codec.frame_rate; if (get_frame_filename(buf, sizeof(buf), s->path, s->img_number) < 0) goto fail; if (url_fopen(f, buf, URL_RDONLY) < 0) goto fail; } else { f = &s1->pb; } ret = av_read_image(f, s1->filename, s->img_fmt, read_header_alloc_cb, s); if (ret < 0) goto fail1; if (!s->is_pipe) { url_fclose(f); } else { url_fseek(f, 0, SEEK_SET); } st->codec.codec_type = CODEC_TYPE_VIDEO; st->codec.codec_id = CODEC_ID_RAWVIDEO; st->codec.width = s->width; st->codec.height = s->height; st->codec.pix_fmt = s->pix_fmt; s->img_size = avpicture_get_size(s->pix_fmt, s->width, s->height); return 0; fail1: if (!s->is_pipe) url_fclose(f); fail: av_free(s); return -EIO; }","No, it is non-vulnerable."519517,"static ram_addr_t s390_virtio_device_num_vq(VirtIOS390Device *dev) { VirtIODevice *vdev = dev->vdev; int num_vq; for (num_vq = 0; num_vq < VIRTIO_PCI_QUEUE_MAX; num_vq++) { if (!virtio_queue_get_num(vdev, num_vq)) { break; } } return num_vq; }","No, it is non-vulnerable."520518,"static int kvm_get_xsave(X86CPU *cpu) { CPUX86State *env = &cpu->env; struct kvm_xsave* xsave = env->kvm_xsave_buf; int ret, i; const uint8_t *xmm, *ymmh, *zmmh; uint16_t cwd, swd, twd; if (!kvm_has_xsave()) { return kvm_get_fpu(cpu); } ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XSAVE, xsave); if (ret < 0) { return ret; } cwd = (uint16_t)xsave->region[XSAVE_FCW_FSW]; swd = (uint16_t)(xsave->region[XSAVE_FCW_FSW] >> 16); twd = (uint16_t)xsave->region[XSAVE_FTW_FOP]; env->fpop = (uint16_t)(xsave->region[XSAVE_FTW_FOP] >> 16); env->fpstt = (swd >> 11) & 7; env->fpus = swd; env->fpuc = cwd; for (i = 0; i < 8; ++i) { env->fptags[i] = !((twd >> i) & 1); } memcpy(&env->fpip, &xsave->region[XSAVE_CWD_RIP], sizeof(env->fpip)); memcpy(&env->fpdp, &xsave->region[XSAVE_CWD_RDP], sizeof(env->fpdp)); env->mxcsr = xsave->region[XSAVE_MXCSR]; memcpy(env->fpregs, &xsave->region[XSAVE_ST_SPACE], sizeof env->fpregs); env->xstate_bv = *(uint64_t *)&xsave->region[XSAVE_XSTATE_BV]; memcpy(env->bnd_regs, &xsave->region[XSAVE_BNDREGS], sizeof env->bnd_regs); memcpy(&env->bndcs_regs, &xsave->region[XSAVE_BNDCSR], sizeof(env->bndcs_regs)); memcpy(env->opmask_regs, &xsave->region[XSAVE_OPMASK], sizeof env->opmask_regs); xmm = (const uint8_t *)&xsave->region[XSAVE_XMM_SPACE]; ymmh = (const uint8_t *)&xsave->region[XSAVE_YMMH_SPACE]; zmmh = (const uint8_t *)&xsave->region[XSAVE_ZMM_Hi256]; for (i = 0; i < CPU_NB_REGS; i++, xmm += 16, ymmh += 16, zmmh += 32) { env->xmm_regs[i].XMM_Q(0) = ldq_p(xmm); env->xmm_regs[i].XMM_Q(1) = ldq_p(xmm+8); env->xmm_regs[i].XMM_Q(2) = ldq_p(ymmh); env->xmm_regs[i].XMM_Q(3) = ldq_p(ymmh+8); env->xmm_regs[i].XMM_Q(4) = ldq_p(zmmh); env->xmm_regs[i].XMM_Q(5) = ldq_p(zmmh+8); env->xmm_regs[i].XMM_Q(6) = ldq_p(zmmh+16); env->xmm_regs[i].XMM_Q(7) = ldq_p(zmmh+24); } #ifdef TARGET_X86_64 memcpy(&env->xmm_regs[16], &xsave->region[XSAVE_Hi16_ZMM], 16 * sizeof env->xmm_regs[16]); #endif return 0; }","No, it is non-vulnerable."521519,"static int jazz_led_init(SysBusDevice *dev) { LedState *s = FROM_SYSBUS(LedState, dev); memory_region_init_io(&s->iomem, &led_ops, s, ""led"", 1); sysbus_init_mmio(dev, &s->iomem); s->con = graphic_console_init(jazz_led_update_display, jazz_led_invalidate_display, NULL, jazz_led_text_update, s); return 0; }","No, it is non-vulnerable."522520,"static uint32_t hpet_ram_readb(void *opaque, target_phys_addr_t addr) { printf(""qemu: hpet_read b at %"" PRIx64 ""\n"", addr); return 0; }","No, it is non-vulnerable."523521,"static int read_restart_header(MLPDecodeContext *m, BitstreamContext *bc, const uint8_t *buf, unsigned int substr) { SubStream *s = &m->substream[substr]; unsigned int ch; int sync_word, tmp; uint8_t checksum; uint8_t lossless_check; int start_count = bitstream_tell(bc); int min_channel, max_channel, max_matrix_channel; const int std_max_matrix_channel = m->avctx->codec_id == AV_CODEC_ID_MLP ? MAX_MATRIX_CHANNEL_MLP : MAX_MATRIX_CHANNEL_TRUEHD; sync_word = bitstream_read(bc, 13); if (sync_word != 0x31ea >> 1) { av_log(m->avctx, AV_LOG_ERROR, ""restart header sync incorrect (got 0x%04x)\n"", sync_word); return AVERROR_INVALIDDATA; } s->noise_type = bitstream_read_bit(bc); if (m->avctx->codec_id == AV_CODEC_ID_MLP && s->noise_type) { av_log(m->avctx, AV_LOG_ERROR, ""MLP must have 0x31ea sync word.\n""); return AVERROR_INVALIDDATA; } bitstream_skip(bc, 16); /* Output timestamp */ min_channel = bitstream_read(bc, 4); max_channel = bitstream_read(bc, 4); max_matrix_channel = bitstream_read(bc, 4); if (max_matrix_channel > std_max_matrix_channel) { av_log(m->avctx, AV_LOG_ERROR, ""Max matrix channel cannot be greater than %d.\n"", max_matrix_channel); return AVERROR_INVALIDDATA; } if (max_channel != max_matrix_channel) { av_log(m->avctx, AV_LOG_ERROR, ""Max channel must be equal max matrix channel.\n""); return AVERROR_INVALIDDATA; } /* This should happen for TrueHD streams with >6 channels and MLP's noise * type. It is not yet known if this is allowed. */ if (s->max_channel > MAX_MATRIX_CHANNEL_MLP && !s->noise_type) { avpriv_request_sample(m->avctx, ""%d channels (more than the "" ""maximum supported by the decoder)"", s->max_channel + 2); return AVERROR_PATCHWELCOME; } if (min_channel > max_channel) { av_log(m->avctx, AV_LOG_ERROR, ""Substream min channel cannot be greater than max channel.\n""); return AVERROR_INVALIDDATA; } s->min_channel = min_channel; s->max_channel = max_channel; s->max_matrix_channel = max_matrix_channel; if (m->avctx->request_channel_layout && (s->mask & m->avctx->request_channel_layout) == m->avctx->request_channel_layout && m->max_decoded_substream > substr) { av_log(m->avctx, AV_LOG_DEBUG, ""Extracting %d-channel downmix (0x%""PRIx64"") from substream %d. "" ""Further substreams will be skipped.\n"", s->max_channel + 1, s->mask, substr); m->max_decoded_substream = substr; } s->noise_shift = bitstream_read(bc, 4); s->noisegen_seed = bitstream_read(bc, 23); bitstream_skip(bc, 19); s->data_check_present = bitstream_read_bit(bc); lossless_check = bitstream_read(bc, 8); if (substr == m->max_decoded_substream && s->lossless_check_data != 0xffffffff) { tmp = xor_32_to_8(s->lossless_check_data); if (tmp != lossless_check) av_log(m->avctx, AV_LOG_WARNING, ""Lossless check failed - expected %02x, calculated %02x.\n"", lossless_check, tmp); } bitstream_skip(bc, 16); memset(s->ch_assign, 0, sizeof(s->ch_assign)); for (ch = 0; ch <= s->max_matrix_channel; ch++) { int ch_assign = bitstream_read(bc, 6); if (m->avctx->codec_id == AV_CODEC_ID_TRUEHD) { uint64_t channel = thd_channel_layout_extract_channel(s->mask, ch_assign); ch_assign = av_get_channel_layout_channel_index(s->mask, channel); } if (ch_assign < 0 || ch_assign > s->max_matrix_channel) { avpriv_request_sample(m->avctx, ""Assignment of matrix channel %d to invalid output channel %d"", ch, ch_assign); return AVERROR_PATCHWELCOME; } s->ch_assign[ch_assign] = ch; } checksum = ff_mlp_restart_checksum(buf, bitstream_tell(bc) - start_count); if (checksum != bitstream_read(bc, 8)) av_log(m->avctx, AV_LOG_ERROR, ""restart header checksum error\n""); /* Set default decoding parameters. */ s->param_presence_flags = 0xff; s->num_primitive_matrices = 0; s->blocksize = 8; s->lossless_check_data = 0; memset(s->output_shift , 0, sizeof(s->output_shift )); memset(s->quant_step_size, 0, sizeof(s->quant_step_size)); for (ch = s->min_channel; ch <= s->max_channel; ch++) { ChannelParams *cp = &s->channel_params[ch]; cp->filter_params[FIR].order = 0; cp->filter_params[IIR].order = 0; cp->filter_params[FIR].shift = 0; cp->filter_params[IIR].shift = 0; /* Default audio coding is 24-bit raw PCM. */ cp->huff_offset = 0; cp->sign_huff_offset = -(1 << 23); cp->codebook = 0; cp->huff_lsbs = 24; } if (substr == m->max_decoded_substream) { m->avctx->channels = s->max_matrix_channel + 1; m->avctx->channel_layout = s->mask; m->dsp.mlp_pack_output = m->dsp.mlp_select_pack_output(s->ch_assign, s->output_shift, s->max_matrix_channel, m->avctx->sample_fmt == AV_SAMPLE_FMT_S32); } return 0; }","No, it is non-vulnerable."524522,static bool x86_cpu_has_work(CPUState *cs) { X86CPU *cpu = X86_CPU(cs); CPUX86State *env = &cpu->env; return ((cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_POLL)) && (env->eflags & IF_MASK)) || (cs->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_INIT | CPU_INTERRUPT_SIPI | CPU_INTERRUPT_MCE)); },"No, it is non-vulnerable."525523,"static void sd_reset(SDState *sd, BlockBackend *blk) { uint64_t size; uint64_t sect; if (blk) { blk_get_geometry(blk, &sect); } else { sect = 0; } size = sect << 9; sect = sd_addr_to_wpnum(size) + 1; sd->state = sd_idle_state; sd->rca = 0x0000; sd_set_ocr(sd); sd_set_scr(sd); sd_set_cid(sd); sd_set_csd(sd, size); sd_set_cardstatus(sd); sd_set_sdstatus(sd); sd->blk = blk; if (sd->wp_groups) g_free(sd->wp_groups); sd->wp_switch = blk ? blk_is_read_only(blk) : false; sd->wpgrps_size = sect; sd->wp_groups = bitmap_new(sd->wpgrps_size); memset(sd->function_group, 0, sizeof(sd->function_group)); sd->erase_start = 0; sd->erase_end = 0; sd->size = size; sd->blk_len = 0x200; sd->pwd_len = 0; sd->expecting_acmd = false; }","No, it is non-vulnerable."526524,"static void do_streamcopy(InputStream *ist, OutputStream *ost, const AVPacket *pkt) { OutputFile *of = output_files[ost->file_index]; int64_t ost_tb_start_time = av_rescale_q(of->start_time, AV_TIME_BASE_Q, ost->st->time_base); AVPacket opkt; av_init_packet(&opkt); if ((!ost->frame_number && !(pkt->flags & AV_PKT_FLAG_KEY)) && !ost->copy_initial_nonkeyframes) return; if (of->recording_time != INT64_MAX && ist->last_dts >= of->recording_time + of->start_time) { ost->finished = 1; return; } /* force the input stream PTS */ if (ost->st->codec->codec_type == AVMEDIA_TYPE_AUDIO) audio_size += pkt->size; else if (ost->st->codec->codec_type == AVMEDIA_TYPE_VIDEO) { video_size += pkt->size; ost->sync_opts++; } if (pkt->pts != AV_NOPTS_VALUE) opkt.pts = av_rescale_q(pkt->pts, ist->st->time_base, ost->st->time_base) - ost_tb_start_time; else opkt.pts = AV_NOPTS_VALUE; if (pkt->dts == AV_NOPTS_VALUE) opkt.dts = av_rescale_q(ist->last_dts, AV_TIME_BASE_Q, ost->st->time_base); else opkt.dts = av_rescale_q(pkt->dts, ist->st->time_base, ost->st->time_base); opkt.dts -= ost_tb_start_time; opkt.duration = av_rescale_q(pkt->duration, ist->st->time_base, ost->st->time_base); opkt.flags = pkt->flags; // FIXME remove the following 2 lines they shall be replaced by the bitstream filters if ( ost->st->codec->codec_id != AV_CODEC_ID_H264 && ost->st->codec->codec_id != AV_CODEC_ID_MPEG1VIDEO && ost->st->codec->codec_id != AV_CODEC_ID_MPEG2VIDEO && ost->st->codec->codec_id != AV_CODEC_ID_VC1 ) { if (av_parser_change(ist->st->parser, ost->st->codec, &opkt.data, &opkt.size, pkt->data, pkt->size, pkt->flags & AV_PKT_FLAG_KEY)) { opkt.buf = av_buffer_create(opkt.data, opkt.size, av_buffer_default_free, NULL, 0); if (!opkt.buf) exit(1); } } else { opkt.data = pkt->data; opkt.size = pkt->size; } write_frame(of->ctx, &opkt, ost); ost->st->codec->frame_number++; }","Yes, it is vulnerable."527525,"struct GuestAgentInfo *qmp_guest_info(Error **errp) { GuestAgentInfo *info = g_malloc0(sizeof(GuestAgentInfo)); info->version = g_strdup(QEMU_VERSION); qmp_for_each_command(qmp_command_info, info); return info; }","Yes, it is vulnerable."528526,"static int init_pass2(MpegEncContext *s) { RateControlContext *rcc = &s->rc_context; AVCodecContext *a = s->avctx; int i, toobig; double fps = get_fps(s->avctx); double complexity[5] = { 0 }; // approximate bits at quant=1 uint64_t const_bits[5] = { 0 }; // quantizer independent bits uint64_t all_const_bits; uint64_t all_available_bits = (uint64_t)(s->bit_rate * (double)rcc->num_entries / fps); double rate_factor = 0; double step; const int filter_size = (int)(a->qblur * 4) | 1; double expected_bits; double *qscale, *blurred_qscale, qscale_sum; /* find complexity & const_bits & decide the pict_types */ for (i = 0; i < rcc->num_entries; i++) { RateControlEntry *rce = &rcc->entry[i]; rce->new_pict_type = rce->pict_type; rcc->i_cplx_sum[rce->pict_type] += rce->i_tex_bits * rce->qscale; rcc->p_cplx_sum[rce->pict_type] += rce->p_tex_bits * rce->qscale; rcc->mv_bits_sum[rce->pict_type] += rce->mv_bits; rcc->frame_count[rce->pict_type]++; complexity[rce->new_pict_type] += (rce->i_tex_bits + rce->p_tex_bits) * (double)rce->qscale; const_bits[rce->new_pict_type] += rce->mv_bits + rce->misc_bits; } all_const_bits = const_bits[AV_PICTURE_TYPE_I] + const_bits[AV_PICTURE_TYPE_P] + const_bits[AV_PICTURE_TYPE_B]; if (all_available_bits < all_const_bits) { av_log(s->avctx, AV_LOG_ERROR, ""requested bitrate is too low\n""); return -1; } qscale = av_malloc(sizeof(double) * rcc->num_entries); blurred_qscale = av_malloc(sizeof(double) * rcc->num_entries); toobig = 0; for (step = 256 * 256; step > 0.0000001; step *= 0.5) { expected_bits = 0; rate_factor += step; rcc->buffer_index = s->avctx->rc_buffer_size / 2; /* find qscale */ for (i = 0; i < rcc->num_entries; i++) { RateControlEntry *rce = &rcc->entry[i]; qscale[i] = get_qscale(s, &rcc->entry[i], rate_factor, i); rcc->last_qscale_for[rce->pict_type] = qscale[i]; } assert(filter_size % 2 == 1); /* fixed I/B QP relative to P mode */ for (i = FFMAX(0, rcc->num_entries - 300); i < rcc->num_entries; i++) { RateControlEntry *rce = &rcc->entry[i]; qscale[i] = get_diff_limited_q(s, rce, qscale[i]); } for (i = rcc->num_entries - 1; i >= 0; i--) { RateControlEntry *rce = &rcc->entry[i]; qscale[i] = get_diff_limited_q(s, rce, qscale[i]); } /* smooth curve */ for (i = 0; i < rcc->num_entries; i++) { RateControlEntry *rce = &rcc->entry[i]; const int pict_type = rce->new_pict_type; int j; double q = 0.0, sum = 0.0; for (j = 0; j < filter_size; j++) { int index = i + j - filter_size / 2; double d = index - i; double coeff = a->qblur == 0 ? 1.0 : exp(-d * d / (a->qblur * a->qblur)); if (index < 0 || index >= rcc->num_entries) continue; if (pict_type != rcc->entry[index].new_pict_type) continue; q += qscale[index] * coeff; sum += coeff; } blurred_qscale[i] = q / sum; } /* find expected bits */ for (i = 0; i < rcc->num_entries; i++) { RateControlEntry *rce = &rcc->entry[i]; double bits; rce->new_qscale = modify_qscale(s, rce, blurred_qscale[i], i); bits = qp2bits(rce, rce->new_qscale) + rce->mv_bits + rce->misc_bits; bits += 8 * ff_vbv_update(s, bits); rce->expected_bits = expected_bits; expected_bits += bits; } av_dlog(s->avctx, ""expected_bits: %f all_available_bits: %d rate_factor: %f\n"", expected_bits, (int)all_available_bits, rate_factor); if (expected_bits > all_available_bits) { rate_factor -= step; ++toobig; } } av_free(qscale); av_free(blurred_qscale); /* check bitrate calculations and print info */ qscale_sum = 0.0; for (i = 0; i < rcc->num_entries; i++) { av_dlog(s, ""[lavc rc] entry[%d].new_qscale = %.3f qp = %.3f\n"", i, rcc->entry[i].new_qscale, rcc->entry[i].new_qscale / FF_QP2LAMBDA); qscale_sum += av_clip(rcc->entry[i].new_qscale / FF_QP2LAMBDA, s->avctx->qmin, s->avctx->qmax); } assert(toobig <= 40); av_log(s->avctx, AV_LOG_DEBUG, ""[lavc rc] requested bitrate: %d bps expected bitrate: %d bps\n"", s->bit_rate, (int)(expected_bits / ((double)all_available_bits / s->bit_rate))); av_log(s->avctx, AV_LOG_DEBUG, ""[lavc rc] estimated target average qp: %.3f\n"", (float)qscale_sum / rcc->num_entries); if (toobig == 0) { av_log(s->avctx, AV_LOG_INFO, ""[lavc rc] Using all of requested bitrate is not "" ""necessary for this video with these parameters.\n""); } else if (toobig == 40) { av_log(s->avctx, AV_LOG_ERROR, ""[lavc rc] Error: bitrate too low for this video "" ""with these parameters.\n""); return -1; } else if (fabs(expected_bits / all_available_bits - 1.0) > 0.01) { av_log(s->avctx, AV_LOG_ERROR, ""[lavc rc] Error: 2pass curve failed to converge\n""); return -1; } return 0; }","Yes, it is vulnerable."529527,"void replay_configure(QemuOpts *opts) { const char *fname; const char *rr; ReplayMode mode = REPLAY_MODE_NONE; Location loc; if (!opts) { return; } loc_push_none(&loc); qemu_opts_loc_restore(opts); rr = qemu_opt_get(opts, ""rr""); if (!rr) { /* Just enabling icount */ return; } else if (!strcmp(rr, ""record"")) { mode = REPLAY_MODE_RECORD; } else if (!strcmp(rr, ""replay"")) { mode = REPLAY_MODE_PLAY; } else { error_report(""Invalid icount rr option: %s"", rr); exit(1); } fname = qemu_opt_get(opts, ""rrfile""); if (!fname) { error_report(""File name not specified for replay""); exit(1); } replay_enable(fname, mode); loc_pop(&loc); }","Yes, it is vulnerable."530528,"static void paint_mouse_pointer(XImage *image, AVFormatContext *s1) { X11GrabContext *s = s1->priv_data; int x_off = s->x_off; int y_off = s->y_off; int width = s->width; int height = s->height; Display *dpy = s->dpy; XFixesCursorImage *xcim; int x, y; int line, column; int to_line, to_column; int pixstride = image->bits_per_pixel >> 3; /* Warning: in its insanity, xlib provides unsigned image data through a * char* pointer, so we have to make it uint8_t to make things not break. * Anyone who performs further investigation of the xlib API likely risks * permanent brain damage. */ uint8_t *pix = image->data; Window root; XSetWindowAttributes attr; /* Code doesn't currently support 16-bit or PAL8 */ if (image->bits_per_pixel != 24 && image->bits_per_pixel != 32) return; if (!s->c) s->c = XCreateFontCursor(dpy, XC_left_ptr); root = DefaultRootWindow(dpy); attr.cursor = s->c; XChangeWindowAttributes(dpy, root, CWCursor, &attr); xcim = XFixesGetCursorImage(dpy); if (!xcim) { av_log(s1, AV_LOG_WARNING, ""XFixes extension not available, impossible to draw cursor\n""); s->draw_mouse = 0; return; } x = xcim->x - xcim->xhot; y = xcim->y - xcim->yhot; to_line = FFMIN((y + xcim->height), (height + y_off)); to_column = FFMIN((x + xcim->width), (width + x_off)); for (line = FFMAX(y, y_off); line < to_line; line++) { for (column = FFMAX(x, x_off); column < to_column; column++) { int xcim_addr = (line - y) * xcim->width + column - x; int image_addr = ((line - y_off) * width + column - x_off) * pixstride; int r = (uint8_t)(xcim->pixels[xcim_addr] >> 0); int g = (uint8_t)(xcim->pixels[xcim_addr] >> 8); int b = (uint8_t)(xcim->pixels[xcim_addr] >> 16); int a = (uint8_t)(xcim->pixels[xcim_addr] >> 24); if (a == 255) { pix[image_addr + 0] = r; pix[image_addr + 1] = g; pix[image_addr + 2] = b; } else if (a) { /* pixel values from XFixesGetCursorImage come premultiplied by alpha */ pix[image_addr + 0] = r + (pix[image_addr + 0] * (255 - a) + 255 / 2) / 255; pix[image_addr + 1] = g + (pix[image_addr + 1] * (255 - a) + 255 / 2) / 255; pix[image_addr + 2] = b + (pix[image_addr + 2] * (255 - a) + 255 / 2) / 255; } } } XFree(xcim); xcim = NULL; }","No, it is non-vulnerable."531529,"void scsi_req_dequeue(SCSIRequest *req) { trace_scsi_req_dequeue(req->dev->id, req->lun, req->tag); if (req->enqueued) { QTAILQ_REMOVE(&req->dev->requests, req, next); req->enqueued = false; scsi_req_unref(req); } }","Yes, it is vulnerable."532530,"static int pci_rocker_init(PCIDevice *dev) { Rocker *r = to_rocker(dev); const MACAddr zero = { .a = { 0, 0, 0, 0, 0, 0 } }; const MACAddr dflt = { .a = { 0x52, 0x54, 0x00, 0x12, 0x35, 0x01 } }; static int sw_index; int i, err = 0; /* allocate worlds */ r->worlds[ROCKER_WORLD_TYPE_OF_DPA] = of_dpa_world_alloc(r); if (!r->world_name) { r->world_name = g_strdup(world_name(r->worlds[ROCKER_WORLD_TYPE_OF_DPA])); } r->world_dflt = rocker_world_type_by_name(r, r->world_name); if (!r->world_dflt) { fprintf(stderr, ""rocker: requested world \""%s\"" does not exist\n"", r->world_name); err = -EINVAL; goto err_world_type_by_name; } /* set up memory-mapped region at BAR0 */ memory_region_init_io(&r->mmio, OBJECT(r), &rocker_mmio_ops, r, ""rocker-mmio"", ROCKER_PCI_BAR0_SIZE); pci_register_bar(dev, ROCKER_PCI_BAR0_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, &r->mmio); /* set up memory-mapped region for MSI-X */ memory_region_init(&r->msix_bar, OBJECT(r), ""rocker-msix-bar"", ROCKER_PCI_MSIX_BAR_SIZE); pci_register_bar(dev, ROCKER_PCI_MSIX_BAR_IDX, PCI_BASE_ADDRESS_SPACE_MEMORY, &r->msix_bar); /* MSI-X init */ err = rocker_msix_init(r); if (err) { goto err_msix_init; } /* validate switch properties */ if (!r->name) { r->name = g_strdup(ROCKER); } if (rocker_find(r->name)) { err = -EEXIST; goto err_duplicate; } /* Rocker name is passed in port name requests to OS with the intention * that the name is used in interface names. Limit the length of the * rocker name to avoid naming problems in the OS. Also, adding the * port number as p# and unganged breakout b#, where # is at most 2 * digits, so leave room for it too (-1 for string terminator, -3 for * p# and -3 for b#) */ #define ROCKER_IFNAMSIZ 16 #define MAX_ROCKER_NAME_LEN (ROCKER_IFNAMSIZ - 1 - 3 - 3) if (strlen(r->name) > MAX_ROCKER_NAME_LEN) { fprintf(stderr, ""rocker: name too long; please shorten to at most %d chars\n"", MAX_ROCKER_NAME_LEN); return -EINVAL; } if (memcmp(&r->fp_start_macaddr, &zero, sizeof(zero)) == 0) { memcpy(&r->fp_start_macaddr, &dflt, sizeof(dflt)); r->fp_start_macaddr.a[4] += (sw_index++); } if (!r->switch_id) { memcpy(&r->switch_id, &r->fp_start_macaddr, sizeof(r->fp_start_macaddr)); } if (r->fp_ports > ROCKER_FP_PORTS_MAX) { r->fp_ports = ROCKER_FP_PORTS_MAX; } r->rings = g_new(DescRing *, rocker_pci_ring_count(r)); /* Rings are ordered like this: * - command ring * - event ring * - port0 tx ring * - port0 rx ring * - port1 tx ring * - port1 rx ring * ..... */ for (i = 0; i < rocker_pci_ring_count(r); i++) { DescRing *ring = desc_ring_alloc(r, i); if (i == ROCKER_RING_CMD) { desc_ring_set_consume(ring, cmd_consume, ROCKER_MSIX_VEC_CMD); } else if (i == ROCKER_RING_EVENT) { desc_ring_set_consume(ring, NULL, ROCKER_MSIX_VEC_EVENT); } else if (i % 2 == 0) { desc_ring_set_consume(ring, tx_consume, ROCKER_MSIX_VEC_TX((i - 2) / 2)); } else if (i % 2 == 1) { desc_ring_set_consume(ring, NULL, ROCKER_MSIX_VEC_RX((i - 3) / 2)); } r->rings[i] = ring; } for (i = 0; i < r->fp_ports; i++) { FpPort *port = fp_port_alloc(r, r->name, &r->fp_start_macaddr, i, &r->fp_ports_peers[i]); r->fp_port[i] = port; fp_port_set_world(port, r->world_dflt); } QLIST_INSERT_HEAD(&rockers, r, next); return 0; err_duplicate: rocker_msix_uninit(r); err_msix_init: object_unparent(OBJECT(&r->msix_bar)); object_unparent(OBJECT(&r->mmio)); err_world_type_by_name: for (i = 0; i < ROCKER_WORLD_TYPE_MAX; i++) { if (r->worlds[i]) { world_free(r->worlds[i]); } } return err; }","Yes, it is vulnerable."533531,"static int cow_test_bit(int64_t bitnum, const uint8_t *bitmap) { return (bitmap[bitnum / 8] & (1 << (bitnum & 7))) != 0; }","No, it is non-vulnerable."534532,"static void create_gic(VirtBoardInfo *vbi, qemu_irq *pic) { /* We create a standalone GIC v2 */ DeviceState *gicdev; SysBusDevice *gicbusdev; const char *gictype; int i; gictype = gic_class_name(); gicdev = qdev_create(NULL, gictype); qdev_prop_set_uint32(gicdev, ""revision"", 2); qdev_prop_set_uint32(gicdev, ""num-cpu"", smp_cpus); /* Note that the num-irq property counts both internal and external * interrupts; there are always 32 of the former (mandated by GIC spec). */ qdev_prop_set_uint32(gicdev, ""num-irq"", NUM_IRQS + 32); qdev_init_nofail(gicdev); gicbusdev = SYS_BUS_DEVICE(gicdev); sysbus_mmio_map(gicbusdev, 0, vbi->memmap[VIRT_GIC_DIST].base); sysbus_mmio_map(gicbusdev, 1, vbi->memmap[VIRT_GIC_CPU].base); /* Wire the outputs from each CPU's generic timer to the * appropriate GIC PPI inputs, and the GIC's IRQ output to * the CPU's IRQ input. */ for (i = 0; i < smp_cpus; i++) { DeviceState *cpudev = DEVICE(qemu_get_cpu(i)); int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS; /* physical timer; we wire it up to the non-secure timer's ID, * since a real A15 always has TrustZone but QEMU doesn't. */ qdev_connect_gpio_out(cpudev, 0, qdev_get_gpio_in(gicdev, ppibase + ARCH_TIMER_NS_EL1_IRQ)); /* virtual timer */ qdev_connect_gpio_out(cpudev, 1, qdev_get_gpio_in(gicdev, ppibase + ARCH_TIMER_VIRT_IRQ)); /* Hypervisor timer. */ qdev_connect_gpio_out(cpudev, 2, qdev_get_gpio_in(gicdev, ppibase + ARCH_TIMER_NS_EL2_IRQ)); sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ)); sysbus_connect_irq(gicbusdev, i + smp_cpus, qdev_get_gpio_in(cpudev, ARM_CPU_FIQ)); } for (i = 0; i < NUM_IRQS; i++) { pic[i] = qdev_get_gpio_in(gicdev, i); } fdt_add_gic_node(vbi); create_v2m(vbi, pic); }","No, it is non-vulnerable."535533,"static void kvmppc_host_cpu_class_init(ObjectClass *oc, void *data) { DeviceClass *dc = DEVICE_CLASS(oc); PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc); uint32_t vmx = kvmppc_get_vmx(); uint32_t dfp = kvmppc_get_dfp(); uint32_t dcache_size = kvmppc_read_int_cpu_dt(""d-cache-size""); uint32_t icache_size = kvmppc_read_int_cpu_dt(""i-cache-size""); /* Now fix up the class with information we can query from the host */ pcc->pvr = mfpvr(); if (vmx != -1) { /* Only override when we know what the host supports */ alter_insns(&pcc->insns_flags, PPC_ALTIVEC, vmx > 0); alter_insns(&pcc->insns_flags2, PPC2_VSX, vmx > 1); } if (dfp != -1) { /* Only override when we know what the host supports */ alter_insns(&pcc->insns_flags2, PPC2_DFP, dfp); } if (dcache_size != -1) { pcc->l1_dcache_size = dcache_size; } if (icache_size != -1) { pcc->l1_icache_size = icache_size; } /* Reason: kvmppc_host_cpu_initfn() dies when !kvm_enabled() */ dc->cannot_destroy_with_object_finalize_yet = true; }","No, it is non-vulnerable."536534,"static float128 addFloat128Sigs( float128 a, float128 b, flag zSign STATUS_PARAM) { int32 aExp, bExp, zExp; uint64_t aSig0, aSig1, bSig0, bSig1, zSig0, zSig1, zSig2; int32 expDiff; aSig1 = extractFloat128Frac1( a ); aSig0 = extractFloat128Frac0( a ); aExp = extractFloat128Exp( a ); bSig1 = extractFloat128Frac1( b ); bSig0 = extractFloat128Frac0( b ); bExp = extractFloat128Exp( b ); expDiff = aExp - bExp; if ( 0 < expDiff ) { if ( aExp == 0x7FFF ) { if ( aSig0 | aSig1 ) return propagateFloat128NaN( a, b STATUS_VAR ); return a; } if ( bExp == 0 ) { --expDiff; } else { bSig0 |= LIT64( 0x0001000000000000 ); } shift128ExtraRightJamming( bSig0, bSig1, 0, expDiff, &bSig0, &bSig1, &zSig2 ); zExp = aExp; } else if ( expDiff < 0 ) { if ( bExp == 0x7FFF ) { if ( bSig0 | bSig1 ) return propagateFloat128NaN( a, b STATUS_VAR ); return packFloat128( zSign, 0x7FFF, 0, 0 ); } if ( aExp == 0 ) { ++expDiff; } else { aSig0 |= LIT64( 0x0001000000000000 ); } shift128ExtraRightJamming( aSig0, aSig1, 0, - expDiff, &aSig0, &aSig1, &zSig2 ); zExp = bExp; } else { if ( aExp == 0x7FFF ) { if ( aSig0 | aSig1 | bSig0 | bSig1 ) { return propagateFloat128NaN( a, b STATUS_VAR ); } return a; } add128( aSig0, aSig1, bSig0, bSig1, &zSig0, &zSig1 ); if ( aExp == 0 ) { if ( STATUS(flush_to_zero) ) return packFloat128( zSign, 0, 0, 0 ); return packFloat128( zSign, 0, zSig0, zSig1 ); } zSig2 = 0; zSig0 |= LIT64( 0x0002000000000000 ); zExp = aExp; goto shiftRight1; } aSig0 |= LIT64( 0x0001000000000000 ); add128( aSig0, aSig1, bSig0, bSig1, &zSig0, &zSig1 ); --zExp; if ( zSig0 < LIT64( 0x0002000000000000 ) ) goto roundAndPack; ++zExp; shiftRight1: shift128ExtraRightJamming( zSig0, zSig1, zSig2, 1, &zSig0, &zSig1, &zSig2 ); roundAndPack: return roundAndPackFloat128( zSign, zExp, zSig0, zSig1, zSig2 STATUS_VAR ); }","Yes, it is vulnerable."537535,"static void test_acpi_one(const char *params) { char *args; uint8_t signature_low; uint8_t signature_high; uint16_t signature; int i; uint32_t off; args = g_strdup_printf(""-net none -display none %s %s"", params ? params : """", disk); qtest_start(args); /* Wait at most 1 minute */ #define TEST_DELAY (1 * G_USEC_PER_SEC / 10) #define TEST_CYCLES MAX((60 * G_USEC_PER_SEC / TEST_DELAY), 1) /* Poll until code has run and modified memory. Once it has we know BIOS * initialization is done. TODO: check that IP reached the halt * instruction. */ for (i = 0; i < TEST_CYCLES; ++i) { signature_low = readb(BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET); signature_high = readb(BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET + 1); signature = (signature_high << 8) | signature_low; if (signature == SIGNATURE) { break; } g_usleep(TEST_DELAY); } g_assert_cmphex(signature, ==, SIGNATURE); /* OK, now find RSDP */ for (off = 0xf0000; off < 0x100000; off += 0x10) { uint8_t sig[] = ""RSD PTR ""; int i; for (i = 0; i < sizeof sig - 1; ++i) { sig[i] = readb(off + i); } if (!memcmp(sig, ""RSD PTR "", sizeof sig)) { break; } } g_assert_cmphex(off, <, 0x100000); qtest_quit(global_qtest); g_free(args); }","Yes, it is vulnerable."538536,"static FFPsyWindowInfo psy_3gpp_window(FFPsyContext *ctx, const int16_t *audio, const int16_t *la, int channel, int prev_type) { int i, j; int br = ctx->avctx->bit_rate / ctx->avctx->channels; int attack_ratio = br <= 16000 ? 18 : 10; Psy3gppContext *pctx = (Psy3gppContext*) ctx->model_priv_data; Psy3gppChannel *pch = &pctx->ch[channel]; uint8_t grouping = 0; FFPsyWindowInfo wi; memset(&wi, 0, sizeof(wi)); if (la) { float s[8], v; int switch_to_eight = 0; float sum = 0.0, sum2 = 0.0; int attack_n = 0; for (i = 0; i < 8; i++) { for (j = 0; j < 128; j++) { v = iir_filter(la[(i*128+j)*ctx->avctx->channels], pch->iir_state); sum += v*v; } s[i] = sum; sum2 += sum; } for (i = 0; i < 8; i++) { if (s[i] > pch->win_energy * attack_ratio) { attack_n = i + 1; switch_to_eight = 1; break; } } pch->win_energy = pch->win_energy*7/8 + sum2/64; wi.window_type[1] = prev_type; switch (prev_type) { case ONLY_LONG_SEQUENCE: wi.window_type[0] = switch_to_eight ? LONG_START_SEQUENCE : ONLY_LONG_SEQUENCE; break; case LONG_START_SEQUENCE: wi.window_type[0] = EIGHT_SHORT_SEQUENCE; grouping = pch->next_grouping; break; case LONG_STOP_SEQUENCE: wi.window_type[0] = ONLY_LONG_SEQUENCE; break; case EIGHT_SHORT_SEQUENCE: wi.window_type[0] = switch_to_eight ? EIGHT_SHORT_SEQUENCE : LONG_STOP_SEQUENCE; grouping = switch_to_eight ? pch->next_grouping : 0; break; } pch->next_grouping = window_grouping[attack_n]; } else { for (i = 0; i < 3; i++) wi.window_type[i] = prev_type; grouping = (prev_type == EIGHT_SHORT_SEQUENCE) ? window_grouping[0] : 0; } wi.window_shape = 1; if (wi.window_type[0] != EIGHT_SHORT_SEQUENCE) { wi.num_windows = 1; wi.grouping[0] = 1; } else { int lastgrp = 0; wi.num_windows = 8; for (i = 0; i < 8; i++) { if (!((grouping >> i) & 1)) lastgrp = i; wi.grouping[lastgrp]++; } } return wi; }","Yes, it is vulnerable."539537,"void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size, ram_addr_t phys_offset) { struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1; uint64_t end; int ret, io_index; end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK; start_addr &= TARGET_PAGE_MASK; kphys_mem->phys_addr = start_addr; kphys_mem->size = end - start_addr; kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK; io_index = phys_offset & ~TARGET_PAGE_MASK; switch(io_index) { case IO_MEM_RAM: kphys_mem->io_index = KQEMU_IO_MEM_RAM; break; case IO_MEM_ROM: kphys_mem->io_index = KQEMU_IO_MEM_ROM; break; default: if (qpi_io_memory == io_index) { kphys_mem->io_index = KQEMU_IO_MEM_COMM; } else { kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED; } break; } #ifdef _WIN32 { DWORD temp; ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem, sizeof(*kphys_mem), NULL, 0, &temp, NULL) == TRUE ? 0 : -1; } #else ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem); #endif if (ret < 0) { fprintf(stderr, ""kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016"" PRIx64 "" size=0x%08lx phys_offset=0x%08lx\n"", ret, start_addr, (unsigned long)size, (unsigned long)phys_offset); } }","No, it is non-vulnerable."540538,"static void omap_dpll_write(void *opaque, target_phys_addr_t addr, uint64_t value, unsigned size) { struct dpll_ctl_s *s = (struct dpll_ctl_s *) opaque; uint16_t diff; static const int bypass_div[4] = { 1, 2, 4, 4 }; int div, mult; if (size != 2) { return omap_badwidth_write16(opaque, addr, value); } if (addr == 0x00) { /* CTL_REG */ /* See omap_ulpd_pm_write() too */ diff = s->mode & value; s->mode = value & 0x2fff; if (diff & (0x3ff << 2)) { if (value & (1 << 4)) { /* PLL_ENABLE */ div = ((value >> 5) & 3) + 1; /* PLL_DIV */ mult = MIN((value >> 7) & 0x1f, 1); /* PLL_MULT */ } else { div = bypass_div[((value >> 2) & 3)]; /* BYPASS_DIV */ mult = 1; } omap_clk_setrate(s->dpll, div, mult); } /* Enter the desired mode. */ s->mode = (s->mode & 0xfffe) | ((s->mode >> 4) & 1); /* Act as if the lock is restored. */ s->mode |= 2; } else { OMAP_BAD_REG(addr); } }","No, it is non-vulnerable."541539,"static inline void gen_evfsneg(DisasContext *ctx) { if (unlikely(!ctx->spe_enabled)) { gen_exception(ctx, POWERPC_EXCP_APU); return; } #if defined(TARGET_PPC64) tcg_gen_xori_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], 0x8000000080000000LL); #else tcg_gen_xori_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], 0x80000000); tcg_gen_xori_tl(cpu_gprh[rD(ctx->opcode)], cpu_gprh[rA(ctx->opcode)], 0x80000000); #endif }","No, it is non-vulnerable."542540,"static void qmp_input_start_list(Visitor *v, const char *name, Error **errp) { QmpInputVisitor *qiv = to_qiv(v); QObject *qobj = qmp_input_get_object(qiv, name, true); if (!qobj || qobject_type(qobj) != QTYPE_QLIST) { error_setg(errp, QERR_INVALID_PARAMETER_TYPE, name ? name : ""null"", ""list""); return; } qmp_input_push(qiv, qobj, errp); }","No, it is non-vulnerable."543541,"static void nvic_sysreg_write(void *opaque, target_phys_addr_t addr, uint64_t value, unsigned size) { uint32_t offset = addr; if (size == 4) { nvic_writel(opaque, offset, value); return; } hw_error(""NVIC: Bad write of size %d at offset 0x%x\n"", size, offset); }","No, it is non-vulnerable."544542,"static void pci_init_bus_master(PCIDevice *pci_dev) { AddressSpace *dma_as = pci_device_iommu_address_space(pci_dev); memory_region_init_alias(&pci_dev->bus_master_enable_region, OBJECT(pci_dev), ""bus master"", dma_as->root, 0, memory_region_size(dma_as->root)); memory_region_set_enabled(&pci_dev->bus_master_enable_region, false); address_space_init(&pci_dev->bus_master_as, &pci_dev->bus_master_enable_region, pci_dev->name); }","No, it is non-vulnerable."545543,"void aio_set_event_notifier_poll(AioContext *ctx, EventNotifier *notifier, EventNotifierHandler *io_poll_begin, EventNotifierHandler *io_poll_end) { aio_set_fd_poll(ctx, event_notifier_get_fd(notifier), (IOHandler *)io_poll_begin, (IOHandler *)io_poll_end); }","No, it is non-vulnerable."546544,"static uint64_t m5208_sys_read(void *opaque, target_phys_addr_t addr, unsigned size) { switch (addr) { case 0x110: /* SDCS0 */ { int n; for (n = 0; n < 32; n++) { if (ram_size < (2u << n)) break; } return (n - 1) | 0x40000000; } case 0x114: /* SDCS1 */ return 0; default: hw_error(""m5208_sys_read: Bad offset 0x%x\n"", (int)addr); return 0; } }","No, it is non-vulnerable."547545,"static int vhost_user_set_vring_addr(struct vhost_dev *dev, struct vhost_vring_addr *addr) { VhostUserMsg msg = { .request = VHOST_USER_SET_VRING_ADDR, .flags = VHOST_USER_VERSION, .payload.addr = *addr, .size = sizeof(msg.payload.addr), }; vhost_user_write(dev, &msg, NULL, 0); return 0; }","Yes, it is vulnerable."548546,"static int amr_read_packet(AVFormatContext *s, AVPacket *pkt) { AVCodecContext *enc = s->streams[0]->codec; int read, size, toc, mode; if (url_feof(&s->pb)) { return AVERROR_IO; } //FIXME this is wrong, this should rather be in a AVParset toc=get_byte(&s->pb); mode = (toc >> 3) & 0x0F; if (enc->codec_id == CODEC_ID_AMR_NB) { static const uint8_t packed_size[16] = {12, 13, 15, 17, 19, 20, 26, 31, 5, 0, 0, 0, 0, 0, 0, 0}; size=packed_size[mode]+1; } else if(enc->codec_id == CODEC_ID_AMR_WB) { static uint8_t packed_size[16] = {18, 24, 33, 37, 41, 47, 51, 59, 61, 6, 6, 0, 0, 0, 1, 1}; size=packed_size[mode]; } else { assert(0); } if ( (size==0) || av_new_packet(pkt, size)) { return AVERROR_IO; } pkt->stream_index = 0; pkt->pos= url_ftell(&s->pb); pkt->data[0]=toc; pkt->duration= enc->codec_id == CODEC_ID_AMR_NB ? 160 : 320; read = get_buffer(&s->pb, pkt->data+1, size-1); if (read != size-1) { av_free_packet(pkt); return AVERROR_IO; } return 0; }","Yes, it is vulnerable."549547,"static void park_frame_worker_threads(FrameThreadContext *fctx, int thread_count) { int i; for (i = 0; i < thread_count; i++) { PerThreadContext *p = &fctx->threads[i]; if (p->state != STATE_INPUT_READY) { pthread_mutex_lock(&p->progress_mutex); while (p->state != STATE_INPUT_READY) pthread_cond_wait(&p->output_cond, &p->progress_mutex); pthread_mutex_unlock(&p->progress_mutex); } } }","Yes, it is vulnerable."550548,"static int nut_read_packet(AVFormatContext *s, AVPacket *pkt) { NUTContext *nut = s->priv_data; ByteIOContext *bc = &s->pb; int i, frame_code=0, ret, skip; int64_t ts, back_ptr; for(;;){ int64_t pos= url_ftell(bc); uint64_t tmp= nut->next_startcode; nut->next_startcode=0; if (url_feof(bc)) return -1; if(tmp){ pos-=8; }else{ frame_code = get_byte(bc); if(frame_code == 'N'){ tmp= frame_code; for(i=1; i<8; i++) tmp = (tmp<<8) + get_byte(bc); } } switch(tmp){ case MAIN_STARTCODE: case STREAM_STARTCODE: case INDEX_STARTCODE: skip= get_packetheader(nut, bc, 0); url_fseek(bc, skip, SEEK_CUR); break; case INFO_STARTCODE: if(decode_info_header(nut)<0) goto resync; break; case SYNCPOINT_STARTCODE: if(decode_syncpoint(nut, &ts, &back_ptr)<0) goto resync; frame_code = get_byte(bc); case 0: ret= decode_frame(nut, pkt, frame_code); if(ret==0) return 0; else if(ret==1) //ok but discard packet break; default: resync: av_log(s, AV_LOG_DEBUG, ""syncing from %""PRId64""\n"", pos); tmp= find_any_startcode(bc, nut->last_syncpoint_pos+1); if(tmp==0) return -1; av_log(s, AV_LOG_DEBUG, ""sync\n""); nut->next_startcode= tmp; } } }","Yes, it is vulnerable."551549,"void rgb8tobgr8(const uint8_t *src, uint8_t *dst, long src_size) { long i; long num_pixels = src_size; for(i=0; i<num_pixels; i++) { unsigned b,g,r; register uint8_t rgb; rgb = src[i]; r = (rgb&0x07); g = (rgb&0x38)>>3; b = (rgb&0xC0)>>6; dst[i] = ((b<<1)&0x07) | ((g&0x07)<<3) | ((r&0x03)<<6); } }","Yes, it is vulnerable."552550,"static av_always_inline void hl_decode_mb_internal(H264Context *h, int simple){ MpegEncContext * const s = &h->s; const int mb_x= s->mb_x; const int mb_y= s->mb_y; const int mb_xy= h->mb_xy; const int mb_type= s->current_picture.mb_type[mb_xy]; uint8_t *dest_y, *dest_cb, *dest_cr; int linesize, uvlinesize /*dct_offset*/; int i; int *block_offset = &h->block_offset[0]; const int transform_bypass = !simple && (s->qscale == 0 && h->sps.transform_bypass); const int is_h264 = simple || s->codec_id == CODEC_ID_H264; void (*idct_add)(uint8_t *dst, DCTELEM *block, int stride); void (*idct_dc_add)(uint8_t *dst, DCTELEM *block, int stride); dest_y = s->current_picture.data[0] + (mb_x + mb_y * s->linesize ) * 16; dest_cb = s->current_picture.data[1] + (mb_x + mb_y * s->uvlinesize) * 8; dest_cr = s->current_picture.data[2] + (mb_x + mb_y * s->uvlinesize) * 8; s->dsp.prefetch(dest_y + (s->mb_x&3)*4*s->linesize + 64, s->linesize, 4); s->dsp.prefetch(dest_cb + (s->mb_x&7)*s->uvlinesize + 64, dest_cr - dest_cb, 2); if (!simple && MB_FIELD) { linesize = h->mb_linesize = s->linesize * 2; uvlinesize = h->mb_uvlinesize = s->uvlinesize * 2; block_offset = &h->block_offset[24]; if(mb_y&1){ //FIXME move out of this function? dest_y -= s->linesize*15; dest_cb-= s->uvlinesize*7; dest_cr-= s->uvlinesize*7; } if(FRAME_MBAFF) { int list; for(list=0; list<h->list_count; list++){ if(!USES_LIST(mb_type, list)) continue; if(IS_16X16(mb_type)){ int8_t *ref = &h->ref_cache[list][scan8[0]]; fill_rectangle(ref, 4, 4, 8, (16+*ref)^(s->mb_y&1), 1); }else{ for(i=0; i<16; i+=4){ int ref = h->ref_cache[list][scan8[i]]; if(ref >= 0) fill_rectangle(&h->ref_cache[list][scan8[i]], 2, 2, 8, (16+ref)^(s->mb_y&1), 1); } } } } } else { linesize = h->mb_linesize = s->linesize; uvlinesize = h->mb_uvlinesize = s->uvlinesize; // dct_offset = s->linesize * 16; } if (!simple && IS_INTRA_PCM(mb_type)) { for (i=0; i<16; i++) { memcpy(dest_y + i* linesize, h->mb + i*8, 16); } for (i=0; i<8; i++) { memcpy(dest_cb+ i*uvlinesize, h->mb + 128 + i*4, 8); memcpy(dest_cr+ i*uvlinesize, h->mb + 160 + i*4, 8); } } else { if(IS_INTRA(mb_type)){ if(h->deblocking_filter) xchg_mb_border(h, dest_y, dest_cb, dest_cr, linesize, uvlinesize, 1, simple); if(simple || !ENABLE_GRAY || !(s->flags&CODEC_FLAG_GRAY)){ h->hpc.pred8x8[ h->chroma_pred_mode ](dest_cb, uvlinesize); h->hpc.pred8x8[ h->chroma_pred_mode ](dest_cr, uvlinesize); } if(IS_INTRA4x4(mb_type)){ if(simple || !s->encoding){ if(IS_8x8DCT(mb_type)){ if(transform_bypass){ idct_dc_add = idct_add = s->dsp.add_pixels8; }else if(IS_8x8DCT(mb_type)){ idct_dc_add = s->dsp.h264_idct8_dc_add; idct_add = s->dsp.h264_idct8_add; } for(i=0; i<16; i+=4){ uint8_t * const ptr= dest_y + block_offset[i]; const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ]; if(transform_bypass && h->sps.profile_idc==244 && dir<=1){ h->hpc.pred8x8l_add[dir](ptr, h->mb + i*16, linesize); }else{ const int nnz = h->non_zero_count_cache[ scan8[i] ]; h->hpc.pred8x8l[ dir ](ptr, (h->topleft_samples_available<<i)&0x8000, (h->topright_samples_available<<i)&0x4000, linesize); if(nnz){ if(nnz == 1 && h->mb[i*16]) idct_dc_add(ptr, h->mb + i*16, linesize); else idct_add (ptr, h->mb + i*16, linesize); } } } }else{ if(transform_bypass){ idct_dc_add = idct_add = s->dsp.add_pixels4; }else{ idct_dc_add = s->dsp.h264_idct_dc_add; idct_add = s->dsp.h264_idct_add; } for(i=0; i<16; i++){ uint8_t * const ptr= dest_y + block_offset[i]; const int dir= h->intra4x4_pred_mode_cache[ scan8[i] ]; if(transform_bypass && h->sps.profile_idc==244 && dir<=1){ h->hpc.pred4x4_add[dir](ptr, h->mb + i*16, linesize); }else{ uint8_t *topright; int nnz, tr; if(dir == DIAG_DOWN_LEFT_PRED || dir == VERT_LEFT_PRED){ const int topright_avail= (h->topright_samples_available<<i)&0x8000; assert(mb_y || linesize <= block_offset[i]); if(!topright_avail){ tr= ptr[3 - linesize]*0x01010101; topright= (uint8_t*) &tr; }else topright= ptr + 4 - linesize; }else topright= NULL; h->hpc.pred4x4[ dir ](ptr, topright, linesize); nnz = h->non_zero_count_cache[ scan8[i] ]; if(nnz){ if(is_h264){ if(nnz == 1 && h->mb[i*16]) idct_dc_add(ptr, h->mb + i*16, linesize); else idct_add (ptr, h->mb + i*16, linesize); }else svq3_add_idct_c(ptr, h->mb + i*16, linesize, s->qscale, 0); } } } } } }else{ h->hpc.pred16x16[ h->intra16x16_pred_mode ](dest_y , linesize); if(is_h264){ if(!transform_bypass) h264_luma_dc_dequant_idct_c(h->mb, s->qscale, h->dequant4_coeff[0][s->qscale][0]); }else svq3_luma_dc_dequant_idct_c(h->mb, s->qscale); } if(h->deblocking_filter) xchg_mb_border(h, dest_y, dest_cb, dest_cr, linesize, uvlinesize, 0, simple); }else if(is_h264){ hl_motion(h, dest_y, dest_cb, dest_cr, s->me.qpel_put, s->dsp.put_h264_chroma_pixels_tab, s->me.qpel_avg, s->dsp.avg_h264_chroma_pixels_tab, s->dsp.weight_h264_pixels_tab, s->dsp.biweight_h264_pixels_tab); } if(!IS_INTRA4x4(mb_type)){ if(is_h264){ if(IS_INTRA16x16(mb_type)){ if(transform_bypass){ if(h->sps.profile_idc==244 && (h->intra16x16_pred_mode==VERT_PRED8x8 || h->intra16x16_pred_mode==HOR_PRED8x8)){ h->hpc.pred16x16_add[h->intra16x16_pred_mode](dest_y, block_offset, h->mb, linesize); }else{ for(i=0; i<16; i++){ if(h->non_zero_count_cache[ scan8[i] ] || h->mb[i*16]) s->dsp.add_pixels4(dest_y + block_offset[i], h->mb + i*16, linesize); } } }else{ s->dsp.h264_idct_add16intra(dest_y, block_offset, h->mb, linesize, h->non_zero_count_cache); } }else if(h->cbp&15){ if(transform_bypass){ const int di = IS_8x8DCT(mb_type) ? 4 : 1; idct_add= IS_8x8DCT(mb_type) ? s->dsp.add_pixels8 : s->dsp.add_pixels4; for(i=0; i<16; i+=di){ if(h->non_zero_count_cache[ scan8[i] ]){ idct_add(dest_y + block_offset[i], h->mb + i*16, linesize); } } }else{ if(IS_8x8DCT(mb_type)){ s->dsp.h264_idct8_add4(dest_y, block_offset, h->mb, linesize, h->non_zero_count_cache); }else{ s->dsp.h264_idct_add16(dest_y, block_offset, h->mb, linesize, h->non_zero_count_cache); } } } }else{ for(i=0; i<16; i++){ if(h->non_zero_count_cache[ scan8[i] ] || h->mb[i*16]){ //FIXME benchmark weird rule, & below uint8_t * const ptr= dest_y + block_offset[i]; svq3_add_idct_c(ptr, h->mb + i*16, linesize, s->qscale, IS_INTRA(mb_type) ? 1 : 0); } } } } if((simple || !ENABLE_GRAY || !(s->flags&CODEC_FLAG_GRAY)) && (h->cbp&0x30)){ uint8_t *dest[2] = {dest_cb, dest_cr}; if(transform_bypass){ idct_add = idct_dc_add = s->dsp.add_pixels4; }else{ idct_add = s->dsp.h264_idct_add; idct_dc_add = s->dsp.h264_idct_dc_add; chroma_dc_dequant_idct_c(h->mb + 16*16, h->chroma_qp[0], h->dequant4_coeff[IS_INTRA(mb_type) ? 1:4][h->chroma_qp[0]][0]); chroma_dc_dequant_idct_c(h->mb + 16*16+4*16, h->chroma_qp[1], h->dequant4_coeff[IS_INTRA(mb_type) ? 2:5][h->chroma_qp[1]][0]); } if(is_h264){ if(transform_bypass && IS_INTRA(mb_type) && h->sps.profile_idc==244 && (h->chroma_pred_mode==VERT_PRED8x8 || h->chroma_pred_mode==HOR_PRED8x8)){ h->hpc.pred8x8_add[h->chroma_pred_mode](dest[0], block_offset + 16, h->mb + 16*16, uvlinesize); h->hpc.pred8x8_add[h->chroma_pred_mode](dest[1], block_offset + 20, h->mb + 20*16, uvlinesize); }else{ for(i=16; i<16+8; i++){ if(h->non_zero_count_cache[ scan8[i] ]) idct_add (dest[(i&4)>>2] + block_offset[i], h->mb + i*16, uvlinesize); else if(h->mb[i*16]) idct_dc_add(dest[(i&4)>>2] + block_offset[i], h->mb + i*16, uvlinesize); } } }else{ for(i=16; i<16+8; i++){ if(h->non_zero_count_cache[ scan8[i] ] || h->mb[i*16]){ uint8_t * const ptr= dest[(i&4)>>2] + block_offset[i]; svq3_add_idct_c(ptr, h->mb + i*16, uvlinesize, chroma_qp[s->qscale + 12] - 12, 2); } } } } } if(h->deblocking_filter) { backup_mb_border(h, dest_y, dest_cb, dest_cr, linesize, uvlinesize, simple); fill_caches(h, mb_type, 1); //FIXME don't fill stuff which isn't used by filter_mb h->chroma_qp[0] = get_chroma_qp(h, 0, s->current_picture.qscale_table[mb_xy]); h->chroma_qp[1] = get_chroma_qp(h, 1, s->current_picture.qscale_table[mb_xy]); if (!simple && FRAME_MBAFF) { filter_mb (h, mb_x, mb_y, dest_y, dest_cb, dest_cr, linesize, uvlinesize); } else { filter_mb_fast(h, mb_x, mb_y, dest_y, dest_cb, dest_cr, linesize, uvlinesize); } } }","No, it is non-vulnerable."553551,"static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd, void *opaque) { const VMStateSubsection *sub = vmsd->subsections; while (sub && sub->needed) { if (sub->needed(opaque)) { const VMStateDescription *vmsd = sub->vmsd; uint8_t len; qemu_put_byte(f, QEMU_VM_SUBSECTION); len = strlen(vmsd->name); qemu_put_byte(f, len); qemu_put_buffer(f, (uint8_t *)vmsd->name, len); qemu_put_be32(f, vmsd->version_id); assert(!vmsd->subsections); vmstate_save_state(f, vmsd, opaque); } sub++; } }","Yes, it is vulnerable."554552,"static void sbr_hf_g_filt_c(int (*Y)[2], const int (*X_high)[40][2], const SoftFloat *g_filt, int m_max, intptr_t ixh) { int m; int64_t accu; for (m = 0; m < m_max; m++) { int64_t r = 1LL << (22-g_filt[m].exp); accu = (int64_t)X_high[m][ixh][0] * ((g_filt[m].mant + 0x40)>>7); Y[m][0] = (int)((accu + r) >> (23-g_filt[m].exp)); accu = (int64_t)X_high[m][ixh][1] * ((g_filt[m].mant + 0x40)>>7); Y[m][1] = (int)((accu + r) >> (23-g_filt[m].exp)); } }","Yes, it is vulnerable."555553,"static int output_frame(AVFilterLink *outlink, int need_request) { AVFilterContext *ctx = outlink->src; MixContext *s = ctx->priv; AVFrame *out_buf, *in_buf; int nb_samples, ns, ret, i; ret = calc_active_inputs(s); if (ret < 0) return ret; if (s->input_state[0] & INPUT_ON) { /* first input live: use the corresponding frame size */ nb_samples = frame_list_next_frame_size(s->frame_list); for (i = 1; i < s->nb_inputs; i++) { if (s->input_state[i] & INPUT_ON) { ns = av_audio_fifo_size(s->fifos[i]); if (ns < nb_samples) { if (!(s->input_state[i] & INPUT_EOF)) /* unclosed input with not enough samples */ return need_request ? ff_request_frame(ctx->inputs[i]) : 0; /* closed input to drain */ nb_samples = ns; } } } } else { /* first input closed: use the available samples */ nb_samples = INT_MAX; for (i = 1; i < s->nb_inputs; i++) { if (s->input_state[i] & INPUT_ON) { ns = av_audio_fifo_size(s->fifos[i]); nb_samples = FFMIN(nb_samples, ns); } } if (nb_samples == INT_MAX) return AVERROR_EOF; } s->next_pts = frame_list_next_pts(s->frame_list); frame_list_remove_samples(s->frame_list, nb_samples); calculate_scales(s, nb_samples); if (nb_samples == 0) return 0; out_buf = ff_get_audio_buffer(outlink, nb_samples); if (!out_buf) return AVERROR(ENOMEM); in_buf = ff_get_audio_buffer(outlink, nb_samples); if (!in_buf) { av_frame_free(&out_buf); return AVERROR(ENOMEM); } for (i = 0; i < s->nb_inputs; i++) { if (s->input_state[i] & INPUT_ON) { int planes, plane_size, p; av_audio_fifo_read(s->fifos[i], (void **)in_buf->extended_data, nb_samples); planes = s->planar ? s->nb_channels : 1; plane_size = nb_samples * (s->planar ? 1 : s->nb_channels); plane_size = FFALIGN(plane_size, 16); if (out_buf->format == AV_SAMPLE_FMT_FLT || out_buf->format == AV_SAMPLE_FMT_FLTP) { for (p = 0; p < planes; p++) { s->fdsp->vector_fmac_scalar((float *)out_buf->extended_data[p], (float *) in_buf->extended_data[p], s->input_scale[i], plane_size); } } else { for (p = 0; p < planes; p++) { s->fdsp->vector_dmac_scalar((double *)out_buf->extended_data[p], (double *) in_buf->extended_data[p], s->input_scale[i], plane_size); } } } } av_frame_free(&in_buf); out_buf->pts = s->next_pts; if (s->next_pts != AV_NOPTS_VALUE) s->next_pts += nb_samples; return ff_filter_frame(outlink, out_buf); }","No, it is non-vulnerable."556554,"static const char *token_get_value(QObject *obj) { return qdict_get_str(qobject_to_qdict(obj), ""token""); }","No, it is non-vulnerable."557555,"static void channel_store_d(struct fs_dma_ctrl *ctrl, int c) { target_phys_addr_t addr = channel_reg(ctrl, c, RW_SAVED_DATA); /* Encode and store. FIXME: handle endianness. */ D(printf(""%s ch=%d addr="" TARGET_FMT_plx ""\n"", __func__, c, addr)); cpu_physical_memory_write (addr, (void *) &ctrl->channels[c].current_d, sizeof ctrl->channels[c].current_d); }","No, it is non-vulnerable."558556,"static void omap_ulpd_pm_init(MemoryRegion *system_memory, target_phys_addr_t base, struct omap_mpu_state_s *mpu) { memory_region_init_io(&mpu->ulpd_pm_iomem, &omap_ulpd_pm_ops, mpu, ""omap-ulpd-pm"", 0x800); memory_region_add_subregion(system_memory, base, &mpu->ulpd_pm_iomem); omap_ulpd_pm_reset(mpu); }","No, it is non-vulnerable."559557,"static void ahci_reset_port(AHCIState *s, int port) { AHCIDevice *d = &s->dev[port]; AHCIPortRegs *pr = &d->port_regs; IDEState *ide_state = &d->port.ifs[0]; int i; DPRINTF(port, ""reset port\n""); ide_bus_reset(&d->port); ide_state->ncq_queues = AHCI_MAX_CMDS; pr->scr_stat = 0; pr->scr_err = 0; pr->scr_act = 0; pr->tfdata = 0x7F; pr->sig = 0xFFFFFFFF; d->busy_slot = -1; d->init_d2h_sent = false; ide_state = &s->dev[port].port.ifs[0]; if (!ide_state->bs) { return; } /* reset ncq queue */ for (i = 0; i < AHCI_MAX_CMDS; i++) { NCQTransferState *ncq_tfs = &s->dev[port].ncq_tfs[i]; if (!ncq_tfs->used) { continue; } if (ncq_tfs->aiocb) { bdrv_aio_cancel(ncq_tfs->aiocb); ncq_tfs->aiocb = NULL; } /* Maybe we just finished the request thanks to bdrv_aio_cancel() */ if (!ncq_tfs->used) { continue; } qemu_sglist_destroy(&ncq_tfs->sglist); ncq_tfs->used = 0; } s->dev[port].port_state = STATE_RUN; if (!ide_state->bs) { pr->sig = 0; ide_state->status = SEEK_STAT | WRERR_STAT; } else if (ide_state->drive_kind == IDE_CD) { pr->sig = SATA_SIGNATURE_CDROM; ide_state->lcyl = 0x14; ide_state->hcyl = 0xeb; DPRINTF(port, ""set lcyl = %d\n"", ide_state->lcyl); ide_state->status = SEEK_STAT | WRERR_STAT | READY_STAT; } else { pr->sig = SATA_SIGNATURE_DISK; ide_state->status = SEEK_STAT | WRERR_STAT; } ide_state->error = 1; ahci_init_d2h(d); }","No, it is non-vulnerable."560558,"int usb_device_detach(USBDevice *dev) { USBBus *bus = usb_bus_from_device(dev); USBPort *port; if (!dev->attached) { error_report(""Error: tried to detach unattached usb device %s\n"", dev->product_desc); return -1; } dev->attached--; QTAILQ_FOREACH(port, &bus->used, next) { if (port->dev == dev) break; } assert(port != NULL); QTAILQ_REMOVE(&bus->used, port, next); bus->nused--; usb_attach(port, NULL); QTAILQ_INSERT_TAIL(&bus->free, port, next); bus->nfree++; return 0; }","No, it is non-vulnerable."561559,"make_setup_request (AVFormatContext *s, const char *host, int port, int protocol) { RTSPState *rt = s->priv_data; int j, i, err; RTSPStream *rtsp_st; AVStream *st; RTSPHeader reply1, *reply = &reply1; char cmd[2048]; /* for each stream, make the setup request */ /* XXX: we assume the same server is used for the control of each RTSP stream */ for(j = RTSP_RTP_PORT_MIN, i = 0; i < rt->nb_rtsp_streams; ++i) { char transport[2048]; rtsp_st = rt->rtsp_streams[i]; /* compute available transports */ transport[0] = '\0'; /* RTP/UDP */ if (protocol == RTSP_PROTOCOL_RTP_UDP) { char buf[256]; /* first try in specified port range */ if (RTSP_RTP_PORT_MIN != 0) { while(j <= RTSP_RTP_PORT_MAX) { snprintf(buf, sizeof(buf), ""rtp://%s?localport=%d"", host, j); j += 2; /* we will use two port by rtp stream (rtp and rtcp) */ if (url_open(&rtsp_st->rtp_handle, buf, URL_RDWR) == 0) { goto rtp_opened; } } } /* then try on any port ** if (url_open(&rtsp_st->rtp_handle, ""rtp://"", URL_RDONLY) < 0) { ** err = AVERROR_INVALIDDATA; ** goto fail; ** } */ rtp_opened: port = rtp_get_local_port(rtsp_st->rtp_handle); if (transport[0] != '\0') av_strlcat(transport, "","", sizeof(transport)); snprintf(transport + strlen(transport), sizeof(transport) - strlen(transport) - 1, ""RTP/AVP/UDP;unicast;client_port=%d-%d"", port, port + 1); } /* RTP/TCP */ else if (protocol == RTSP_PROTOCOL_RTP_TCP) { if (transport[0] != '\0') av_strlcat(transport, "","", sizeof(transport)); snprintf(transport + strlen(transport), sizeof(transport) - strlen(transport) - 1, ""RTP/AVP/TCP""); } else if (protocol == RTSP_PROTOCOL_RTP_UDP_MULTICAST) { if (transport[0] != '\0') av_strlcat(transport, "","", sizeof(transport)); snprintf(transport + strlen(transport), sizeof(transport) - strlen(transport) - 1, ""RTP/AVP/UDP;multicast""); } snprintf(cmd, sizeof(cmd), ""SETUP %s RTSP/1.0\r\n"" ""Transport: %s\r\n"", rtsp_st->control_url, transport); rtsp_send_cmd(s, cmd, reply, NULL); if (reply->status_code == 461 /* Unsupported protocol */ && i == 0) { err = 1; goto fail; } else if (reply->status_code != RTSP_STATUS_OK || reply->nb_transports != 1) { err = AVERROR_INVALIDDATA; goto fail; } /* XXX: same protocol for all streams is required */ if (i > 0) { if (reply->transports[0].protocol != rt->protocol) { err = AVERROR_INVALIDDATA; goto fail; } } else { rt->protocol = reply->transports[0].protocol; } /* close RTP connection if not choosen */ if (reply->transports[0].protocol != RTSP_PROTOCOL_RTP_UDP && (protocol == RTSP_PROTOCOL_RTP_UDP)) { url_close(rtsp_st->rtp_handle); rtsp_st->rtp_handle = NULL; } switch(reply->transports[0].protocol) { case RTSP_PROTOCOL_RTP_TCP: rtsp_st->interleaved_min = reply->transports[0].interleaved_min; rtsp_st->interleaved_max = reply->transports[0].interleaved_max; break; case RTSP_PROTOCOL_RTP_UDP: { char url[1024]; /* XXX: also use address if specified */ snprintf(url, sizeof(url), ""rtp://%s:%d"", host, reply->transports[0].server_port_min); if (rtp_set_remote_url(rtsp_st->rtp_handle, url) < 0) { err = AVERROR_INVALIDDATA; goto fail; } } break; case RTSP_PROTOCOL_RTP_UDP_MULTICAST: { char url[1024]; struct in_addr in; in.s_addr = htonl(reply->transports[0].destination); snprintf(url, sizeof(url), ""rtp://%s:%d?ttl=%d"", inet_ntoa(in), reply->transports[0].port_min, reply->transports[0].ttl); if (url_open(&rtsp_st->rtp_handle, url, URL_RDWR) < 0) { err = AVERROR_INVALIDDATA; goto fail; } } break; } /* open the RTP context */ st = NULL; if (rtsp_st->stream_index >= 0) st = s->streams[rtsp_st->stream_index]; if (!st) s->ctx_flags |= AVFMTCTX_NOHEADER; rtsp_st->rtp_ctx = rtp_parse_open(s, st, rtsp_st->rtp_handle, rtsp_st->sdp_payload_type, &rtsp_st->rtp_payload_data); if (!rtsp_st->rtp_ctx) { err = AVERROR(ENOMEM); goto fail; } else { if(rtsp_st->dynamic_handler) { rtsp_st->rtp_ctx->dynamic_protocol_context= rtsp_st->dynamic_protocol_context; rtsp_st->rtp_ctx->parse_packet= rtsp_st->dynamic_handler->parse_packet; } } } return 0; fail: for (i=0; i<rt->nb_rtsp_streams; i++) { if (rt->rtsp_streams[i]->rtp_handle) { url_close(rt->rtsp_streams[i]->rtp_handle); rt->rtsp_streams[i]->rtp_handle = NULL; } } return err; }","No, it is non-vulnerable."562560,"static int add_metadata(int count, int type, const char *name, const char *sep, TiffContext *s) { switch(type) { case TIFF_DOUBLE: return add_doubles_metadata(count, name, sep, s); case TIFF_SHORT : return add_shorts_metadata(count, name, sep, s); case TIFF_STRING: return add_string_metadata(count, name, s); default : return AVERROR_INVALIDDATA; }; }","Yes, it is vulnerable."563561,"e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size) { E1000State *s = qemu_get_nic_opaque(nc); struct e1000_rx_desc desc; dma_addr_t base; unsigned int n, rdt; uint32_t rdh_start; uint16_t vlan_special = 0; uint8_t vlan_status = 0, vlan_offset = 0; uint8_t min_buf[MIN_BUF_SIZE]; size_t desc_offset; size_t desc_size; size_t total_size; if (!(s->mac_reg[RCTL] & E1000_RCTL_EN)) return -1; /* Pad to minimum Ethernet frame length */ if (size < sizeof(min_buf)) { memcpy(min_buf, buf, size); memset(&min_buf[size], 0, sizeof(min_buf) - size); buf = min_buf; size = sizeof(min_buf); } /* Discard oversized packets if !LPE and !SBP. */ if ((size > MAXIMUM_ETHERNET_LPE_SIZE || (size > MAXIMUM_ETHERNET_VLAN_SIZE && !(s->mac_reg[RCTL] & E1000_RCTL_LPE))) && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) { return size; } if (!receive_filter(s, buf, size)) return size; if (vlan_enabled(s) && is_vlan_packet(s, buf)) { vlan_special = cpu_to_le16(be16_to_cpup((uint16_t *)(buf + 14))); memmove((uint8_t *)buf + 4, buf, 12); vlan_status = E1000_RXD_STAT_VP; vlan_offset = 4; size -= 4; } rdh_start = s->mac_reg[RDH]; desc_offset = 0; total_size = size + fcs_len(s); if (!e1000_has_rxbufs(s, total_size)) { set_ics(s, 0, E1000_ICS_RXO); return -1; } do { desc_size = total_size - desc_offset; if (desc_size > s->rxbuf_size) { desc_size = s->rxbuf_size; } base = rx_desc_base(s) + sizeof(desc) * s->mac_reg[RDH]; pci_dma_read(&s->dev, base, &desc, sizeof(desc)); desc.special = vlan_special; desc.status |= (vlan_status | E1000_RXD_STAT_DD); if (desc.buffer_addr) { if (desc_offset < size) { size_t copy_size = size - desc_offset; if (copy_size > s->rxbuf_size) { copy_size = s->rxbuf_size; } pci_dma_write(&s->dev, le64_to_cpu(desc.buffer_addr), buf + desc_offset + vlan_offset, copy_size); } desc_offset += desc_size; desc.length = cpu_to_le16(desc_size); if (desc_offset >= total_size) { desc.status |= E1000_RXD_STAT_EOP | E1000_RXD_STAT_IXSM; } else { /* Guest zeroing out status is not a hardware requirement. Clear EOP in case guest didn't do it. */ desc.status &= ~E1000_RXD_STAT_EOP; } } else { // as per intel docs; skip descriptors with null buf addr DBGOUT(RX, ""Null RX descriptor!!\n""); } pci_dma_write(&s->dev, base, &desc, sizeof(desc)); if (++s->mac_reg[RDH] * sizeof(desc) >= s->mac_reg[RDLEN]) s->mac_reg[RDH] = 0; /* see comment in start_xmit; same here */ if (s->mac_reg[RDH] == rdh_start) { DBGOUT(RXERR, ""RDH wraparound @%x, RDT %x, RDLEN %x\n"", rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]); set_ics(s, 0, E1000_ICS_RXO); return -1; } } while (desc_offset < total_size); s->mac_reg[GPRC]++; s->mac_reg[TPR]++; /* TOR - Total Octets Received: * This register includes bytes received in a packet from the <Destination * Address> field through the <CRC> field, inclusively. */ n = s->mac_reg[TORL] + size + /* Always include FCS length. */ 4; if (n < s->mac_reg[TORL]) s->mac_reg[TORH]++; s->mac_reg[TORL] = n; n = E1000_ICS_RXT0; if ((rdt = s->mac_reg[RDT]) < s->mac_reg[RDH]) rdt += s->mac_reg[RDLEN] / sizeof(desc); if (((rdt - s->mac_reg[RDH]) * sizeof(desc)) <= s->mac_reg[RDLEN] >> s->rxbuf_min_shift) n |= E1000_ICS_RXDMT0; set_ics(s, 0, n); return size; }","Yes, it is vulnerable."564562,"real_parse_asm_rule(AVStream *st, const char *p, const char *end) { do { /* can be either averagebandwidth= or AverageBandwidth= */ #if AV_HAVE_INCOMPATIBLE_LIBAV_ABI if (sscanf(p, "" %*1[Aa]verage%*1[Bb]andwidth=%d"", &st->codec->bit_rate) == 1) #else if (sscanf(p, "" %*1[Aa]verage%*1[Bb]andwidth=%""SCNd64, &st->codec->bit_rate) == 1) #endif break; if (!(p = strchr(p, ',')) || p > end) p = end; p++; } while (p < end); }","No, it is non-vulnerable."565563,"int select_watchdog(const char *p) { WatchdogTimerModel *model; if (watchdog) { fprintf(stderr, ""qemu: only one watchdog option may be given\n""); return 1; } /* -watchdog ? lists available devices and exits cleanly. */ if (strcmp(p, ""?"") == 0) { LIST_FOREACH(model, &watchdog_list, entry) { fprintf(stderr, ""\t%s\t%s\n"", model->wdt_name, model->wdt_description); } return 2; } LIST_FOREACH(model, &watchdog_list, entry) { if (strcasecmp(model->wdt_name, p) == 0) { watchdog = model; return 0; } } fprintf(stderr, ""Unknown -watchdog device. Supported devices are:\n""); LIST_FOREACH(model, &watchdog_list, entry) { fprintf(stderr, ""\t%s\t%s\n"", model->wdt_name, model->wdt_description); } return 1; }","Yes, it is vulnerable."566564,"static int vp3_decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; Vp3DecodeContext *s = avctx->priv_data; GetBitContext gb; static int counter = 0; int i; init_get_bits(&gb, buf, buf_size * 8); if (s->theora && get_bits1(&gb)) { av_log(avctx, AV_LOG_ERROR, ""Header packet passed to frame decoder, skipping\n""); return -1; } s->keyframe = !get_bits1(&gb); if (!s->theora) skip_bits(&gb, 1); for (i = 0; i < 3; i++) s->last_qps[i] = s->qps[i]; s->nqps=0; do{ s->qps[s->nqps++]= get_bits(&gb, 6); } while(s->theora >= 0x030200 && s->nqps<3 && get_bits1(&gb)); for (i = s->nqps; i < 3; i++) s->qps[i] = -1; if (s->avctx->debug & FF_DEBUG_PICT_INFO) av_log(s->avctx, AV_LOG_INFO, "" VP3 %sframe #%d: Q index = %d\n"", s->keyframe?""key"":"""", counter, s->qps[0]); counter++; if (s->qps[0] != s->last_qps[0]) init_loop_filter(s); for (i = 0; i < s->nqps; i++) // reinit all dequantizers if the first one changed, because // the DC of the first quantizer must be used for all matrices if (s->qps[i] != s->last_qps[i] || s->qps[0] != s->last_qps[0]) init_dequantizer(s, i); if (avctx->skip_frame >= AVDISCARD_NONKEY && !s->keyframe) return buf_size; s->current_frame.reference = 3; if (avctx->get_buffer(avctx, &s->current_frame) < 0) { av_log(s->avctx, AV_LOG_ERROR, ""get_buffer() failed\n""); return -1; } if (s->keyframe) { if (!s->theora) { skip_bits(&gb, 4); /* width code */ skip_bits(&gb, 4); /* height code */ if (s->version) { s->version = get_bits(&gb, 5); if (counter == 1) av_log(s->avctx, AV_LOG_DEBUG, ""VP version: %d\n"", s->version); } } if (s->version || s->theora) { if (get_bits1(&gb)) av_log(s->avctx, AV_LOG_ERROR, ""Warning, unsupported keyframe coding type?!\n""); skip_bits(&gb, 2); /* reserved? */ } } else { if (!s->golden_frame.data[0]) { av_log(s->avctx, AV_LOG_ERROR, ""vp3: first frame not a keyframe\n""); avctx->release_buffer(avctx, &s->current_frame); return -1; } } s->current_frame.qscale_table= s->qscale_table; //FIXME allocate individual tables per AVFrame s->current_frame.qstride= 0; init_frame(s, &gb); if (unpack_superblocks(s, &gb)){ av_log(s->avctx, AV_LOG_ERROR, ""error in unpack_superblocks\n""); return -1; } if (unpack_modes(s, &gb)){ av_log(s->avctx, AV_LOG_ERROR, ""error in unpack_modes\n""); return -1; } if (unpack_vectors(s, &gb)){ av_log(s->avctx, AV_LOG_ERROR, ""error in unpack_vectors\n""); return -1; } if (unpack_block_qpis(s, &gb)){ av_log(s->avctx, AV_LOG_ERROR, ""error in unpack_block_qpis\n""); return -1; } if (unpack_dct_coeffs(s, &gb)){ av_log(s->avctx, AV_LOG_ERROR, ""error in unpack_dct_coeffs\n""); return -1; } for (i = 0; i < 3; i++) { if (s->flipped_image) s->data_offset[i] = 0; else s->data_offset[i] = ((s->height>>!!i)-1) * s->current_frame.linesize[i]; } s->last_slice_end = 0; for (i = 0; i < s->c_superblock_height; i++) render_slice(s, i); // filter the last row for (i = 0; i < 3; i++) { int row = (s->height >> (3+!!i)) - 1; apply_loop_filter(s, i, row, row+1); } vp3_draw_horiz_band(s, s->height); *data_size=sizeof(AVFrame); *(AVFrame*)data= s->current_frame; /* release the last frame, if it is allocated and if it is not the * golden frame */ if ((s->last_frame.data[0]) && (s->last_frame.data[0] != s->golden_frame.data[0])) avctx->release_buffer(avctx, &s->last_frame); /* shuffle frames (last = current) */ s->last_frame= s->current_frame; if (s->keyframe) { if (s->golden_frame.data[0]) avctx->release_buffer(avctx, &s->golden_frame); s->golden_frame = s->current_frame; } s->current_frame.data[0]= NULL; /* ensure that we catch any access to this released frame */ return buf_size; }","Yes, it is vulnerable."567565,"static void mainstone_common_init(MemoryRegion *address_space_mem, ram_addr_t ram_size, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model, enum mainstone_model_e model, int arm_id) { uint32_t sector_len = 256 * 1024; target_phys_addr_t mainstone_flash_base[] = { MST_FLASH_0, MST_FLASH_1 }; PXA2xxState *mpu; DeviceState *mst_irq; DriveInfo *dinfo; int i; int be; MemoryRegion *rom = g_new(MemoryRegion, 1); if (!cpu_model) cpu_model = ""pxa270-c5""; /* Setup CPU & memory */ mpu = pxa270_init(address_space_mem, mainstone_binfo.ram_size, cpu_model); memory_region_init_ram(rom, ""mainstone.rom"", MAINSTONE_ROM); vmstate_register_ram_global(rom); memory_region_set_readonly(rom, true); memory_region_add_subregion(address_space_mem, 0, rom); #ifdef TARGET_WORDS_BIGENDIAN be = 1; #else be = 0; #endif /* There are two 32MiB flash devices on the board */ for (i = 0; i < 2; i ++) { dinfo = drive_get(IF_PFLASH, 0, i); if (!dinfo) { fprintf(stderr, ""Two flash images must be given with the "" ""'pflash' parameter\n""); exit(1); } if (!pflash_cfi01_register(mainstone_flash_base[i], NULL, i ? ""mainstone.flash1"" : ""mainstone.flash0"", MAINSTONE_FLASH, dinfo->bdrv, sector_len, MAINSTONE_FLASH / sector_len, 4, 0, 0, 0, 0, be)) { fprintf(stderr, ""qemu: Error registering flash memory.\n""); exit(1); } } mst_irq = sysbus_create_simple(""mainstone-fpga"", MST_FPGA_PHYS, qdev_get_gpio_in(mpu->gpio, 0)); /* setup keypad */ printf(""map addr %p\n"", &map); pxa27x_register_keypad(mpu->kp, map, 0xe0); /* MMC/SD host */ pxa2xx_mmci_handlers(mpu->mmc, NULL, qdev_get_gpio_in(mst_irq, MMC_IRQ)); pxa2xx_pcmcia_set_irq_cb(mpu->pcmcia[0], qdev_get_gpio_in(mst_irq, S0_IRQ), qdev_get_gpio_in(mst_irq, S0_CD_IRQ)); pxa2xx_pcmcia_set_irq_cb(mpu->pcmcia[1], qdev_get_gpio_in(mst_irq, S1_IRQ), qdev_get_gpio_in(mst_irq, S1_CD_IRQ)); smc91c111_init(&nd_table[0], MST_ETH_PHYS, qdev_get_gpio_in(mst_irq, ETHERNET_IRQ)); mainstone_binfo.kernel_filename = kernel_filename; mainstone_binfo.kernel_cmdline = kernel_cmdline; mainstone_binfo.initrd_filename = initrd_filename; mainstone_binfo.board_id = arm_id; arm_load_kernel(mpu->cpu, &mainstone_binfo); }","No, it is non-vulnerable."568566,"static void gicv3_cpuif_el_change_hook(ARMCPU *cpu, void *opaque) { /* Do nothing for now. */ }","No, it is non-vulnerable."569567,"static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size) { unsigned desc[2]; target_phys_addr_t packet_desc_addr, last_desc_addr; GemState *s; unsigned rxbufsize, bytes_to_copy; unsigned rxbuf_offset; uint8_t rxbuf[2048]; uint8_t *rxbuf_ptr; s = DO_UPCAST(NICState, nc, nc)->opaque; /* Do nothing if receive is not enabled. */ if (!(s->regs[GEM_NWCTRL] & GEM_NWCTRL_RXENA)) { return -1; } /* Is this destination MAC address ""for us"" ? */ if (gem_mac_address_filter(s, buf) == GEM_RX_REJECT) { return -1; } /* Discard packets with receive length error enabled ? */ if (s->regs[GEM_NWCFG] & GEM_NWCFG_LERR_DISC) { unsigned type_len; /* Fish the ethertype / length field out of the RX packet */ type_len = buf[12] << 8 | buf[13]; /* It is a length field, not an ethertype */ if (type_len < 0x600) { if (size < type_len) { /* discard */ return -1; } } } /* * Determine configured receive buffer offset (probably 0) */ rxbuf_offset = (s->regs[GEM_NWCFG] & GEM_NWCFG_BUFF_OFST_M) >> GEM_NWCFG_BUFF_OFST_S; /* The configure size of each receive buffer. Determines how many * buffers needed to hold this packet. */ rxbufsize = ((s->regs[GEM_DMACFG] & GEM_DMACFG_RBUFSZ_M) >> GEM_DMACFG_RBUFSZ_S) * GEM_DMACFG_RBUFSZ_MUL; bytes_to_copy = size; /* Strip of FCS field ? (usually yes) */ if (s->regs[GEM_NWCFG] & GEM_NWCFG_STRIP_FCS) { rxbuf_ptr = (void *)buf; } else { unsigned crc_val; int crc_offset; /* The application wants the FCS field, which QEMU does not provide. * We must try and caclculate one. */ memcpy(rxbuf, buf, size); memset(rxbuf + size, 0, sizeof(rxbuf) - size); rxbuf_ptr = rxbuf; crc_val = cpu_to_le32(crc32(0, rxbuf, MAX(size, 60))); if (size < 60) { crc_offset = 60; } else { crc_offset = size; } memcpy(rxbuf + crc_offset, &crc_val, sizeof(crc_val)); bytes_to_copy += 4; size += 4; } /* Pad to minimum length */ if (size < 64) { size = 64; } DB_PRINT(""config bufsize: %d packet size: %ld\n"", rxbufsize, size); packet_desc_addr = s->rx_desc_addr; while (1) { DB_PRINT(""read descriptor 0x%x\n"", packet_desc_addr); /* read current descriptor */ cpu_physical_memory_read(packet_desc_addr, (uint8_t *)&desc[0], sizeof(desc)); /* Descriptor owned by software ? */ if (rx_desc_get_ownership(desc) == 1) { DB_PRINT(""descriptor 0x%x owned by sw.\n"", packet_desc_addr); s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF; /* Handle interrupt consequences */ gem_update_int_status(s); return -1; } DB_PRINT(""copy %d bytes to 0x%x\n"", MIN(bytes_to_copy, rxbufsize), rx_desc_get_buffer(desc)); /* * Let's have QEMU lend a helping hand. */ if (rx_desc_get_buffer(desc) == 0) { DB_PRINT(""Invalid RX buffer (NULL) for descriptor 0x%x\n"", packet_desc_addr); break; } /* Copy packet data to emulated DMA buffer */ cpu_physical_memory_write(rx_desc_get_buffer(desc) + rxbuf_offset, rxbuf_ptr, MIN(bytes_to_copy, rxbufsize)); bytes_to_copy -= MIN(bytes_to_copy, rxbufsize); rxbuf_ptr += MIN(bytes_to_copy, rxbufsize); if (bytes_to_copy == 0) { break; } /* Next descriptor */ if (rx_desc_get_wrap(desc)) { packet_desc_addr = s->regs[GEM_RXQBASE]; } else { packet_desc_addr += 8; } } DB_PRINT(""set length: %ld, EOF on descriptor 0x%x\n"", size, (unsigned)packet_desc_addr); /* Update last descriptor with EOF and total length */ rx_desc_set_eof(desc); rx_desc_set_length(desc, size); cpu_physical_memory_write(packet_desc_addr, (uint8_t *)&desc[0], sizeof(desc)); /* Advance RX packet descriptor Q */ last_desc_addr = packet_desc_addr; packet_desc_addr = s->rx_desc_addr; s->rx_desc_addr = last_desc_addr; if (rx_desc_get_wrap(desc)) { s->rx_desc_addr = s->regs[GEM_RXQBASE]; } else { s->rx_desc_addr += 8; } DB_PRINT(""set SOF, OWN on descriptor 0x%08x\n"", packet_desc_addr); /* Count it */ gem_receive_updatestats(s, buf, size); /* Update first descriptor (which could also be the last) */ /* read descriptor */ cpu_physical_memory_read(packet_desc_addr, (uint8_t *)&desc[0], sizeof(desc)); rx_desc_set_sof(desc); rx_desc_set_ownership(desc); cpu_physical_memory_write(packet_desc_addr, (uint8_t *)&desc[0], sizeof(desc)); s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_FRMRCVD; /* Handle interrupt consequences */ gem_update_int_status(s); return size; }","No, it is non-vulnerable."570568,"static int dxva2_vc1_end_frame(AVCodecContext *avctx) { VC1Context *v = avctx->priv_data; struct dxva2_picture_context *ctx_pic = v->s.current_picture_ptr->hwaccel_picture_private; int ret; if (ctx_pic->bitstream_size <= 0) return -1; ret = ff_dxva2_common_end_frame(avctx, &v->s.current_picture_ptr->f, &ctx_pic->pp, sizeof(ctx_pic->pp), NULL, 0, commit_bitstream_and_slice_buffer); if (!ret) ff_mpeg_draw_horiz_band(&v->s, 0, avctx->height); return ret; }","Yes, it is vulnerable."571569,"static char *vnc_socket_remote_addr(const char *format, int fd) { struct sockaddr_storage sa; socklen_t salen; salen = sizeof(sa); if (getpeername(fd, (struct sockaddr*)&sa, &salen) < 0) return NULL; return addr_to_string(format, &sa, salen); }","Yes, it is vulnerable."572570,"static int qemu_gluster_open(BlockDriverState *bs, QDict *options, int bdrv_flags, Error **errp) { BDRVGlusterState *s = bs->opaque; int open_flags = 0; int ret = 0; BlockdevOptionsGluster *gconf = NULL; QemuOpts *opts; Error *local_err = NULL; const char *filename; opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort); qemu_opts_absorb_qdict(opts, options, &local_err); if (local_err) { error_propagate(errp, local_err); ret = -EINVAL; goto out; } filename = qemu_opt_get(opts, GLUSTER_OPT_FILENAME); s->debug_level = qemu_opt_get_number(opts, GLUSTER_OPT_DEBUG, GLUSTER_DEBUG_DEFAULT); if (s->debug_level < 0) { s->debug_level = 0; } else if (s->debug_level > GLUSTER_DEBUG_MAX) { s->debug_level = GLUSTER_DEBUG_MAX; } gconf = g_new0(BlockdevOptionsGluster, 1); gconf->debug_level = s->debug_level; gconf->has_debug_level = true; s->glfs = qemu_gluster_init(gconf, filename, options, errp); if (!s->glfs) { ret = -errno; goto out; } #ifdef CONFIG_GLUSTERFS_XLATOR_OPT /* Without this, if fsync fails for a recoverable reason (for instance, * ENOSPC), gluster will dump its cache, preventing retries. This means * almost certain data loss. Not all gluster versions support the * 'resync-failed-syncs-after-fsync' key value, but there is no way to * discover during runtime if it is supported (this api returns success for * unknown key/value pairs) */ ret = glfs_set_xlator_option(s->glfs, ""*-write-behind"", ""resync-failed-syncs-after-fsync"", ""on""); if (ret < 0) { error_setg_errno(errp, errno, ""Unable to set xlator key/value pair""); ret = -errno; goto out; } #endif qemu_gluster_parse_flags(bdrv_flags, &open_flags); s->fd = glfs_open(s->glfs, gconf->path, open_flags); if (!s->fd) { ret = -errno; } s->supports_seek_data = qemu_gluster_test_seek(s->fd); out: qemu_opts_del(opts); qapi_free_BlockdevOptionsGluster(gconf); if (!ret) { return ret; } if (s->fd) { glfs_close(s->fd); } if (s->glfs) { glfs_fini(s->glfs); } return ret; }","Yes, it is vulnerable."573571,"static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h) { BitBuf bb; int res, val; int i, j; int bx, by; int l0x, l1x, l0y, l1y; int mx, my; kmvc_init_getbits(bb, &ctx->g); for (by = 0; by < h; by += 8) for (bx = 0; bx < w; bx += 8) { if (!bytestream2_get_bytes_left(&ctx->g)) { av_log(ctx->avctx, AV_LOG_ERROR, ""Data overrun\n""); return AVERROR_INVALIDDATA; } kmvc_getbit(bb, &ctx->g, res); if (!res) { // fill whole 8x8 block val = bytestream2_get_byte(&ctx->g); for (i = 0; i < 64; i++) BLK(ctx->cur, bx + (i & 0x7), by + (i >> 3)) = val; } else { // handle four 4x4 subblocks for (i = 0; i < 4; i++) { l0x = bx + (i & 1) * 4; l0y = by + (i & 2) * 2; kmvc_getbit(bb, &ctx->g, res); if (!res) { kmvc_getbit(bb, &ctx->g, res); if (!res) { // fill whole 4x4 block val = bytestream2_get_byte(&ctx->g); for (j = 0; j < 16; j++) BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = val; } else { // copy block from already decoded place val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 316*196) { av_log(ctx->avctx, AV_LOG_ERROR, ""Invalid MV\n""); return AVERROR_INVALIDDATA; } for (j = 0; j < 16; j++) BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = BLK(ctx->cur, l0x + (j & 3) - mx, l0y + (j >> 2) - my); } } else { // descend to 2x2 sub-sub-blocks for (j = 0; j < 4; j++) { l1x = l0x + (j & 1) * 2; l1y = l0y + (j & 2); kmvc_getbit(bb, &ctx->g, res); if (!res) { kmvc_getbit(bb, &ctx->g, res); if (!res) { // fill whole 2x2 block val = bytestream2_get_byte(&ctx->g); BLK(ctx->cur, l1x, l1y) = val; BLK(ctx->cur, l1x + 1, l1y) = val; BLK(ctx->cur, l1x, l1y + 1) = val; BLK(ctx->cur, l1x + 1, l1y + 1) = val; } else { // copy block from already decoded place val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 318*198) { av_log(ctx->avctx, AV_LOG_ERROR, ""Invalid MV\n""); return AVERROR_INVALIDDATA; } BLK(ctx->cur, l1x, l1y) = BLK(ctx->cur, l1x - mx, l1y - my); BLK(ctx->cur, l1x + 1, l1y) = BLK(ctx->cur, l1x + 1 - mx, l1y - my); BLK(ctx->cur, l1x, l1y + 1) = BLK(ctx->cur, l1x - mx, l1y + 1 - my); BLK(ctx->cur, l1x + 1, l1y + 1) = BLK(ctx->cur, l1x + 1 - mx, l1y + 1 - my); } } else { // read values for block BLK(ctx->cur, l1x, l1y) = bytestream2_get_byte(&ctx->g); BLK(ctx->cur, l1x + 1, l1y) = bytestream2_get_byte(&ctx->g); BLK(ctx->cur, l1x, l1y + 1) = bytestream2_get_byte(&ctx->g); BLK(ctx->cur, l1x + 1, l1y + 1) = bytestream2_get_byte(&ctx->g); } } } } } } return 0; }","No, it is non-vulnerable."574572,"static uint32_t pci_unin_main_config_readl (void *opaque, target_phys_addr_t addr) { UNINState *s = opaque; uint32_t val; val = s->config_reg; #ifdef TARGET_WORDS_BIGENDIAN val = bswap32(val); #endif UNIN_DPRINTF(""config_readl addr "" TARGET_FMT_plx "" val %x\n"", addr, val); return val; }","Yes, it is vulnerable."575573,"static int ram_save_init_globals(void) { int64_t ram_bitmap_pages; /* Size of bitmap in pages, including gaps */ dirty_rate_high_cnt = 0; bitmap_sync_count = 0; migration_bitmap_sync_init(); qemu_mutex_init(&migration_bitmap_mutex); if (migrate_use_xbzrle()) { XBZRLE_cache_lock(); ZERO_TARGET_PAGE = g_malloc0(TARGET_PAGE_SIZE); XBZRLE.cache = cache_init(migrate_xbzrle_cache_size() / TARGET_PAGE_SIZE, TARGET_PAGE_SIZE); if (!XBZRLE.cache) { XBZRLE_cache_unlock(); error_report(""Error creating cache""); return -1; } XBZRLE_cache_unlock(); /* We prefer not to abort if there is no memory */ XBZRLE.encoded_buf = g_try_malloc0(TARGET_PAGE_SIZE); if (!XBZRLE.encoded_buf) { error_report(""Error allocating encoded_buf""); return -1; } XBZRLE.current_buf = g_try_malloc(TARGET_PAGE_SIZE); if (!XBZRLE.current_buf) { error_report(""Error allocating current_buf""); g_free(XBZRLE.encoded_buf); XBZRLE.encoded_buf = NULL; return -1; } acct_clear(); } /* For memory_global_dirty_log_start below. */ qemu_mutex_lock_iothread(); qemu_mutex_lock_ramlist(); rcu_read_lock(); bytes_transferred = 0; reset_ram_globals(); ram_bitmap_pages = last_ram_offset() >> TARGET_PAGE_BITS; migration_bitmap_rcu = g_new0(struct BitmapRcu, 1); migration_bitmap_rcu->bmap = bitmap_new(ram_bitmap_pages); bitmap_set(migration_bitmap_rcu->bmap, 0, ram_bitmap_pages); if (migrate_postcopy_ram()) { migration_bitmap_rcu->unsentmap = bitmap_new(ram_bitmap_pages); bitmap_set(migration_bitmap_rcu->unsentmap, 0, ram_bitmap_pages); } /* * Count the total number of pages used by ram blocks not including any * gaps due to alignment or unplugs. */ migration_dirty_pages = ram_bytes_total() >> TARGET_PAGE_BITS; memory_global_dirty_log_start(); migration_bitmap_sync(); qemu_mutex_unlock_ramlist(); qemu_mutex_unlock_iothread(); rcu_read_unlock(); return 0; }","Yes, it is vulnerable."576574,"static uint16_t nvme_dma_read_prp(NvmeCtrl *n, uint8_t *ptr, uint32_t len, uint64_t prp1, uint64_t prp2) { QEMUSGList qsg; QEMUIOVector iov; uint16_t status = NVME_SUCCESS; if (nvme_map_prp(&qsg, &iov, prp1, prp2, len, n)) { return NVME_INVALID_FIELD | NVME_DNR; } if (qsg.nsg > 0) { if (dma_buf_read(ptr, len, &qsg)) { status = NVME_INVALID_FIELD | NVME_DNR; } qemu_sglist_destroy(&qsg); } else { if (qemu_iovec_to_buf(&iov, 0, ptr, len) != len) { status = NVME_INVALID_FIELD | NVME_DNR; } qemu_iovec_destroy(&iov); } return status; }","Yes, it is vulnerable."577575,"static int asf_read_metadata_obj(AVFormatContext *s, const GUIDParseTable *g) { ASFContext *asf = s->priv_data; AVIOContext *pb = s->pb; uint64_t size = avio_rl64(pb); uint16_t nb_recs = avio_rl16(pb); // number of records in the Description Records list int i, ret; for (i = 0; i < nb_recs; i++) { uint16_t name_len, buflen, type, val_len, st_num; uint8_t *name = NULL; avio_skip(pb, 2); // skip reserved field st_num = avio_rl16(pb); name_len = avio_rl16(pb); buflen = 2 * name_len + 1; if (!name_len) break; type = avio_rl16(pb); val_len = avio_rl32(pb); name = av_malloc(name_len); if (!name) return AVERROR(ENOMEM); avio_get_str16le(pb, name_len, name, buflen); if (!strcmp(name, ""AspectRatioX"") || !strcmp(name, ""AspectRatioY"")) { asf_store_aspect_ratio(s, st_num, name); } else { if (st_num < ASF_MAX_STREAMS) { if ((ret = process_metadata(s, name, name_len, val_len, type, &asf->asf_sd[st_num].asf_met)) < 0) break; } else av_freep(&name); } } align_position(pb, asf->offset, size); return 0; }","Yes, it is vulnerable."578576,"static int check_refcounts_l1(BlockDriverState *bs, BdrvCheckResult *res, uint16_t *refcount_table, int64_t refcount_table_size, int64_t l1_table_offset, int l1_size, int flags) { BDRVQcowState *s = bs->opaque; uint64_t *l1_table, l2_offset, l1_size2; int i, ret; l1_size2 = l1_size * sizeof(uint64_t); /* Mark L1 table as used */ inc_refcounts(bs, res, refcount_table, refcount_table_size, l1_table_offset, l1_size2); /* Read L1 table entries from disk */ if (l1_size2 == 0) { l1_table = NULL; } else { l1_table = g_try_malloc(l1_size2); if (l1_table == NULL) { ret = -ENOMEM; goto fail; } if (bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2) != l1_size2) goto fail; for(i = 0;i < l1_size; i++) be64_to_cpus(&l1_table[i]); } /* Do the actual checks */ for(i = 0; i < l1_size; i++) { l2_offset = l1_table[i]; if (l2_offset) { /* Mark L2 table as used */ l2_offset &= L1E_OFFSET_MASK; inc_refcounts(bs, res, refcount_table, refcount_table_size, l2_offset, s->cluster_size); /* L2 tables are cluster aligned */ if (offset_into_cluster(s, l2_offset)) { fprintf(stderr, ""ERROR l2_offset=%"" PRIx64 "": Table is not "" ""cluster aligned; L1 entry corrupted\n"", l2_offset); res->corruptions++; } /* Process and check L2 entries */ ret = check_refcounts_l2(bs, res, refcount_table, refcount_table_size, l2_offset, flags); if (ret < 0) { goto fail; } } } g_free(l1_table); return 0; fail: fprintf(stderr, ""ERROR: I/O error in check_refcounts_l1\n""); res->check_errors++; g_free(l1_table); return -EIO; }","Yes, it is vulnerable."579577,"DeviceState *i2c_create_slave(i2c_bus *bus, const char *name, uint8_t addr) { DeviceState *dev; dev = qdev_create(&bus->qbus, name); qdev_prop_set_uint8(dev, ""address"", addr); qdev_init(dev); return dev; }","Yes, it is vulnerable."580578,"static void strongarm_gpio_write(void *opaque, hwaddr offset, uint64_t value, unsigned size) { StrongARMGPIOInfo *s = opaque; switch (offset) { case GPDR: /* GPIO Pin-Direction registers */ s->dir = value; strongarm_gpio_handler_update(s); break; case GPSR: /* GPIO Pin-Output Set registers */ s->olevel |= value; strongarm_gpio_handler_update(s); s->gpsr = value; break; case GPCR: /* GPIO Pin-Output Clear registers */ s->olevel &= ~value; strongarm_gpio_handler_update(s); break; case GRER: /* GPIO Rising-Edge Detect Enable registers */ s->rising = value; break; case GFER: /* GPIO Falling-Edge Detect Enable registers */ s->falling = value; break; case GAFR: /* GPIO Alternate Function registers */ s->gafr = value; break; case GEDR: /* GPIO Edge Detect Status registers */ s->status &= ~value; strongarm_gpio_irq_update(s); break; default: printf(""%s: Bad offset 0x"" TARGET_FMT_plx ""\n"", __func__, offset); } }","Yes, it is vulnerable."581579,"static void gen_bitops (DisasContext *ctx, uint32_t opc, int rt, int rs, int lsb, int msb) { TCGv t0 = tcg_temp_new(); TCGv t1 = tcg_temp_new(); gen_load_gpr(t1, rs); switch (opc) { case OPC_EXT: if (lsb + msb > 31) goto fail; tcg_gen_shri_tl(t0, t1, lsb); if (msb != 31) { tcg_gen_andi_tl(t0, t0, (1 << (msb + 1)) - 1); } else { tcg_gen_ext32s_tl(t0, t0); } break; #if defined(TARGET_MIPS64) case OPC_DEXTM: tcg_gen_shri_tl(t0, t1, lsb); if (msb != 31) { tcg_gen_andi_tl(t0, t0, (1ULL << (msb + 1 + 32)) - 1); } break; case OPC_DEXTU: tcg_gen_shri_tl(t0, t1, lsb + 32); tcg_gen_andi_tl(t0, t0, (1ULL << (msb + 1)) - 1); break; case OPC_DEXT: tcg_gen_shri_tl(t0, t1, lsb); tcg_gen_andi_tl(t0, t0, (1ULL << (msb + 1)) - 1); break; #endif case OPC_INS: if (lsb > msb) goto fail; gen_load_gpr(t0, rt); tcg_gen_deposit_tl(t0, t0, t1, lsb, msb - lsb + 1); tcg_gen_ext32s_tl(t0, t0); break; #if defined(TARGET_MIPS64) case OPC_DINSM: gen_load_gpr(t0, rt); tcg_gen_deposit_tl(t0, t0, t1, lsb, msb + 32 - lsb + 1); break; case OPC_DINSU: gen_load_gpr(t0, rt); tcg_gen_deposit_tl(t0, t0, t1, lsb + 32, msb - lsb + 1); break; case OPC_DINS: gen_load_gpr(t0, rt); tcg_gen_deposit_tl(t0, t0, t1, lsb, msb - lsb + 1); break; #endif default: fail: MIPS_INVAL(""bitops""); generate_exception(ctx, EXCP_RI); tcg_temp_free(t0); tcg_temp_free(t1); return; } gen_store_gpr(t0, rt); tcg_temp_free(t0); tcg_temp_free(t1); }","Yes, it is vulnerable."582580,"static int vhost_scsi_exit(DeviceState *qdev) { VirtIODevice *vdev = VIRTIO_DEVICE(qdev); VHostSCSI *s = VHOST_SCSI(qdev); VirtIOSCSICommon *vs = VIRTIO_SCSI_COMMON(qdev); migrate_del_blocker(s->migration_blocker); error_free(s->migration_blocker); /* This will stop vhost backend. */ vhost_scsi_set_status(vdev, 0); g_free(s->dev.vqs); return virtio_scsi_common_exit(vs); }","Yes, it is vulnerable."583581,"static inline void RENAME(rgb24toyv12)(const uint8_t *src, uint8_t *ydst, uint8_t *udst, uint8_t *vdst, unsigned int width, unsigned int height, int lumStride, int chromStride, int srcStride) { unsigned y; const unsigned chromWidth= width>>1; #ifdef HAVE_MMX for(y=0; y<height-2; y+=2) { unsigned i; for(i=0; i<2; i++) { asm volatile( ""mov %2, %%""REG_a"" \n\t"" ""movq ""MANGLE(bgr2YCoeff)"", %%mm6 \n\t"" ""movq ""MANGLE(w1111)"", %%mm5 \n\t"" ""pxor %%mm7, %%mm7 \n\t"" ""lea (%%""REG_a"", %%""REG_a"", 2), %%""REG_b""\n\t"" "".balign 16 \n\t"" ""1: \n\t"" PREFETCH"" 64(%0, %%""REG_b"") \n\t"" ""movd (%0, %%""REG_b""), %%mm0 \n\t"" ""movd 3(%0, %%""REG_b""), %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm0 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""movd 6(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 9(%0, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm0 \n\t"" ""pmaddwd %%mm6, %%mm1 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" ""pmaddwd %%mm6, %%mm3 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm0 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm1, %%mm0 \n\t"" ""packssdw %%mm3, %%mm2 \n\t"" ""pmaddwd %%mm5, %%mm0 \n\t"" ""pmaddwd %%mm5, %%mm2 \n\t"" ""packssdw %%mm2, %%mm0 \n\t"" ""psraw $7, %%mm0 \n\t"" ""movd 12(%0, %%""REG_b""), %%mm4 \n\t"" ""movd 15(%0, %%""REG_b""), %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm4 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""movd 18(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 21(%0, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm4 \n\t"" ""pmaddwd %%mm6, %%mm1 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" ""pmaddwd %%mm6, %%mm3 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm4 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm1, %%mm4 \n\t"" ""packssdw %%mm3, %%mm2 \n\t"" ""pmaddwd %%mm5, %%mm4 \n\t"" ""pmaddwd %%mm5, %%mm2 \n\t"" ""add $24, %%""REG_b"" \n\t"" ""packssdw %%mm2, %%mm4 \n\t"" ""psraw $7, %%mm4 \n\t"" ""packuswb %%mm4, %%mm0 \n\t"" ""paddusb ""MANGLE(bgr2YOffset)"", %%mm0 \n\t"" MOVNTQ"" %%mm0, (%1, %%""REG_a"") \n\t"" ""add $8, %%""REG_a"" \n\t"" "" js 1b \n\t"" : : ""r"" (src+width*3), ""r"" (ydst+width), ""g"" ((long)-width) : ""%""REG_a, ""%""REG_b ); ydst += lumStride; src += srcStride; } src -= srcStride*2; asm volatile( ""mov %4, %%""REG_a"" \n\t"" ""movq ""MANGLE(w1111)"", %%mm5 \n\t"" ""movq ""MANGLE(bgr2UCoeff)"", %%mm6 \n\t"" ""pxor %%mm7, %%mm7 \n\t"" ""lea (%%""REG_a"", %%""REG_a"", 2), %%""REG_b""\n\t"" ""add %%""REG_b"", %%""REG_b"" \n\t"" "".balign 16 \n\t"" ""1: \n\t"" PREFETCH"" 64(%0, %%""REG_b"") \n\t"" PREFETCH"" 64(%1, %%""REG_b"") \n\t"" #if defined (HAVE_MMX2) || defined (HAVE_3DNOW) ""movq (%0, %%""REG_b""), %%mm0 \n\t"" ""movq (%1, %%""REG_b""), %%mm1 \n\t"" ""movq 6(%0, %%""REG_b""), %%mm2 \n\t"" ""movq 6(%1, %%""REG_b""), %%mm3 \n\t"" PAVGB"" %%mm1, %%mm0 \n\t"" PAVGB"" %%mm3, %%mm2 \n\t"" ""movq %%mm0, %%mm1 \n\t"" ""movq %%mm2, %%mm3 \n\t"" ""psrlq $24, %%mm0 \n\t"" ""psrlq $24, %%mm2 \n\t"" PAVGB"" %%mm1, %%mm0 \n\t"" PAVGB"" %%mm3, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm0 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" #else ""movd (%0, %%""REG_b""), %%mm0 \n\t"" ""movd (%1, %%""REG_b""), %%mm1 \n\t"" ""movd 3(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 3(%1, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm0 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""paddw %%mm1, %%mm0 \n\t"" ""paddw %%mm3, %%mm2 \n\t"" ""paddw %%mm2, %%mm0 \n\t"" ""movd 6(%0, %%""REG_b""), %%mm4 \n\t"" ""movd 6(%1, %%""REG_b""), %%mm1 \n\t"" ""movd 9(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 9(%1, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm4 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""paddw %%mm1, %%mm4 \n\t"" ""paddw %%mm3, %%mm2 \n\t"" ""paddw %%mm4, %%mm2 \n\t"" ""psrlw $2, %%mm0 \n\t"" ""psrlw $2, %%mm2 \n\t"" #endif ""movq ""MANGLE(bgr2VCoeff)"", %%mm1 \n\t"" ""movq ""MANGLE(bgr2VCoeff)"", %%mm3 \n\t"" ""pmaddwd %%mm0, %%mm1 \n\t"" ""pmaddwd %%mm2, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm0 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm0 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm2, %%mm0 \n\t"" ""packssdw %%mm3, %%mm1 \n\t"" ""pmaddwd %%mm5, %%mm0 \n\t"" ""pmaddwd %%mm5, %%mm1 \n\t"" ""packssdw %%mm1, %%mm0 \n\t"" // V1 V0 U1 U0 ""psraw $7, %%mm0 \n\t"" #if defined (HAVE_MMX2) || defined (HAVE_3DNOW) ""movq 12(%0, %%""REG_b""), %%mm4 \n\t"" ""movq 12(%1, %%""REG_b""), %%mm1 \n\t"" ""movq 18(%0, %%""REG_b""), %%mm2 \n\t"" ""movq 18(%1, %%""REG_b""), %%mm3 \n\t"" PAVGB"" %%mm1, %%mm4 \n\t"" PAVGB"" %%mm3, %%mm2 \n\t"" ""movq %%mm4, %%mm1 \n\t"" ""movq %%mm2, %%mm3 \n\t"" ""psrlq $24, %%mm4 \n\t"" ""psrlq $24, %%mm2 \n\t"" PAVGB"" %%mm1, %%mm4 \n\t"" PAVGB"" %%mm3, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm4 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" #else ""movd 12(%0, %%""REG_b""), %%mm4 \n\t"" ""movd 12(%1, %%""REG_b""), %%mm1 \n\t"" ""movd 15(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 15(%1, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm4 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""paddw %%mm1, %%mm4 \n\t"" ""paddw %%mm3, %%mm2 \n\t"" ""paddw %%mm2, %%mm4 \n\t"" ""movd 18(%0, %%""REG_b""), %%mm5 \n\t"" ""movd 18(%1, %%""REG_b""), %%mm1 \n\t"" ""movd 21(%0, %%""REG_b""), %%mm2 \n\t"" ""movd 21(%1, %%""REG_b""), %%mm3 \n\t"" ""punpcklbw %%mm7, %%mm5 \n\t"" ""punpcklbw %%mm7, %%mm1 \n\t"" ""punpcklbw %%mm7, %%mm2 \n\t"" ""punpcklbw %%mm7, %%mm3 \n\t"" ""paddw %%mm1, %%mm5 \n\t"" ""paddw %%mm3, %%mm2 \n\t"" ""paddw %%mm5, %%mm2 \n\t"" ""movq ""MANGLE(w1111)"", %%mm5 \n\t"" ""psrlw $2, %%mm4 \n\t"" ""psrlw $2, %%mm2 \n\t"" #endif ""movq ""MANGLE(bgr2VCoeff)"", %%mm1 \n\t"" ""movq ""MANGLE(bgr2VCoeff)"", %%mm3 \n\t"" ""pmaddwd %%mm4, %%mm1 \n\t"" ""pmaddwd %%mm2, %%mm3 \n\t"" ""pmaddwd %%mm6, %%mm4 \n\t"" ""pmaddwd %%mm6, %%mm2 \n\t"" #ifndef FAST_BGR2YV12 ""psrad $8, %%mm4 \n\t"" ""psrad $8, %%mm1 \n\t"" ""psrad $8, %%mm2 \n\t"" ""psrad $8, %%mm3 \n\t"" #endif ""packssdw %%mm2, %%mm4 \n\t"" ""packssdw %%mm3, %%mm1 \n\t"" ""pmaddwd %%mm5, %%mm4 \n\t"" ""pmaddwd %%mm5, %%mm1 \n\t"" ""add $24, %%""REG_b"" \n\t"" ""packssdw %%mm1, %%mm4 \n\t"" // V3 V2 U3 U2 ""psraw $7, %%mm4 \n\t"" ""movq %%mm0, %%mm1 \n\t"" ""punpckldq %%mm4, %%mm0 \n\t"" ""punpckhdq %%mm4, %%mm1 \n\t"" ""packsswb %%mm1, %%mm0 \n\t"" ""paddb ""MANGLE(bgr2UVOffset)"", %%mm0 \n\t"" ""movd %%mm0, (%2, %%""REG_a"") \n\t"" ""punpckhdq %%mm0, %%mm0 \n\t"" ""movd %%mm0, (%3, %%""REG_a"") \n\t"" ""add $4, %%""REG_a"" \n\t"" "" js 1b \n\t"" : : ""r"" (src+chromWidth*6), ""r"" (src+srcStride+chromWidth*6), ""r"" (udst+chromWidth), ""r"" (vdst+chromWidth), ""g"" ((long)-chromWidth) : ""%""REG_a, ""%""REG_b ); udst += chromStride; vdst += chromStride; src += srcStride*2; } asm volatile( EMMS"" \n\t"" SFENCE"" \n\t"" :::""memory""); #else y=0; #endif for(; y<height; y+=2) { unsigned i; for(i=0; i<chromWidth; i++) { unsigned int b= src[6*i+0]; unsigned int g= src[6*i+1]; unsigned int r= src[6*i+2]; unsigned int Y = ((RY*r + GY*g + BY*b)>>RGB2YUV_SHIFT) + 16; unsigned int V = ((RV*r + GV*g + BV*b)>>RGB2YUV_SHIFT) + 128; unsigned int U = ((RU*r + GU*g + BU*b)>>RGB2YUV_SHIFT) + 128; udst[i] = U; vdst[i] = V; ydst[2*i] = Y; b= src[6*i+3]; g= src[6*i+4]; r= src[6*i+5]; Y = ((RY*r + GY*g + BY*b)>>RGB2YUV_SHIFT) + 16; ydst[2*i+1] = Y; } ydst += lumStride; src += srcStride; for(i=0; i<chromWidth; i++) { unsigned int b= src[6*i+0]; unsigned int g= src[6*i+1]; unsigned int r= src[6*i+2]; unsigned int Y = ((RY*r + GY*g + BY*b)>>RGB2YUV_SHIFT) + 16; ydst[2*i] = Y; b= src[6*i+3]; g= src[6*i+4]; r= src[6*i+5]; Y = ((RY*r + GY*g + BY*b)>>RGB2YUV_SHIFT) + 16; ydst[2*i+1] = Y; } udst += chromStride; vdst += chromStride; ydst += lumStride; src += srcStride; } }","Yes, it is vulnerable."584582,"static void dec_wcsr(DisasContext *dc) { int no; LOG_DIS(""wcsr r%d, %d\n"", dc->r1, dc->csr); switch (dc->csr) { case CSR_IE: tcg_gen_mov_tl(cpu_ie, cpu_R[dc->r1]); tcg_gen_movi_tl(cpu_pc, dc->pc + 4); dc->is_jmp = DISAS_UPDATE; break; case CSR_IM: /* mark as an io operation because it could cause an interrupt */ if (use_icount) { gen_io_start(); } gen_helper_wcsr_im(cpu_env, cpu_R[dc->r1]); tcg_gen_movi_tl(cpu_pc, dc->pc + 4); if (use_icount) { gen_io_end(); } dc->is_jmp = DISAS_UPDATE; break; case CSR_IP: /* mark as an io operation because it could cause an interrupt */ if (use_icount) { gen_io_start(); } gen_helper_wcsr_ip(cpu_env, cpu_R[dc->r1]); tcg_gen_movi_tl(cpu_pc, dc->pc + 4); if (use_icount) { gen_io_end(); } dc->is_jmp = DISAS_UPDATE; break; case CSR_ICC: /* TODO */ break; case CSR_DCC: /* TODO */ break; case CSR_EBA: tcg_gen_mov_tl(cpu_eba, cpu_R[dc->r1]); break; case CSR_DEBA: tcg_gen_mov_tl(cpu_deba, cpu_R[dc->r1]); break; case CSR_JTX: gen_helper_wcsr_jtx(cpu_env, cpu_R[dc->r1]); break; case CSR_JRX: gen_helper_wcsr_jrx(cpu_env, cpu_R[dc->r1]); break; case CSR_DC: tcg_gen_mov_tl(cpu_dc, cpu_R[dc->r1]); break; case CSR_BP0: case CSR_BP1: case CSR_BP2: case CSR_BP3: no = dc->csr - CSR_BP0; if (dc->env->num_bps <= no) { cpu_abort(dc->env, ""breakpoint #%i is not available\n"", no); } tcg_gen_mov_tl(cpu_bp[no], cpu_R[dc->r1]); break; case CSR_WP0: case CSR_WP1: case CSR_WP2: case CSR_WP3: no = dc->csr - CSR_WP0; if (dc->env->num_wps <= no) { cpu_abort(dc->env, ""watchpoint #%i is not available\n"", no); } tcg_gen_mov_tl(cpu_wp[no], cpu_R[dc->r1]); break; case CSR_CC: case CSR_CFG: cpu_abort(dc->env, ""invalid write access csr=%x\n"", dc->csr); break; default: cpu_abort(dc->env, ""write_csr unknown csr=%x\n"", dc->csr); break; } }","Yes, it is vulnerable."585583,"void pmac_format_nvram_partition (MacIONVRAMState *nvr, int len) { unsigned int i; uint32_t start = 0, end; struct OpenBIOS_nvpart_v1 *part_header; // OpenBIOS nvram variables // Variable partition part_header = (struct OpenBIOS_nvpart_v1 *)nvr->data; part_header->signature = OPENBIOS_PART_SYSTEM; pstrcpy(part_header->name, sizeof(part_header->name), ""system""); end = start + sizeof(struct OpenBIOS_nvpart_v1); for (i = 0; i < nb_prom_envs; i++) end = OpenBIOS_set_var(nvr->data, end, prom_envs[i]); // End marker nvr->data[end++] = '\0'; end = start + ((end - start + 15) & ~15); /* XXX: OpenBIOS is not able to grow up a partition. Leave some space for new variables. */ if (end < DEF_SYSTEM_SIZE) end = DEF_SYSTEM_SIZE; OpenBIOS_finish_partition(part_header, end - start); // free partition start = end; part_header = (struct OpenBIOS_nvpart_v1 *)&nvr->data[start]; part_header->signature = OPENBIOS_PART_FREE; pstrcpy(part_header->name, sizeof(part_header->name), ""free""); end = len; OpenBIOS_finish_partition(part_header, end - start); }","No, it is non-vulnerable."586584,"static void gen_slq(DisasContext *ctx) { int l1 = gen_new_label(); TCGv t0 = tcg_temp_new(); TCGv t1 = tcg_temp_new(); tcg_gen_andi_tl(t1, cpu_gpr[rB(ctx->opcode)], 0x1F); tcg_gen_shl_tl(t0, cpu_gpr[rS(ctx->opcode)], t1); tcg_gen_subfi_tl(t1, 32, t1); tcg_gen_shr_tl(t1, cpu_gpr[rS(ctx->opcode)], t1); tcg_gen_or_tl(t1, t0, t1); gen_store_spr(SPR_MQ, t1); tcg_gen_andi_tl(t1, cpu_gpr[rB(ctx->opcode)], 0x20); tcg_gen_mov_tl(cpu_gpr[rA(ctx->opcode)], t0); tcg_gen_brcondi_tl(TCG_COND_EQ, t1, 0, l1); tcg_gen_movi_tl(cpu_gpr[rA(ctx->opcode)], 0); gen_set_label(l1); tcg_temp_free(t0); tcg_temp_free(t1); if (unlikely(Rc(ctx->opcode) != 0)) gen_set_Rc0(ctx, cpu_gpr[rA(ctx->opcode)]); }","No, it is non-vulnerable."587585,"vmxnet3_pop_rxc_descr(VMXNET3State *s, int qidx, uint32_t *descr_gen) { uint8_t ring_gen; struct Vmxnet3_RxCompDesc rxcd; hwaddr daddr = vmxnet3_ring_curr_cell_pa(&s->rxq_descr[qidx].comp_ring); pci_dma_read(PCI_DEVICE(s), daddr, &rxcd, sizeof(struct Vmxnet3_RxCompDesc)); ring_gen = vmxnet3_ring_curr_gen(&s->rxq_descr[qidx].comp_ring); if (rxcd.gen != ring_gen) { *descr_gen = ring_gen; vmxnet3_inc_rx_completion_counter(s, qidx); return daddr; } return 0; }","Yes, it is vulnerable."588586,"build_madt(GArray *table_data, GArray *linker, AcpiCpuInfo *cpu) { PCMachineState *pcms = PC_MACHINE(qdev_get_machine()); int madt_start = table_data->len; AcpiMultipleApicTable *madt; AcpiMadtIoApic *io_apic; AcpiMadtIntsrcovr *intsrcovr; AcpiMadtLocalNmi *local_nmi; int i; madt = acpi_data_push(table_data, sizeof *madt); madt->local_apic_address = cpu_to_le32(APIC_DEFAULT_ADDRESS); madt->flags = cpu_to_le32(1); for (i = 0; i < pcms->apic_id_limit; i++) { AcpiMadtProcessorApic *apic = acpi_data_push(table_data, sizeof *apic); apic->type = ACPI_APIC_PROCESSOR; apic->length = sizeof(*apic); apic->processor_id = i; apic->local_apic_id = i; if (test_bit(i, cpu->found_cpus)) { apic->flags = cpu_to_le32(1); } else { apic->flags = cpu_to_le32(0); } } io_apic = acpi_data_push(table_data, sizeof *io_apic); io_apic->type = ACPI_APIC_IO; io_apic->length = sizeof(*io_apic); #define ACPI_BUILD_IOAPIC_ID 0x0 io_apic->io_apic_id = ACPI_BUILD_IOAPIC_ID; io_apic->address = cpu_to_le32(IO_APIC_DEFAULT_ADDRESS); io_apic->interrupt = cpu_to_le32(0); if (pcms->apic_xrupt_override) { intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr); intsrcovr->type = ACPI_APIC_XRUPT_OVERRIDE; intsrcovr->length = sizeof(*intsrcovr); intsrcovr->source = 0; intsrcovr->gsi = cpu_to_le32(2); intsrcovr->flags = cpu_to_le16(0); /* conforms to bus specifications */ } for (i = 1; i < 16; i++) { #define ACPI_BUILD_PCI_IRQS ((1<<5) | (1<<9) | (1<<10) | (1<<11)) if (!(ACPI_BUILD_PCI_IRQS & (1 << i))) { /* No need for a INT source override structure. */ continue; } intsrcovr = acpi_data_push(table_data, sizeof *intsrcovr); intsrcovr->type = ACPI_APIC_XRUPT_OVERRIDE; intsrcovr->length = sizeof(*intsrcovr); intsrcovr->source = i; intsrcovr->gsi = cpu_to_le32(i); intsrcovr->flags = cpu_to_le16(0xd); /* active high, level triggered */ } local_nmi = acpi_data_push(table_data, sizeof *local_nmi); local_nmi->type = ACPI_APIC_LOCAL_NMI; local_nmi->length = sizeof(*local_nmi); local_nmi->processor_id = 0xff; /* all processors */ local_nmi->flags = cpu_to_le16(0); local_nmi->lint = 1; /* ACPI_LINT1 */ build_header(linker, table_data, (void *)(table_data->data + madt_start), ""APIC"", table_data->len - madt_start, 1, NULL); }","No, it is non-vulnerable."589587,"matroska_parse_blockgroup (MatroskaDemuxContext *matroska, uint64_t cluster_time) { int res = 0; uint32_t id; AVPacket *pkt = NULL; int is_keyframe = PKT_FLAG_KEY, last_num_packets = matroska->num_packets; uint64_t duration = AV_NOPTS_VALUE; int track = -1; uint8_t *data; int size = 0; int64_t pos = 0; av_log(matroska->ctx, AV_LOG_DEBUG, ""parsing blockgroup...\n""); while (res == 0) { if (!(id = ebml_peek_id(matroska, &matroska->level_up))) { res = AVERROR_IO; break; } else if (matroska->level_up) { matroska->level_up--; break; } switch (id) { /* one block inside the group. Note, block parsing is one * of the harder things, so this code is a bit complicated. * See http://www.matroska.org/ for documentation. */ case MATROSKA_ID_BLOCK: { pos = url_ftell(&matroska->ctx->pb); res = ebml_read_binary(matroska, &id, &data, &size); break; } case MATROSKA_ID_BLOCKDURATION: { if ((res = ebml_read_uint(matroska, &id, &duration)) < 0) break; break; } case MATROSKA_ID_BLOCKREFERENCE: /* We've found a reference, so not even the first frame in * the lace is a key frame. */ is_keyframe = 0; if (last_num_packets != matroska->num_packets) matroska->packets[last_num_packets]->flags = 0; res = ebml_read_skip(matroska); break; default: av_log(matroska->ctx, AV_LOG_INFO, ""Unknown entry 0x%x in blockgroup data\n"", id); /* fall-through */ case EBML_ID_VOID: res = ebml_read_skip(matroska); break; } if (matroska->level_up) { matroska->level_up--; break; } } if (res) return res; if (size > 0) res = matroska_parse_block(matroska, data, size, pos, cluster_time, is_keyframe, &track, &pkt); if (pkt) { if (duration != AV_NOPTS_VALUE) pkt->duration = duration; else if (track >= 0 && track < matroska->num_tracks) pkt->duration = matroska->tracks[track]->default_duration / matroska->time_scale; } return res; }","No, it is non-vulnerable."590588,"void vncws_tls_handshake_peek(void *opaque) { VncState *vs = opaque; long ret; if (!vs->ws_tls.session) { char peek[4]; ret = qemu_recv(vs->csock, peek, sizeof(peek), MSG_PEEK); if (ret && (strncmp(peek, ""\x16"", 1) == 0 || strncmp(peek, ""\x80"", 1) == 0)) { VNC_DEBUG(""TLS Websocket connection recognized""); vnc_tls_client_setup(vs, 1); vncws_start_tls_handshake(vs); } else { vncws_handshake_read(vs); } } else { qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); } }","No, it is non-vulnerable."591589,"bool check_hw_breakpoints(CPUX86State *env, bool force_dr6_update) { target_ulong dr6; int reg; bool hit_enabled = false; dr6 = env->dr[6] & ~0xf; for (reg = 0; reg < DR7_MAX_BP; reg++) { bool bp_match = false; bool wp_match = false; switch (hw_breakpoint_type(env->dr[7], reg)) { case DR7_TYPE_BP_INST: if (env->dr[reg] == env->eip) { bp_match = true; } break; case DR7_TYPE_DATA_WR: case DR7_TYPE_DATA_RW: if (env->cpu_watchpoint[reg] && env->cpu_watchpoint[reg]->flags & BP_WATCHPOINT_HIT) { wp_match = true; } break; case DR7_TYPE_IO_RW: break; } if (bp_match || wp_match) { dr6 |= 1 << reg; if (hw_breakpoint_enabled(env->dr[7], reg)) { hit_enabled = true; } } } if (hit_enabled || force_dr6_update) { env->dr[6] = dr6; } return hit_enabled; }","No, it is non-vulnerable."592590,"static int ipvideo_decode_block_opcode_0x7(IpvideoContext *s) { int x, y; unsigned char P[2]; unsigned int flags; /* 2-color encoding */ CHECK_STREAM_PTR(2); P[0] = *s->stream_ptr++; P[1] = *s->stream_ptr++; if (P[0] <= P[1]) { /* need 8 more bytes from the stream */ CHECK_STREAM_PTR(8); for (y = 0; y < 8; y++) { flags = *s->stream_ptr++ | 0x100; for (; flags != 1; flags >>= 1) *s->pixel_ptr++ = P[flags & 1]; s->pixel_ptr += s->line_inc; } } else { /* need 2 more bytes from the stream */ CHECK_STREAM_PTR(2); flags = bytestream_get_le16(&s->stream_ptr); for (y = 0; y < 8; y += 2) { for (x = 0; x < 8; x += 2, flags >>= 1) { s->pixel_ptr[x ] = s->pixel_ptr[x + 1 ] = s->pixel_ptr[x + s->stride] = s->pixel_ptr[x + 1 + s->stride] = P[flags & 1]; } s->pixel_ptr += s->stride * 2; } } /* report success */ return 0; }","No, it is non-vulnerable."593591,"void arm_translate_init(void) { cpu_env = tcg_global_reg_new(TCG_TYPE_PTR, TCG_AREG0, ""env""); cpu_T[0] = tcg_global_reg_new(TCG_TYPE_I32, TCG_AREG1, ""T0""); cpu_T[1] = tcg_global_reg_new(TCG_TYPE_I32, TCG_AREG2, ""T1""); }","No, it is non-vulnerable."594592,"void virtio_9p_push_and_notify(V9fsPDU *pdu) { V9fsState *s = pdu->s; V9fsVirtioState *v = container_of(s, V9fsVirtioState, state); VirtQueueElement *elem = &v->elems[pdu->idx]; /* push onto queue and notify */ virtqueue_push(v->vq, elem, pdu->size); /* FIXME: we should batch these completions */ virtio_notify(VIRTIO_DEVICE(v), v->vq); }","No, it is non-vulnerable."595593,"int coroutine_fn bdrv_co_pwritev(BlockDriverState *bs, int64_t offset, unsigned int bytes, QEMUIOVector *qiov, BdrvRequestFlags flags) { BdrvTrackedRequest req; uint64_t align = bs->request_alignment; uint8_t *head_buf = NULL; uint8_t *tail_buf = NULL; QEMUIOVector local_qiov; bool use_local_qiov = false; int ret; if (!bs->drv) { return -ENOMEDIUM; } if (bs->read_only) { return -EPERM; } assert(!(bs->open_flags & BDRV_O_INACTIVE)); ret = bdrv_check_byte_request(bs, offset, bytes); if (ret < 0) { return ret; } /* * Align write if necessary by performing a read-modify-write cycle. * Pad qiov with the read parts and be sure to have a tracked request not * only for bdrv_aligned_pwritev, but also for the reads of the RMW cycle. */ tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_WRITE); if (!qiov) { ret = bdrv_co_do_zero_pwritev(bs, offset, bytes, flags, &req); goto out; } if (offset & (align - 1)) { QEMUIOVector head_qiov; struct iovec head_iov; mark_request_serialising(&req, align); wait_serialising_requests(&req); head_buf = qemu_blockalign(bs, align); head_iov = (struct iovec) { .iov_base = head_buf, .iov_len = align, }; qemu_iovec_init_external(&head_qiov, &head_iov, 1); bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD); ret = bdrv_aligned_preadv(bs, &req, offset & ~(align - 1), align, align, &head_qiov, 0); if (ret < 0) { goto fail; } bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD); qemu_iovec_init(&local_qiov, qiov->niov + 2); qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1)); qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size); use_local_qiov = true; bytes += offset & (align - 1); offset = offset & ~(align - 1); /* We have read the tail already if the request is smaller * than one aligned block. */ if (bytes < align) { qemu_iovec_add(&local_qiov, head_buf + bytes, align - bytes); bytes = align; } } if ((offset + bytes) & (align - 1)) { QEMUIOVector tail_qiov; struct iovec tail_iov; size_t tail_bytes; bool waited; mark_request_serialising(&req, align); waited = wait_serialising_requests(&req); assert(!waited || !use_local_qiov); tail_buf = qemu_blockalign(bs, align); tail_iov = (struct iovec) { .iov_base = tail_buf, .iov_len = align, }; qemu_iovec_init_external(&tail_qiov, &tail_iov, 1); bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL); ret = bdrv_aligned_preadv(bs, &req, (offset + bytes) & ~(align - 1), align, align, &tail_qiov, 0); if (ret < 0) { goto fail; } bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL); if (!use_local_qiov) { qemu_iovec_init(&local_qiov, qiov->niov + 1); qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size); use_local_qiov = true; } tail_bytes = (offset + bytes) & (align - 1); qemu_iovec_add(&local_qiov, tail_buf + tail_bytes, align - tail_bytes); bytes = ROUND_UP(bytes, align); } ret = bdrv_aligned_pwritev(bs, &req, offset, bytes, align, use_local_qiov ? &local_qiov : qiov, flags); fail: if (use_local_qiov) { qemu_iovec_destroy(&local_qiov); } qemu_vfree(head_buf); qemu_vfree(tail_buf); out: tracked_request_end(&req); return ret; }","No, it is non-vulnerable."596594,"static int kvm_s390_check_clear_cmma(KVMState *s) { struct kvm_device_attr attr = { .group = KVM_S390_VM_MEM_CTRL, .attr = KVM_S390_VM_MEM_CLR_CMMA, }; return kvm_vm_ioctl(s, KVM_HAS_DEVICE_ATTR, &attr); }","No, it is non-vulnerable."597595,"static int bdrv_fill_options(QDict **options, const char **pfilename, int flags, BlockDriver *drv, Error **errp) { const char *filename = *pfilename; const char *drvname; bool protocol = flags & BDRV_O_PROTOCOL; bool parse_filename = false; Error *local_err = NULL; /* Parse json: pseudo-protocol */ if (filename && g_str_has_prefix(filename, ""json:"")) { QDict *json_options = parse_json_filename(filename, &local_err); if (local_err) { error_propagate(errp, local_err); return -EINVAL; } /* Options given in the filename have lower priority than options * specified directly */ qdict_join(*options, json_options, false); QDECREF(json_options); *pfilename = filename = NULL; } /* Fetch the file name from the options QDict if necessary */ if (protocol && filename) { if (!qdict_haskey(*options, ""filename"")) { qdict_put(*options, ""filename"", qstring_from_str(filename)); parse_filename = true; } else { error_setg(errp, ""Can't specify 'file' and 'filename' options at "" ""the same time""); return -EINVAL; } } /* Find the right block driver */ filename = qdict_get_try_str(*options, ""filename""); drvname = qdict_get_try_str(*options, ""driver""); if (drv) { if (drvname) { error_setg(errp, ""Driver specified twice""); return -EINVAL; } drvname = drv->format_name; qdict_put(*options, ""driver"", qstring_from_str(drvname)); } else { if (!drvname && protocol) { if (filename) { drv = bdrv_find_protocol(filename, parse_filename, errp); if (!drv) { return -EINVAL; } drvname = drv->format_name; qdict_put(*options, ""driver"", qstring_from_str(drvname)); } else { error_setg(errp, ""Must specify either driver or file""); return -EINVAL; } } else if (drvname) { drv = bdrv_find_format(drvname); if (!drv) { error_setg(errp, ""Unknown driver '%s'"", drvname); return -ENOENT; } } } assert(drv || !protocol); /* Driver-specific filename parsing */ if (drv && drv->bdrv_parse_filename && parse_filename) { drv->bdrv_parse_filename(filename, *options, &local_err); if (local_err) { error_propagate(errp, local_err); return -EINVAL; } if (!drv->bdrv_needs_filename) { qdict_del(*options, ""filename""); } } return 0; }","No, it is non-vulnerable."598596,"int attribute_align_arg sws_scale(struct SwsContext *c, const uint8_t * const srcSlice[], const int srcStride[], int srcSliceY, int srcSliceH, uint8_t *const dst[], const int dstStride[]) { int i, ret; const uint8_t *src2[4] = { srcSlice[0], srcSlice[1], srcSlice[2], srcSlice[3] }; uint8_t *dst2[4] = { dst[0], dst[1], dst[2], dst[3] }; uint8_t *rgb0_tmp = NULL; // do not mess up sliceDir if we have a ""trailing"" 0-size slice if (srcSliceH == 0) return 0; if (!check_image_pointers(srcSlice, c->srcFormat, srcStride)) { av_log(c, AV_LOG_ERROR, ""bad src image pointers\n""); return 0; } if (!check_image_pointers((const uint8_t* const*)dst, c->dstFormat, dstStride)) { av_log(c, AV_LOG_ERROR, ""bad dst image pointers\n""); return 0; } if (c->sliceDir == 0 && srcSliceY != 0 && srcSliceY + srcSliceH != c->srcH) { av_log(c, AV_LOG_ERROR, ""Slices start in the middle!\n""); return 0; } if (c->sliceDir == 0) { if (srcSliceY == 0) c->sliceDir = 1; else c->sliceDir = -1; } if (usePal(c->srcFormat)) { for (i = 0; i < 256; i++) { int p, r, g, b, y, u, v, a = 0xff; if (c->srcFormat == AV_PIX_FMT_PAL8) { p = ((const uint32_t *)(srcSlice[1]))[i]; a = (p >> 24) & 0xFF; r = (p >> 16) & 0xFF; g = (p >> 8) & 0xFF; b = p & 0xFF; } else if (c->srcFormat == AV_PIX_FMT_RGB8) { r = ( i >> 5 ) * 36; g = ((i >> 2) & 7) * 36; b = ( i & 3) * 85; } else if (c->srcFormat == AV_PIX_FMT_BGR8) { b = ( i >> 6 ) * 85; g = ((i >> 3) & 7) * 36; r = ( i & 7) * 36; } else if (c->srcFormat == AV_PIX_FMT_RGB4_BYTE) { r = ( i >> 3 ) * 255; g = ((i >> 1) & 3) * 85; b = ( i & 1) * 255; } else if (c->srcFormat == AV_PIX_FMT_GRAY8 || c->srcFormat == AV_PIX_FMT_GRAY8A) { r = g = b = i; } else { av_assert1(c->srcFormat == AV_PIX_FMT_BGR4_BYTE); b = ( i >> 3 ) * 255; g = ((i >> 1) & 3) * 85; r = ( i & 1) * 255; } #define RGB2YUV_SHIFT 15 #define BY ( (int) (0.114 * 219 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define BV (-(int) (0.081 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define BU ( (int) (0.500 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define GY ( (int) (0.587 * 219 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define GV (-(int) (0.419 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define GU (-(int) (0.331 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define RY ( (int) (0.299 * 219 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define RV ( (int) (0.500 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) #define RU (-(int) (0.169 * 224 / 255 * (1 << RGB2YUV_SHIFT) + 0.5)) y = av_clip_uint8((RY * r + GY * g + BY * b + ( 33 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT); u = av_clip_uint8((RU * r + GU * g + BU * b + (257 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT); v = av_clip_uint8((RV * r + GV * g + BV * b + (257 << (RGB2YUV_SHIFT - 1))) >> RGB2YUV_SHIFT); c->pal_yuv[i]= y + (u<<8) + (v<<16) + ((unsigned)a<<24); switch (c->dstFormat) { case AV_PIX_FMT_BGR32: #if !HAVE_BIGENDIAN case AV_PIX_FMT_RGB24: #endif c->pal_rgb[i]= r + (g<<8) + (b<<16) + ((unsigned)a<<24); break; case AV_PIX_FMT_BGR32_1: #if HAVE_BIGENDIAN case AV_PIX_FMT_BGR24: #endif c->pal_rgb[i]= a + (r<<8) + (g<<16) + ((unsigned)b<<24); break; case AV_PIX_FMT_RGB32_1: #if HAVE_BIGENDIAN case AV_PIX_FMT_RGB24: #endif c->pal_rgb[i]= a + (b<<8) + (g<<16) + ((unsigned)r<<24); break; case AV_PIX_FMT_RGB32: #if !HAVE_BIGENDIAN case AV_PIX_FMT_BGR24: #endif default: c->pal_rgb[i]= b + (g<<8) + (r<<16) + ((unsigned)a<<24); } } } if (c->src0Alpha && !c->dst0Alpha && isALPHA(c->dstFormat)) { uint8_t *base; int x,y; rgb0_tmp = av_malloc(FFABS(srcStride[0]) * srcSliceH + 32); base = srcStride[0] < 0 ? rgb0_tmp - srcStride[0] * (srcSliceH-1) : rgb0_tmp; for (y=0; y<srcSliceH; y++){ memcpy(base + srcStride[0]*y, src2[0] + srcStride[0]*y, 4*c->srcW); for (x=c->src0Alpha-1; x<4*c->srcW; x+=4) { base[ srcStride[0]*y + x] = 0xFF; } } src2[0] = base; } // copy strides, so they can safely be modified if (c->sliceDir == 1) { // slices go from top to bottom int srcStride2[4] = { srcStride[0], srcStride[1], srcStride[2], srcStride[3] }; int dstStride2[4] = { dstStride[0], dstStride[1], dstStride[2], dstStride[3] }; reset_ptr(src2, c->srcFormat); reset_ptr((void*)dst2, c->dstFormat); /* reset slice direction at end of frame */ if (srcSliceY + srcSliceH == c->srcH) c->sliceDir = 0; ret = c->swScale(c, src2, srcStride2, srcSliceY, srcSliceH, dst2, dstStride2); } else { // slices go from bottom to top => we flip the image internally int srcStride2[4] = { -srcStride[0], -srcStride[1], -srcStride[2], -srcStride[3] }; int dstStride2[4] = { -dstStride[0], -dstStride[1], -dstStride[2], -dstStride[3] }; src2[0] += (srcSliceH - 1) * srcStride[0]; if (!usePal(c->srcFormat)) src2[1] += ((srcSliceH >> c->chrSrcVSubSample) - 1) * srcStride[1]; src2[2] += ((srcSliceH >> c->chrSrcVSubSample) - 1) * srcStride[2]; src2[3] += (srcSliceH - 1) * srcStride[3]; dst2[0] += ( c->dstH - 1) * dstStride[0]; dst2[1] += ((c->dstH >> c->chrDstVSubSample) - 1) * dstStride[1]; dst2[2] += ((c->dstH >> c->chrDstVSubSample) - 1) * dstStride[2]; dst2[3] += ( c->dstH - 1) * dstStride[3]; reset_ptr(src2, c->srcFormat); reset_ptr((void*)dst2, c->dstFormat); /* reset slice direction at end of frame */ if (!srcSliceY) c->sliceDir = 0; ret = c->swScale(c, src2, srcStride2, c->srcH-srcSliceY-srcSliceH, srcSliceH, dst2, dstStride2); } av_free(rgb0_tmp); return ret; }","No, it is non-vulnerable."599597,static inline uint32_t vmsvga_fifo_read_raw(struct vmsvga_state_s *s) { uint32_t cmd = s->fifo[CMD(stop) >> 2]; s->cmd->stop = cpu_to_le32(CMD(stop) + 4); if (CMD(stop) >= CMD(max)) { s->cmd->stop = s->cmd->min; } return cmd; },"Yes, it is vulnerable."600598,"static void do_rematrixing(AC3DecodeContext *s) { int bnd, i; int end, bndend; int tmp0, tmp1; end = FFMIN(s->end_freq[1], s->end_freq[2]); for(bnd=0; bnd<s->num_rematrixing_bands; bnd++) { if(s->rematrixing_flags[bnd]) { bndend = FFMIN(end, ff_ac3_rematrix_band_tab[bnd+1]); for(i=ff_ac3_rematrix_band_tab[bnd]; i<bndend; i++) { tmp0 = s->fixed_coeffs[1][i]; tmp1 = s->fixed_coeffs[2][i]; s->fixed_coeffs[1][i] = tmp0 + tmp1; s->fixed_coeffs[2][i] = tmp0 - tmp1; } } } }","No, it is non-vulnerable."601599,static void dead_tmp(TCGv tmp) { tcg_temp_free(tmp); num_temps--; },"Yes, it is vulnerable."602600,int bdrv_has_zero_init(BlockDriverState *bs) { assert(bs->drv); if (bs->drv->bdrv_has_zero_init) { return bs->drv->bdrv_has_zero_init(bs); } return 1; },"Yes, it is vulnerable."603601,static CharDriverState *qemu_chr_open_mux(CharDriverState *drv) { CharDriverState *chr; MuxDriver *d; chr = qemu_chr_alloc(); d = g_malloc0(sizeof(MuxDriver)); chr->opaque = d; d->drv = drv; d->focus = -1; chr->chr_write = mux_chr_write; chr->chr_update_read_handler = mux_chr_update_read_handler; chr->chr_accept_input = mux_chr_accept_input; /* Frontend guest-open / -close notification is not support with muxes */ chr->chr_set_fe_open = NULL; if (drv->chr_add_watch) { chr->chr_add_watch = mux_chr_add_watch; } /* only default to opened state if we've realized the initial * set of muxes */ chr->explicit_be_open = muxes_realized ? 0 : 1; chr->is_mux = 1; return chr; },"Yes, it is vulnerable."604602,"static int scan_file(AVFormatContext *avctx, AVStream *vst, AVStream *ast, int file) { MlvContext *mlv = avctx->priv_data; AVIOContext *pb = mlv->pb[file]; int ret; while (!avio_feof(pb)) { int type; unsigned int size; type = avio_rl32(pb); size = avio_rl32(pb); avio_skip(pb, 8); //timestamp if (size < 16) break; size -= 16; if (vst && type == MKTAG('R','A','W','I') && size >= 164) { vst->codec->width = avio_rl16(pb); vst->codec->height = avio_rl16(pb); if (avio_rl32(pb) != 1) avpriv_request_sample(avctx, ""raw api version""); avio_skip(pb, 20); // pointer, width, height, pitch, frame_size vst->codec->bits_per_coded_sample = avio_rl32(pb); avio_skip(pb, 8 + 16 + 24); // black_level, white_level, xywh, active_area, exposure_bias if (avio_rl32(pb) != 0x2010100) /* RGGB */ avpriv_request_sample(avctx, ""cfa_pattern""); avio_skip(pb, 80); // calibration_illuminant1, color_matrix1, dynamic_range vst->codec->pix_fmt = AV_PIX_FMT_BAYER_RGGB16LE; vst->codec->codec_tag = MKTAG('B', 'I', 'T', 16); size -= 164; } else if (ast && type == MKTAG('W', 'A', 'V', 'I') && size >= 16) { ret = ff_get_wav_header(avctx, pb, ast->codec, 16, 0); size -= 16; } else if (type == MKTAG('I','N','F','O')) { if (size > 0) read_string(avctx, pb, ""info"", size); continue; } else if (type == MKTAG('I','D','N','T') && size >= 36) { read_string(avctx, pb, ""cameraName"", 32); read_uint32(avctx, pb, ""cameraModel"", ""0x%""PRIx32); size -= 36; if (size >= 32) { read_string(avctx, pb, ""cameraSerial"", 32); size -= 32; } else if (type == MKTAG('L','E','N','S') && size >= 48) { read_uint16(avctx, pb, ""focalLength"", ""%i""); read_uint16(avctx, pb, ""focalDist"", ""%i""); read_uint16(avctx, pb, ""aperture"", ""%i""); read_uint8(avctx, pb, ""stabilizerMode"", ""%i""); read_uint8(avctx, pb, ""autofocusMode"", ""%i""); read_uint32(avctx, pb, ""flags"", ""0x%""PRIx32); read_uint32(avctx, pb, ""lensID"", ""%""PRIi32); read_string(avctx, pb, ""lensName"", 32); size -= 48; if (size >= 32) { read_string(avctx, pb, ""lensSerial"", 32); size -= 32; } else if (vst && type == MKTAG('V', 'I', 'D', 'F') && size >= 4) { uint64_t pts = avio_rl32(pb); ff_add_index_entry(&vst->index_entries, &vst->nb_index_entries, &vst->index_entries_allocated_size, avio_tell(pb) - 20, pts, file, 0, AVINDEX_KEYFRAME); size -= 4; } else if (ast && type == MKTAG('A', 'U', 'D', 'F') && size >= 4) { uint64_t pts = avio_rl32(pb); ff_add_index_entry(&ast->index_entries, &ast->nb_index_entries, &ast->index_entries_allocated_size, avio_tell(pb) - 20, pts, file, 0, AVINDEX_KEYFRAME); size -= 4; } else if (vst && type == MKTAG('W','B','A','L') && size >= 28) { read_uint32(avctx, pb, ""wb_mode"", ""%""PRIi32); read_uint32(avctx, pb, ""kelvin"", ""%""PRIi32); read_uint32(avctx, pb, ""wbgain_r"", ""%""PRIi32); read_uint32(avctx, pb, ""wbgain_g"", ""%""PRIi32); read_uint32(avctx, pb, ""wbgain_b"", ""%""PRIi32); read_uint32(avctx, pb, ""wbs_gm"", ""%""PRIi32); read_uint32(avctx, pb, ""wbs_ba"", ""%""PRIi32); size -= 28; } else if (type == MKTAG('R','T','C','I') && size >= 20) { char str[32]; struct tm time = { 0 }; time.tm_sec = avio_rl16(pb); time.tm_min = avio_rl16(pb); time.tm_hour = avio_rl16(pb); time.tm_mday = avio_rl16(pb); time.tm_mon = avio_rl16(pb); time.tm_year = avio_rl16(pb); time.tm_wday = avio_rl16(pb); time.tm_yday = avio_rl16(pb); time.tm_isdst = avio_rl16(pb); avio_skip(pb, 2); if (strftime(str, sizeof(str), ""%Y-%m-%d %H:%M:%S"", &time)) av_dict_set(&avctx->metadata, ""time"", str, 0); size -= 20; } else if (type == MKTAG('E','X','P','O') && size >= 16) { av_dict_set(&avctx->metadata, ""isoMode"", avio_rl32(pb) ? ""auto"" : ""manual"", 0); read_uint32(avctx, pb, ""isoValue"", ""%""PRIi32); read_uint32(avctx, pb, ""isoAnalog"", ""%""PRIi32); read_uint32(avctx, pb, ""digitalGain"", ""%""PRIi32); size -= 16; if (size >= 8) { read_uint64(avctx, pb, ""shutterValue"", ""%""PRIi64); size -= 8; } else if (type == MKTAG('S','T','Y','L') && size >= 36) { read_uint32(avctx, pb, ""picStyleId"", ""%""PRIi32); read_uint32(avctx, pb, ""contrast"", ""%""PRIi32); read_uint32(avctx, pb, ""sharpness"", ""%""PRIi32); read_uint32(avctx, pb, ""saturation"", ""%""PRIi32); read_uint32(avctx, pb, ""colortone"", ""%""PRIi32); read_string(avctx, pb, ""picStyleName"", 16); size -= 36; } else if (type == MKTAG('M','A','R','K')) { } else if (type == MKTAG('N','U','L','L')) { } else if (type == MKTAG('M','L','V','I')) { /* occurs when MLV and Mnn files are concatenated */ } else { av_log(avctx, AV_LOG_INFO, ""unsupported tag %c%c%c%c, size %u\n"", type&0xFF, (type>>8)&0xFF, (type>>16)&0xFF, (type>>24)&0xFF, size); avio_skip(pb, size); return 0;","Yes, it is vulnerable."605603,"static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info) { switch (vd->auth) { case VNC_AUTH_VNC: info->auth = VNC_PRIMARY_AUTH_VNC; break; case VNC_AUTH_RA2: info->auth = VNC_PRIMARY_AUTH_RA2; break; case VNC_AUTH_RA2NE: info->auth = VNC_PRIMARY_AUTH_RA2NE; break; case VNC_AUTH_TIGHT: info->auth = VNC_PRIMARY_AUTH_TIGHT; break; case VNC_AUTH_ULTRA: info->auth = VNC_PRIMARY_AUTH_ULTRA; break; case VNC_AUTH_TLS: info->auth = VNC_PRIMARY_AUTH_TLS; break; case VNC_AUTH_VENCRYPT: info->auth = VNC_PRIMARY_AUTH_VENCRYPT; #ifdef CONFIG_VNC_TLS info->has_vencrypt = true; switch (vd->subauth) { case VNC_AUTH_VENCRYPT_PLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSNONE: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; break; case VNC_AUTH_VENCRYPT_TLSVNC: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; break; case VNC_AUTH_VENCRYPT_TLSPLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; break; case VNC_AUTH_VENCRYPT_X509NONE: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; break; case VNC_AUTH_VENCRYPT_X509VNC: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; break; case VNC_AUTH_VENCRYPT_X509PLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSSASL: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; break; case VNC_AUTH_VENCRYPT_X509SASL: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; break; default: info->has_vencrypt = false; break; } #endif break; case VNC_AUTH_SASL: info->auth = VNC_PRIMARY_AUTH_SASL; break; case VNC_AUTH_NONE: default: info->auth = VNC_PRIMARY_AUTH_NONE; break; } }","Yes, it is vulnerable."606604,"int hvf_vcpu_exec(CPUState *cpu) { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; int ret = 0; uint64_t rip = 0; cpu->halted = 0; if (hvf_process_events(cpu)) { return EXCP_HLT; } do { if (cpu->vcpu_dirty) { hvf_put_registers(cpu); cpu->vcpu_dirty = false; } env->hvf_emul->interruptable = !(rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) & (VMCS_INTERRUPTIBILITY_STI_BLOCKING | VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)); hvf_inject_interrupts(cpu); vmx_update_tpr(cpu); qemu_mutex_unlock_iothread(); if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) { qemu_mutex_lock_iothread(); return EXCP_HLT; } hv_return_t r = hv_vcpu_run(cpu->hvf_fd); assert_hvf_ok(r); /* handle VMEXIT */ uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON); uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION); uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH); uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); rip = rreg(cpu->hvf_fd, HV_X86_RIP); RFLAGS(env) = rreg(cpu->hvf_fd, HV_X86_RFLAGS); env->eflags = RFLAGS(env); qemu_mutex_lock_iothread(); update_apic_tpr(cpu); current_cpu = cpu; ret = 0; switch (exit_reason) { case EXIT_REASON_HLT: { macvm_set_rip(cpu, rip + ins_len); if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) && (EFLAGS(env) & IF_MASK)) && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) && !(idtvec_info & VMCS_IDT_VEC_VALID)) { cpu->halted = 1; ret = EXCP_HLT; } ret = EXCP_INTERRUPT; break; } case EXIT_REASON_MWAIT: { ret = EXCP_INTERRUPT; break; } /* Need to check if MMIO or unmmaped fault */ case EXIT_REASON_EPT_FAULT: { hvf_slot *slot; addr_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS); if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) && ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) { vmx_set_nmi_blocking(cpu); } slot = hvf_find_overlap_slot(gpa, gpa); /* mmio */ if (ept_emulation_fault(slot, gpa, exit_qual)) { struct x86_decode decode; load_regs(cpu); env->hvf_emul->fetch_rip = rip; decode_instruction(env, &decode); exec_instruction(env, &decode); store_regs(cpu); break; } break; } case EXIT_REASON_INOUT: { uint32_t in = (exit_qual & 8) != 0; uint32_t size = (exit_qual & 7) + 1; uint32_t string = (exit_qual & 16) != 0; uint32_t port = exit_qual >> 16; /*uint32_t rep = (exit_qual & 0x20) != 0;*/ #if 1 if (!string && in) { uint64_t val = 0; load_regs(cpu); hvf_handle_io(env, port, &val, 0, size, 1); if (size == 1) { AL(env) = val; } else if (size == 2) { AX(env) = val; } else if (size == 4) { RAX(env) = (uint32_t)val; } else { VM_PANIC(""size""); } RIP(env) += ins_len; store_regs(cpu); break; } else if (!string && !in) { RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX); hvf_handle_io(env, port, &RAX(env), 1, size, 1); macvm_set_rip(cpu, rip + ins_len); break; } #endif struct x86_decode decode; load_regs(cpu); env->hvf_emul->fetch_rip = rip; decode_instruction(env, &decode); VM_PANIC_ON(ins_len != decode.len); exec_instruction(env, &decode); store_regs(cpu); break; } case EXIT_REASON_CPUID: { uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX); uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx); wreg(cpu->hvf_fd, HV_X86_RAX, rax); wreg(cpu->hvf_fd, HV_X86_RBX, rbx); wreg(cpu->hvf_fd, HV_X86_RCX, rcx); wreg(cpu->hvf_fd, HV_X86_RDX, rdx); macvm_set_rip(cpu, rip + ins_len); break; } case EXIT_REASON_XSETBV: { X86CPU *x86_cpu = X86_CPU(cpu); CPUX86State *env = &x86_cpu->env; uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX); uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX); uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX); if (ecx) { macvm_set_rip(cpu, rip + ins_len); break; } env->xcr0 = ((uint64_t)edx << 32) | eax; wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1); macvm_set_rip(cpu, rip + ins_len); break; } case EXIT_REASON_INTR_WINDOW: vmx_clear_int_window_exiting(cpu); ret = EXCP_INTERRUPT; break; case EXIT_REASON_NMI_WINDOW: vmx_clear_nmi_window_exiting(cpu); ret = EXCP_INTERRUPT; break; case EXIT_REASON_EXT_INTR: /* force exit and allow io handling */ ret = EXCP_INTERRUPT; break; case EXIT_REASON_RDMSR: case EXIT_REASON_WRMSR: { load_regs(cpu); if (exit_reason == EXIT_REASON_RDMSR) { simulate_rdmsr(cpu); } else { simulate_wrmsr(cpu); } RIP(env) += rvmcs(cpu->hvf_fd, VMCS_EXIT_INSTRUCTION_LENGTH); store_regs(cpu); break; } case EXIT_REASON_CR_ACCESS: { int cr; int reg; load_regs(cpu); cr = exit_qual & 15; reg = (exit_qual >> 8) & 15; switch (cr) { case 0x0: { macvm_set_cr0(cpu->hvf_fd, RRX(env, reg)); break; } case 4: { macvm_set_cr4(cpu->hvf_fd, RRX(env, reg)); break; } case 8: { X86CPU *x86_cpu = X86_CPU(cpu); if (exit_qual & 0x10) { RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state); } else { int tpr = RRX(env, reg); cpu_set_apic_tpr(x86_cpu->apic_state, tpr); ret = EXCP_INTERRUPT; } break; } default: error_report(""Unrecognized CR %d\n"", cr); abort(); } RIP(env) += ins_len; store_regs(cpu); break; } case EXIT_REASON_APIC_ACCESS: { /* TODO */ struct x86_decode decode; load_regs(cpu); env->hvf_emul->fetch_rip = rip; decode_instruction(env, &decode); exec_instruction(env, &decode); store_regs(cpu); break; } case EXIT_REASON_TPR: { ret = 1; break; } case EXIT_REASON_TASK_SWITCH: { uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO); x68_segment_selector sel = {.sel = exit_qual & 0xffff}; vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3, vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo & VMCS_INTR_T_MASK); break; } case EXIT_REASON_TRIPLE_FAULT: { qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET); ret = EXCP_INTERRUPT; break; } case EXIT_REASON_RDPMC: wreg(cpu->hvf_fd, HV_X86_RAX, 0); wreg(cpu->hvf_fd, HV_X86_RDX, 0); macvm_set_rip(cpu, rip + ins_len); break; case VMX_REASON_VMCALL: /* TODO: inject #GP fault */ break; default: error_report(""%llx: unhandled exit %llx\n"", rip, exit_reason); } } while (ret == 0); return ret; }","No, it is non-vulnerable."607605,static void dummy_event_handler(void *opaque) { },"No, it is non-vulnerable."608606,"void cpu_watchpoint_remove_by_ref(CPUState *env, CPUWatchpoint *watchpoint) { TAILQ_REMOVE(&env->watchpoints, watchpoint, entry); tlb_flush_page(env, watchpoint->vaddr); qemu_free(watchpoint); }","No, it is non-vulnerable."609607,"void armv7m_nvic_set_pending(void *opaque, int irq, bool secure) { NVICState *s = (NVICState *)opaque; bool banked = exc_is_banked(irq); VecInfo *vec; assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq); assert(!secure || banked); vec = (banked && secure) ? &s->sec_vectors[irq] : &s->vectors[irq]; trace_nvic_set_pending(irq, secure, vec->enabled, vec->prio); if (irq >= ARMV7M_EXCP_HARD && irq < ARMV7M_EXCP_PENDSV) { /* If a synchronous exception is pending then it may be * escalated to HardFault if: * * it is equal or lower priority to current execution * * it is disabled * (ie we need to take it immediately but we can't do so). * Asynchronous exceptions (and interrupts) simply remain pending. * * For QEMU, we don't have any imprecise (asynchronous) faults, * so we can assume that PREFETCH_ABORT and DATA_ABORT are always * synchronous. * Debug exceptions are awkward because only Debug exceptions * resulting from the BKPT instruction should be escalated, * but we don't currently implement any Debug exceptions other * than those that result from BKPT, so we treat all debug exceptions * as needing escalation. * * This all means we can identify whether to escalate based only on * the exception number and don't (yet) need the caller to explicitly * tell us whether this exception is synchronous or not. */ int running = nvic_exec_prio(s); bool escalate = false; if (vec->prio >= running) { trace_nvic_escalate_prio(irq, vec->prio, running); escalate = true; } else if (!vec->enabled) { trace_nvic_escalate_disabled(irq); escalate = true; } if (escalate) { if (running < 0) { /* We want to escalate to HardFault but we can't take a * synchronous HardFault at this point either. This is a * Lockup condition due to a guest bug. We don't model * Lockup, so report via cpu_abort() instead. */ cpu_abort(&s->cpu->parent_obj, ""Lockup: can't escalate %d to HardFault "" ""(current priority %d)\n"", irq, running); } /* We can do the escalation, so we take HardFault instead. * If BFHFNMINS is set then we escalate to the banked HF for * the target security state of the original exception; otherwise * we take a Secure HardFault. */ irq = ARMV7M_EXCP_HARD; if (arm_feature(&s->cpu->env, ARM_FEATURE_M_SECURITY) && (secure || !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))) { vec = &s->sec_vectors[irq]; } else { vec = &s->vectors[irq]; } /* HF may be banked but there is only one shared HFSR */ s->cpu->env.v7m.hfsr |= R_V7M_HFSR_FORCED_MASK; } } if (!vec->pending) { vec->pending = 1; nvic_irq_update(s); } }","No, it is non-vulnerable."610608,"void portio_list_init(PortioList *piolist, const MemoryRegionPortio *callbacks, void *opaque, const char *name) { unsigned n = 0; while (callbacks[n].size) { ++n; } piolist->ports = callbacks; piolist->nr = 0; piolist->regions = g_new0(MemoryRegion *, n); piolist->aliases = g_new0(MemoryRegion *, n); piolist->address_space = NULL; piolist->opaque = opaque; piolist->name = name; }","No, it is non-vulnerable."611609,"static int mch_init(PCIDevice *d) { int i; hwaddr pci_hole64_size; MCHPCIState *mch = MCH_PCI_DEVICE(d); /* Leave enough space for the biggest MCFG BAR */ /* TODO: this matches current bios behaviour, but * it's not a power of two, which means an MTRR * can't cover it exactly. */ mch->guest_info->pci_info.w32.begin = MCH_HOST_BRIDGE_PCIEXBAR_DEFAULT + MCH_HOST_BRIDGE_PCIEXBAR_MAX; /* setup pci memory regions */ memory_region_init_alias(&mch->pci_hole, OBJECT(mch), ""pci-hole"", mch->pci_address_space, mch->below_4g_mem_size, 0x100000000ULL - mch->below_4g_mem_size); memory_region_add_subregion(mch->system_memory, mch->below_4g_mem_size, &mch->pci_hole); pci_hole64_size = (sizeof(hwaddr) == 4 ? 0 : ((uint64_t)1 << 62)); memory_region_init_alias(&mch->pci_hole_64bit, OBJECT(mch), ""pci-hole64"", mch->pci_address_space, 0x100000000ULL + mch->above_4g_mem_size, pci_hole64_size); if (pci_hole64_size) { memory_region_add_subregion(mch->system_memory, 0x100000000ULL + mch->above_4g_mem_size, &mch->pci_hole_64bit); } /* smram */ cpu_smm_register(&mch_set_smm, mch); memory_region_init_alias(&mch->smram_region, OBJECT(mch), ""smram-region"", mch->pci_address_space, 0xa0000, 0x20000); memory_region_add_subregion_overlap(mch->system_memory, 0xa0000, &mch->smram_region, 1); memory_region_set_enabled(&mch->smram_region, false); init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory, mch->pci_address_space, &mch->pam_regions[0], PAM_BIOS_BASE, PAM_BIOS_SIZE); for (i = 0; i < 12; ++i) { init_pam(DEVICE(mch), mch->ram_memory, mch->system_memory, mch->pci_address_space, &mch->pam_regions[i+1], PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE); } return 0; }","Yes, it is vulnerable."612610,"static void gen_mtsr(DisasContext *ctx) { #if defined(CONFIG_USER_ONLY) gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG); #else TCGv t0; if (unlikely(ctx->pr)) { gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG); return; } t0 = tcg_const_tl(SR(ctx->opcode)); gen_helper_store_sr(cpu_env, t0, cpu_gpr[rS(ctx->opcode)]); tcg_temp_free(t0); #endif }","Yes, it is vulnerable."613611,"static int get_codec_data(ByteIOContext *pb, AVStream *vst, AVStream *ast, int myth) { frametype_t frametype; if (!vst && !myth) return 1; // no codec data needed while (!url_feof(pb)) { int size, subtype; frametype = get_byte(pb); switch (frametype) { case NUV_EXTRADATA: subtype = get_byte(pb); url_fskip(pb, 6); size = PKTSIZE(get_le32(pb)); if (subtype == 'R') { vst->codec->extradata_size = size; vst->codec->extradata = av_malloc(size); get_buffer(pb, vst->codec->extradata, size); size = 0; if (!myth) return 1; } break; case NUV_MYTHEXT: url_fskip(pb, 7); size = PKTSIZE(get_le32(pb)); if (size != 128 * 4) break; get_le32(pb); // version if (vst) { vst->codec->codec_tag = get_le32(pb); vst->codec->codec_id = codec_get_id(codec_bmp_tags, vst->codec->codec_tag); } else url_fskip(pb, 4); if (ast) { ast->codec->codec_tag = get_le32(pb); ast->codec->sample_rate = get_le32(pb); ast->codec->bits_per_sample = get_le32(pb); ast->codec->channels = get_le32(pb); ast->codec->codec_id = wav_codec_get_id(ast->codec->codec_tag, ast->codec->bits_per_sample); } else url_fskip(pb, 4 * 4); size -= 6 * 4; url_fskip(pb, size); return 1; case NUV_SEEKP: size = 11; break; default: url_fskip(pb, 7); size = PKTSIZE(get_le32(pb)); break; } url_fskip(pb, size); } return 0; }","Yes, it is vulnerable."614612,"static inline void RENAME(rgb24to15)(const uint8_t *src, uint8_t *dst, unsigned src_size) { const uint8_t *s = src; const uint8_t *end; #ifdef HAVE_MMX const uint8_t *mm_end; #endif uint16_t *d = (uint16_t *)dst; end = s + src_size; #ifdef HAVE_MMX __asm __volatile(PREFETCH"" %0""::""m""(*src):""memory""); __asm __volatile( ""movq %0, %%mm7\n\t"" ""movq %1, %%mm6\n\t"" ::""m""(red_15mask),""m""(green_15mask)); mm_end = end - 11; while(s < mm_end) { __asm __volatile( PREFETCH"" 32%1\n\t"" ""movd %1, %%mm0\n\t"" ""movd 3%1, %%mm3\n\t"" ""punpckldq 6%1, %%mm0\n\t"" ""punpckldq 9%1, %%mm3\n\t"" ""movq %%mm0, %%mm1\n\t"" ""movq %%mm0, %%mm2\n\t"" ""movq %%mm3, %%mm4\n\t"" ""movq %%mm3, %%mm5\n\t"" ""psrlq $3, %%mm0\n\t"" ""psrlq $3, %%mm3\n\t"" ""pand %2, %%mm0\n\t"" ""pand %2, %%mm3\n\t"" ""psrlq $6, %%mm1\n\t"" ""psrlq $6, %%mm4\n\t"" ""pand %%mm6, %%mm1\n\t"" ""pand %%mm6, %%mm4\n\t"" ""psrlq $9, %%mm2\n\t"" ""psrlq $9, %%mm5\n\t"" ""pand %%mm7, %%mm2\n\t"" ""pand %%mm7, %%mm5\n\t"" ""por %%mm1, %%mm0\n\t"" ""por %%mm4, %%mm3\n\t"" ""por %%mm2, %%mm0\n\t"" ""por %%mm5, %%mm3\n\t"" ""psllq $16, %%mm3\n\t"" ""por %%mm3, %%mm0\n\t"" MOVNTQ"" %%mm0, %0\n\t"" :""=m""(*d):""m""(*s),""m""(blue_15mask):""memory""); d += 4; s += 12; } __asm __volatile(SFENCE:::""memory""); __asm __volatile(EMMS:::""memory""); #endif while(s < end) { const int b= *s++; const int g= *s++; const int r= *s++; *d++ = (b>>3) | ((g&0xF8)<<2) | ((r&0xF8)<<7); } }","Yes, it is vulnerable."615613,"static int rsd_read_header(AVFormatContext *s) { AVIOContext *pb = s->pb; int i, ret, version, start = 0x800; AVCodecParameters *par; AVStream *st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); avio_skip(pb, 3); // ""RSD"" version = avio_r8(pb) - '0'; par = st->codecpar; par->codec_type = AVMEDIA_TYPE_AUDIO; par->codec_tag = avio_rl32(pb); par->codec_id = ff_codec_get_id(rsd_tags, par->codec_tag); if (!par->codec_id) { char tag_buf[32]; av_get_codec_tag_string(tag_buf, sizeof(tag_buf), par->codec_tag); for (i=0; i < FF_ARRAY_ELEMS(rsd_unsupported_tags); i++) { if (par->codec_tag == rsd_unsupported_tags[i]) { avpriv_request_sample(s, ""Codec tag: %s"", tag_buf); return AVERROR_PATCHWELCOME; } } av_log(s, AV_LOG_ERROR, ""Unknown codec tag: %s\n"", tag_buf); return AVERROR_INVALIDDATA; } par->channels = avio_rl32(pb); if (!par->channels) return AVERROR_INVALIDDATA; avio_skip(pb, 4); // Bit depth par->sample_rate = avio_rl32(pb); if (!par->sample_rate) return AVERROR_INVALIDDATA; avio_skip(pb, 4); // Unknown switch (par->codec_id) { case AV_CODEC_ID_XMA2: par->block_align = 2048; ff_alloc_extradata(par, 34); if (!par->extradata) return AVERROR(ENOMEM); memset(par->extradata, 0, 34); break; case AV_CODEC_ID_ADPCM_PSX: par->block_align = 16 * par->channels; if (pb->seekable) st->duration = av_get_audio_frame_duration2(par, avio_size(pb) - start); break; case AV_CODEC_ID_ADPCM_IMA_RAD: par->block_align = 20 * par->channels; if (pb->seekable) st->duration = av_get_audio_frame_duration2(par, avio_size(pb) - start); break; case AV_CODEC_ID_ADPCM_IMA_WAV: if (version == 2) start = avio_rl32(pb); par->bits_per_coded_sample = 4; par->block_align = 36 * par->channels; if (pb->seekable) st->duration = av_get_audio_frame_duration2(par, avio_size(pb) - start); break; case AV_CODEC_ID_ADPCM_THP_LE: /* RSD3GADP is mono, so only alloc enough memory to store the coeff table for a single channel. */ start = avio_rl32(pb); if ((ret = ff_get_extradata(s, par, s->pb, 32)) < 0) return ret; if (pb->seekable) st->duration = av_get_audio_frame_duration2(par, avio_size(pb) - start); break; case AV_CODEC_ID_ADPCM_THP: par->block_align = 8 * par->channels; avio_skip(s->pb, 0x1A4 - avio_tell(s->pb)); if ((ret = ff_alloc_extradata(st->codecpar, 32 * par->channels)) < 0) return ret; for (i = 0; i < par->channels; i++) { avio_read(s->pb, st->codecpar->extradata + 32 * i, 32); avio_skip(s->pb, 8); } if (pb->seekable) st->duration = (avio_size(pb) - start) / (8 * par->channels) * 14; break; case AV_CODEC_ID_PCM_S16LE: case AV_CODEC_ID_PCM_S16BE: if (version != 4) start = avio_rl32(pb); if (pb->seekable) st->duration = (avio_size(pb) - start) / 2 / par->channels; break; } avio_skip(pb, start - avio_tell(pb)); if (par->codec_id == AV_CODEC_ID_XMA2) { avio_skip(pb, avio_rb32(pb) + avio_rb32(pb)); st->duration = avio_rb32(pb); } avpriv_set_pts_info(st, 64, 1, par->sample_rate); return 0; }","Yes, it is vulnerable."616614,"static void device_initfn(Object *obj) { DeviceState *dev = DEVICE(obj); ObjectClass *class; Property *prop; if (qdev_hotplug) { dev->hotplugged = 1; qdev_hot_added = true; } dev->instance_id_alias = -1; dev->realized = false; object_property_add_bool(obj, ""realized"", device_get_realized, device_set_realized, NULL); object_property_add_bool(obj, ""hotpluggable"", device_get_hotpluggable, NULL, NULL); object_property_add_bool(obj, ""hotplugged"", device_get_hotplugged, device_set_hotplugged, &error_abort); class = object_get_class(OBJECT(dev)); do { for (prop = DEVICE_CLASS(class)->props; prop && prop->name; prop++) { qdev_property_add_legacy(dev, prop, &error_abort); qdev_property_add_static(dev, prop, &error_abort); } class = object_class_get_parent(class); } while (class != object_class_by_name(TYPE_DEVICE)); object_property_add_link(OBJECT(dev), ""parent_bus"", TYPE_BUS, (Object **)&dev->parent_bus, NULL, 0, &error_abort); QLIST_INIT(&dev->gpios); }","Yes, it is vulnerable."617615,"static int http_prepare_data(HTTPContext *c) { int i, len, ret; AVFormatContext *ctx; switch(c->state) { case HTTPSTATE_SEND_DATA_HEADER: memset(&c->fmt_ctx, 0, sizeof(c->fmt_ctx)); pstrcpy(c->fmt_ctx.author, sizeof(c->fmt_ctx.author), c->stream->author); pstrcpy(c->fmt_ctx.comment, sizeof(c->fmt_ctx.comment), c->stream->comment); pstrcpy(c->fmt_ctx.copyright, sizeof(c->fmt_ctx.copyright), c->stream->copyright); pstrcpy(c->fmt_ctx.title, sizeof(c->fmt_ctx.title), c->stream->title); /* open output stream by using specified codecs */ c->fmt_ctx.oformat = c->stream->fmt; c->fmt_ctx.nb_streams = c->stream->nb_streams; for(i=0;i<c->fmt_ctx.nb_streams;i++) { AVStream *st; st = av_mallocz(sizeof(AVStream)); c->fmt_ctx.streams[i] = st; /* if file or feed, then just take streams from FFStream struct */ if (!c->stream->feed || c->stream->feed == c->stream) memcpy(st, c->stream->streams[i], sizeof(AVStream)); else memcpy(st, c->stream->feed->streams[c->stream->feed_streams[i]], sizeof(AVStream)); st->codec.frame_number = 0; /* XXX: should be done in AVStream, not in codec */ } c->got_key_frame = 0; /* prepare header and save header data in a stream */ if (url_open_dyn_buf(&c->fmt_ctx.pb) < 0) { /* XXX: potential leak */ return -1; } c->fmt_ctx.pb.is_streamed = 1; av_write_header(&c->fmt_ctx); len = url_close_dyn_buf(&c->fmt_ctx.pb, &c->pb_buffer); c->buffer_ptr = c->pb_buffer; c->buffer_end = c->pb_buffer + len; c->state = HTTPSTATE_SEND_DATA; c->last_packet_sent = 0; break; case HTTPSTATE_SEND_DATA: /* find a new packet */ { AVPacket pkt; /* read a packet from the input stream */ if (c->stream->feed) { ffm_set_write_index(c->fmt_in, c->stream->feed->feed_write_index, c->stream->feed->feed_size); } if (c->stream->max_time && c->stream->max_time + c->start_time - cur_time < 0) { /* We have timed out */ c->state = HTTPSTATE_SEND_DATA_TRAILER; } else { if (c->is_packetized) { if (compute_send_delay(c) > 0) { c->state = HTTPSTATE_WAIT; return 1; /* state changed */ } } if (av_read_frame(c->fmt_in, &pkt) < 0) { if (c->stream->feed && c->stream->feed->feed_opened) { /* if coming from feed, it means we reached the end of the ffm file, so must wait for more data */ c->state = HTTPSTATE_WAIT_FEED; return 1; /* state changed */ } else { /* must send trailer now because eof or error */ c->state = HTTPSTATE_SEND_DATA_TRAILER; } } else { /* update first pts if needed */ if (c->first_pts == AV_NOPTS_VALUE) c->first_pts = pkt.pts; /* send it to the appropriate stream */ if (c->stream->feed) { /* if coming from a feed, select the right stream */ if (c->switch_pending) { c->switch_pending = 0; for(i=0;i<c->stream->nb_streams;i++) { if (c->switch_feed_streams[i] == pkt.stream_index) { if (pkt.flags & PKT_FLAG_KEY) { do_switch_stream(c, i); } } if (c->switch_feed_streams[i] >= 0) { c->switch_pending = 1; } } } for(i=0;i<c->stream->nb_streams;i++) { if (c->feed_streams[i] == pkt.stream_index) { pkt.stream_index = i; if (pkt.flags & PKT_FLAG_KEY) { c->got_key_frame |= 1 << i; } /* See if we have all the key frames, then * we start to send. This logic is not quite * right, but it works for the case of a * single video stream with one or more * audio streams (for which every frame is * typically a key frame). */ if (!c->stream->send_on_key || ((c->got_key_frame + 1) >> c->stream->nb_streams)) { goto send_it; } } } } else { AVCodecContext *codec; send_it: /* specific handling for RTP: we use several output stream (one for each RTP connection). XXX: need more abstract handling */ if (c->is_packetized) { c->packet_stream_index = pkt.stream_index; ctx = c->rtp_ctx[c->packet_stream_index]; codec = &ctx->streams[0]->codec; } else { ctx = &c->fmt_ctx; /* Fudge here */ codec = &ctx->streams[pkt.stream_index]->codec; } codec->key_frame = ((pkt.flags & PKT_FLAG_KEY) != 0); #ifdef PJSG if (codec->codec_type == CODEC_TYPE_AUDIO) { codec->frame_size = (codec->sample_rate * pkt.duration + 500000) / 1000000; /* printf(""Calculated size %d, from sr %d, duration %d\n"", codec->frame_size, codec->sample_rate, pkt.duration); */ } #endif if (c->is_packetized) { ret = url_open_dyn_packet_buf(&ctx->pb, url_get_max_packet_size(c->rtp_handles[c->packet_stream_index])); c->packet_byte_count = 0; c->packet_start_time_us = av_gettime(); } else { ret = url_open_dyn_buf(&ctx->pb); } if (ret < 0) { /* XXX: potential leak */ return -1; } if (av_write_packet(ctx, &pkt, pkt.pts)) { c->state = HTTPSTATE_SEND_DATA_TRAILER; } len = url_close_dyn_buf(&ctx->pb, &c->pb_buffer); c->buffer_ptr = c->pb_buffer; c->buffer_end = c->pb_buffer + len; codec->frame_number++; } #ifndef AV_READ_FRAME av_free_packet(&pkt); #endif } } } break; default: case HTTPSTATE_SEND_DATA_TRAILER: /* last packet test ? */ if (c->last_packet_sent || c->is_packetized) return -1; ctx = &c->fmt_ctx; /* prepare header */ if (url_open_dyn_buf(&ctx->pb) < 0) { /* XXX: potential leak */ return -1; } av_write_trailer(ctx); len = url_close_dyn_buf(&ctx->pb, &c->pb_buffer); c->buffer_ptr = c->pb_buffer; c->buffer_end = c->pb_buffer + len; c->last_packet_sent = 1; break; } return 0; }","No, it is non-vulnerable."618616,"static inline void cris_update_result(DisasContext *dc, TCGv res) { if (dc->update_cc) { if (dc->cc_size == 4 && (dc->cc_op == CC_OP_SUB || dc->cc_op == CC_OP_ADD)) return; tcg_gen_mov_tl(cc_result, res); } }","No, it is non-vulnerable."619617,"static inline TranslationBlock *tb_find_fast(CPUState *cpu, TranslationBlock *last_tb, int tb_exit) { CPUArchState *env = (CPUArchState *)cpu->env_ptr; TranslationBlock *tb; target_ulong cs_base, pc; uint32_t flags; /* we record a subset of the CPU state. It will always be the same before a given translated block is executed. */ cpu_get_tb_cpu_state(env, &pc, &cs_base, &flags); tb_lock(); tb = atomic_rcu_read(&cpu->tb_jmp_cache[tb_jmp_cache_hash_func(pc)]); if (unlikely(!tb || tb->pc != pc || tb->cs_base != cs_base || tb->flags != flags)) { tb = tb_find_slow(cpu, pc, cs_base, flags); } #ifndef CONFIG_USER_ONLY /* We don't take care of direct jumps when address mapping changes in * system emulation. So it's not safe to make a direct jump to a TB * spanning two pages because the mapping for the second page can change. */ if (tb->page_addr[1] != -1) { last_tb = NULL; } #endif /* See if we can patch the calling TB. */ if (last_tb && !qemu_loglevel_mask(CPU_LOG_TB_NOCHAIN)) { /* Check if translation buffer has been flushed */ if (cpu->tb_flushed) { cpu->tb_flushed = false; } else { tb_add_jump(last_tb, tb_exit, tb); } } tb_unlock(); return tb; }","No, it is non-vulnerable."620618,"static int proxy_init(FsContext *ctx) { V9fsProxy *proxy = g_malloc(sizeof(V9fsProxy)); int sock_id; if (ctx->export_flags & V9FS_PROXY_SOCK_NAME) { sock_id = connect_namedsocket(ctx->fs_root); } else { sock_id = atoi(ctx->fs_root); if (sock_id < 0) { fprintf(stderr, ""socket descriptor not initialized\n""); return -1; } } g_free(ctx->fs_root); proxy->in_iovec.iov_base = g_malloc(PROXY_MAX_IO_SZ + PROXY_HDR_SZ); proxy->in_iovec.iov_len = PROXY_MAX_IO_SZ + PROXY_HDR_SZ; proxy->out_iovec.iov_base = g_malloc(PROXY_MAX_IO_SZ + PROXY_HDR_SZ); proxy->out_iovec.iov_len = PROXY_MAX_IO_SZ + PROXY_HDR_SZ; ctx->private = proxy; proxy->sockfd = sock_id; qemu_mutex_init(&proxy->mutex); ctx->export_flags |= V9FS_PATHNAME_FSCONTEXT; ctx->exops.get_st_gen = proxy_ioc_getversion; return 0; }","Yes, it is vulnerable."621619,"int kvm_arch_init(MachineState *ms, KVMState *s) { MachineClass *mc = MACHINE_GET_CLASS(ms); mc->default_cpu_type = S390_CPU_TYPE_NAME(""host""); cap_sync_regs = kvm_check_extension(s, KVM_CAP_SYNC_REGS); cap_async_pf = kvm_check_extension(s, KVM_CAP_ASYNC_PF); cap_mem_op = kvm_check_extension(s, KVM_CAP_S390_MEM_OP); cap_s390_irq = kvm_check_extension(s, KVM_CAP_S390_INJECT_IRQ); if (!kvm_check_extension(s, KVM_CAP_S390_GMAP) || !kvm_check_extension(s, KVM_CAP_S390_COW)) { phys_mem_set_alloc(legacy_s390_alloc); } kvm_vm_enable_cap(s, KVM_CAP_S390_USER_SIGP, 0); kvm_vm_enable_cap(s, KVM_CAP_S390_VECTOR_REGISTERS, 0); kvm_vm_enable_cap(s, KVM_CAP_S390_USER_STSI, 0); if (ri_allowed()) { if (kvm_vm_enable_cap(s, KVM_CAP_S390_RI, 0) == 0) { cap_ri = 1; } } if (gs_allowed()) { if (kvm_vm_enable_cap(s, KVM_CAP_S390_GS, 0) == 0) { cap_gs = 1; } } /* * The migration interface for ais was introduced with kernel 4.13 * but the capability itself had been active since 4.12. As migration * support is considered necessary let's disable ais in the 2.10 * machine. */ /* kvm_vm_enable_cap(s, KVM_CAP_S390_AIS, 0); */ return 0; }","Yes, it is vulnerable."622620,"static void decode_fixed_sparse(AMRFixed *fixed_sparse, const uint16_t *pulses, const enum Mode mode, const int subframe) { av_assert1(MODE_4k75 <= mode && mode <= MODE_12k2); if (mode == MODE_12k2) { ff_decode_10_pulses_35bits(pulses, fixed_sparse, gray_decode, 5, 3); } else if (mode == MODE_10k2) { decode_8_pulses_31bits(pulses, fixed_sparse); } else { int *pulse_position = fixed_sparse->x; int i, pulse_subset; const int fixed_index = pulses[0]; if (mode <= MODE_5k15) { pulse_subset = ((fixed_index >> 3) & 8) + (subframe << 1); pulse_position[0] = ( fixed_index & 7) * 5 + track_position[pulse_subset]; pulse_position[1] = ((fixed_index >> 3) & 7) * 5 + track_position[pulse_subset + 1]; fixed_sparse->n = 2; } else if (mode == MODE_5k9) { pulse_subset = ((fixed_index & 1) << 1) + 1; pulse_position[0] = ((fixed_index >> 1) & 7) * 5 + pulse_subset; pulse_subset = (fixed_index >> 4) & 3; pulse_position[1] = ((fixed_index >> 6) & 7) * 5 + pulse_subset + (pulse_subset == 3 ? 1 : 0); fixed_sparse->n = pulse_position[0] == pulse_position[1] ? 1 : 2; } else if (mode == MODE_6k7) { pulse_position[0] = (fixed_index & 7) * 5; pulse_subset = (fixed_index >> 2) & 2; pulse_position[1] = ((fixed_index >> 4) & 7) * 5 + pulse_subset + 1; pulse_subset = (fixed_index >> 6) & 2; pulse_position[2] = ((fixed_index >> 8) & 7) * 5 + pulse_subset + 2; fixed_sparse->n = 3; } else { // mode <= MODE_7k95 pulse_position[0] = gray_decode[ fixed_index & 7]; pulse_position[1] = gray_decode[(fixed_index >> 3) & 7] + 1; pulse_position[2] = gray_decode[(fixed_index >> 6) & 7] + 2; pulse_subset = (fixed_index >> 9) & 1; pulse_position[3] = gray_decode[(fixed_index >> 10) & 7] + pulse_subset + 3; fixed_sparse->n = 4; } for (i = 0; i < fixed_sparse->n; i++) fixed_sparse->y[i] = (pulses[1] >> i) & 1 ? 1.0 : -1.0; } }","No, it is non-vulnerable."623621,"static void cg3_reg_write(void *opaque, hwaddr addr, uint64_t val, unsigned size) { CG3State *s = opaque; uint8_t regval; int i; DPRINTF(""write %"" PRIx64 "" to reg %"" HWADDR_PRIx "" size %d\n"", val, addr, size); switch (addr) { case CG3_REG_BT458_ADDR: s->dac_index = val; s->dac_state = 0; break; case CG3_REG_BT458_COLMAP: /* This register can be written to as either a long word or a byte */ if (size == 1) { val <<= 24; } for (i = 0; i < size; i++) { regval = val >> 24; switch (s->dac_state) { case 0: s->r[s->dac_index] = regval; s->dac_state++; break; case 1: s->g[s->dac_index] = regval; s->dac_state++; break; case 2: s->b[s->dac_index] = regval; /* Index autoincrement */ s->dac_index = (s->dac_index + 1) & 0xff; default: s->dac_state = 0; break; } val <<= 8; } s->full_update = 1; break; case CG3_REG_FBC_CTRL: s->regs[0] = val; break; case CG3_REG_FBC_STATUS: if (s->regs[1] & CG3_SR_PENDING_INT) { /* clear interrupt */ s->regs[1] &= ~CG3_SR_PENDING_INT; qemu_irq_lower(s->irq); } break; case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE: s->regs[addr - 0x10] = val; break; default: qemu_log_mask(LOG_UNIMP, ""cg3: Unimplemented register write "" ""reg 0x%"" HWADDR_PRIx "" size 0x%x value 0x%"" PRIx64 ""\n"", addr, size, val); break; } }","Yes, it is vulnerable."624622,"static void qxl_dirty_surfaces(PCIQXLDevice *qxl) { intptr_t vram_start; int i; if (qxl->mode != QXL_MODE_NATIVE && qxl->mode != QXL_MODE_COMPAT) { return; } /* dirty the primary surface */ qxl_set_dirty(&qxl->vga.vram, qxl->shadow_rom.draw_area_offset, qxl->shadow_rom.surface0_area_size); vram_start = (intptr_t)memory_region_get_ram_ptr(&qxl->vram_bar); /* dirty the off-screen surfaces */ for (i = 0; i < qxl->ssd.num_surfaces; i++) { QXLSurfaceCmd *cmd; intptr_t surface_offset; int surface_size; if (qxl->guest_surfaces.cmds[i] == 0) { continue; } cmd = qxl_phys2virt(qxl, qxl->guest_surfaces.cmds[i], MEMSLOT_GROUP_GUEST); assert(cmd); assert(cmd->type == QXL_SURFACE_CMD_CREATE); surface_offset = (intptr_t)qxl_phys2virt(qxl, cmd->u.surface_create.data, MEMSLOT_GROUP_GUEST); assert(surface_offset); surface_offset -= vram_start; surface_size = cmd->u.surface_create.height * abs(cmd->u.surface_create.stride); trace_qxl_surfaces_dirty(qxl->id, i, (int)surface_offset, surface_size); qxl_set_dirty(&qxl->vram_bar, surface_offset, surface_size); } }","Yes, it is vulnerable."625623,"VirtIODevice *virtio_blk_init(DeviceState *dev, VirtIOBlkConf *blk) { VirtIOBlock *s; static int virtio_blk_id; if (!blk->conf.bs) { error_report(""drive property not set""); return NULL; } if (!bdrv_is_inserted(blk->conf.bs)) { error_report(""Device needs media, but drive is empty""); return NULL; } blkconf_serial(&blk->conf, &blk->serial); if (blkconf_geometry(&blk->conf, NULL, 65535, 255, 255) < 0) { return NULL; } s = (VirtIOBlock *)virtio_common_init(""virtio-blk"", VIRTIO_ID_BLOCK, sizeof(struct virtio_blk_config), sizeof(VirtIOBlock)); s->vdev.get_config = virtio_blk_update_config; s->vdev.set_config = virtio_blk_set_config; s->vdev.get_features = virtio_blk_get_features; s->vdev.set_status = virtio_blk_set_status; s->vdev.reset = virtio_blk_reset; s->bs = blk->conf.bs; s->conf = &blk->conf; s->blk = blk; s->rq = NULL; s->sector_mask = (s->conf->logical_block_size / BDRV_SECTOR_SIZE) - 1; s->vq = virtio_add_queue(&s->vdev, 128, virtio_blk_handle_output); #ifdef CONFIG_VIRTIO_BLK_DATA_PLANE if (!virtio_blk_data_plane_create(&s->vdev, blk, &s->dataplane)) { virtio_cleanup(&s->vdev); return NULL; } #endif qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s); s->qdev = dev; register_savevm(dev, ""virtio-blk"", virtio_blk_id++, 2, virtio_blk_save, virtio_blk_load, s); bdrv_set_dev_ops(s->bs, &virtio_block_ops, s); bdrv_set_buffer_alignment(s->bs, s->conf->logical_block_size); bdrv_iostatus_enable(s->bs); add_boot_device_path(s->conf->bootindex, dev, ""/disk@0,0""); return &s->vdev; }","Yes, it is vulnerable."626624,"void _decode_opc(DisasContext * ctx) { #if 0 fprintf(stderr, ""Translating opcode 0x%04x\n"", ctx->opcode); #endif switch (ctx->opcode) { case 0x0019: /* div0u */ tcg_gen_andi_i32(cpu_sr, cpu_sr, ~(SR_M | SR_Q | SR_T)); return; case 0x000b: /* rts */ CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0028: /* clrmac */ tcg_gen_movi_i32(cpu_mach, 0); tcg_gen_movi_i32(cpu_macl, 0); return; case 0x0048: /* clrs */ tcg_gen_andi_i32(cpu_sr, cpu_sr, ~SR_S); return; case 0x0008: /* clrt */ gen_clr_t(); return; case 0x0038: /* ldtlb */ #if defined(CONFIG_USER_ONLY) assert(0); /* XXXXX */ #else tcg_gen_helper_0_0(helper_ldtlb); #endif return; case 0x002b: /* rte */ CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_sr, cpu_ssr); tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0058: /* sets */ tcg_gen_ori_i32(cpu_sr, cpu_sr, SR_S); return; case 0x0018: /* sett */ gen_set_t(); return; case 0xfbfd: /* frchg */ tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_FR); ctx->bstate = BS_STOP; return; case 0xf3fd: /* fschg */ tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_SZ); ctx->bstate = BS_STOP; return; case 0x0009: /* nop */ return; case 0x001b: /* sleep */ if (ctx->memidx) { tcg_gen_helper_0_1(helper_sleep, tcg_const_i32(ctx->pc + 2)); } else { tcg_gen_helper_0_0(helper_raise_illegal_instruction); ctx->bstate = BS_EXCP; } return; } switch (ctx->opcode & 0xf000) { case 0x1000: /* mov.l Rm,@(disp,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B11_8), B3_0 * 4); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x5000: /* mov.l @(disp,Rm),Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 4); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xe000: /* mov #imm,Rn */ tcg_gen_movi_i32(REG(B11_8), B7_0s); return; case 0x9000: /* mov.w @(disp,PC),Rn */ { TCGv addr = tcg_const_i32(ctx->pc + 4 + B7_0 * 2); tcg_gen_qemu_ld16s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xd000: /* mov.l @(disp,PC),Rn */ { TCGv addr = tcg_const_i32((ctx->pc + 4 + B7_0 * 4) & ~3); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x7000: /* add #imm,Rn */ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), B7_0s); return; case 0xa000: /* bra disp */ CHECK_NOT_DELAY_SLOT ctx->delayed_pc = ctx->pc + 4 + B11_0s * 2; tcg_gen_movi_i32(cpu_delayed_pc, ctx->delayed_pc); ctx->flags |= DELAY_SLOT; return; case 0xb000: /* bsr disp */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); ctx->delayed_pc = ctx->pc + 4 + B11_0s * 2; tcg_gen_movi_i32(cpu_delayed_pc, ctx->delayed_pc); ctx->flags |= DELAY_SLOT; return; } switch (ctx->opcode & 0xf00f) { case 0x6003: /* mov Rm,Rn */ tcg_gen_mov_i32(REG(B11_8), REG(B7_4)); return; case 0x2000: /* mov.b Rm,@Rn */ tcg_gen_qemu_st8(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x2001: /* mov.w Rm,@Rn */ tcg_gen_qemu_st16(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x2002: /* mov.l Rm,@Rn */ tcg_gen_qemu_st32(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x6000: /* mov.b @Rm,Rn */ tcg_gen_qemu_ld8s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x6001: /* mov.w @Rm,Rn */ tcg_gen_qemu_ld16s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x6002: /* mov.l @Rm,Rn */ tcg_gen_qemu_ld32s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x2004: /* mov.b Rm,@-Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 1); tcg_gen_qemu_st8(REG(B7_4), addr, ctx->memidx); /* might cause re-execution */ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 1); /* modify register status */ tcg_temp_free(addr); } return; case 0x2005: /* mov.w Rm,@-Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 2); tcg_gen_qemu_st16(REG(B7_4), addr, ctx->memidx); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 2); tcg_temp_free(addr); } return; case 0x2006: /* mov.l Rm,@-Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x6004: /* mov.b @Rm+,Rn */ tcg_gen_qemu_ld8s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 1); return; case 0x6005: /* mov.w @Rm+,Rn */ tcg_gen_qemu_ld16s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 2); return; case 0x6006: /* mov.l @Rm+,Rn */ tcg_gen_qemu_ld32s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); return; case 0x0004: /* mov.b Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st8(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x0005: /* mov.w Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st16(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x0006: /* mov.l Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000c: /* mov.b @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld8s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000d: /* mov.w @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld16s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000e: /* mov.l @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x6008: /* swap.b Rm,Rn */ { TCGv high, low; high = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext8u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 8); low = tcg_temp_new(TCG_TYPE_I32); tcg_gen_shri_i32(low, REG(B7_4), 8); tcg_gen_ext8u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x6009: /* swap.w Rm,Rn */ { TCGv high, low; high = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 16); low = tcg_temp_new(TCG_TYPE_I32); tcg_gen_shri_i32(low, REG(B7_4), 16); tcg_gen_ext16u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x200d: /* xtrct Rm,Rn */ { TCGv high, low; high = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 16); low = tcg_temp_new(TCG_TYPE_I32); tcg_gen_shri_i32(low, REG(B11_8), 16); tcg_gen_ext16u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x300c: /* add Rm,Rn */ tcg_gen_add_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x300e: /* addc Rm,Rn */ tcg_gen_helper_1_2(helper_addc, REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300f: /* addv Rm,Rn */ tcg_gen_helper_1_2(helper_addv, REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x2009: /* and Rm,Rn */ tcg_gen_and_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x3000: /* cmp/eq Rm,Rn */ gen_cmp(TCG_COND_EQ, REG(B7_4), REG(B11_8)); return; case 0x3003: /* cmp/ge Rm,Rn */ gen_cmp(TCG_COND_GE, REG(B7_4), REG(B11_8)); return; case 0x3007: /* cmp/gt Rm,Rn */ gen_cmp(TCG_COND_GT, REG(B7_4), REG(B11_8)); return; case 0x3006: /* cmp/hi Rm,Rn */ gen_cmp(TCG_COND_GTU, REG(B7_4), REG(B11_8)); return; case 0x3002: /* cmp/hs Rm,Rn */ gen_cmp(TCG_COND_GEU, REG(B7_4), REG(B11_8)); return; case 0x200c: /* cmp/str Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); TCGv cmp1 = tcg_temp_local_new(TCG_TYPE_I32); TCGv cmp2 = tcg_temp_local_new(TCG_TYPE_I32); tcg_gen_xor_i32(cmp1, REG(B7_4), REG(B11_8)); tcg_gen_andi_i32(cmp2, cmp1, 0xff000000); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x00ff0000); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x0000ff00); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x000000ff); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cpu_sr, cpu_sr, ~SR_T); tcg_gen_br(label2); gen_set_label(label1); tcg_gen_ori_i32(cpu_sr, cpu_sr, SR_T); gen_set_label(label2); tcg_temp_free(cmp2); tcg_temp_free(cmp1); } return; case 0x2007: /* div0s Rm,Rn */ { gen_copy_bit_i32(cpu_sr, 8, REG(B11_8), 31); /* SR_Q */ gen_copy_bit_i32(cpu_sr, 9, REG(B7_4), 31); /* SR_M */ TCGv val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_xor_i32(val, REG(B7_4), REG(B11_8)); gen_copy_bit_i32(cpu_sr, 0, val, 31); /* SR_T */ tcg_temp_free(val); } return; case 0x3004: /* div1 Rm,Rn */ tcg_gen_helper_1_2(helper_div1, REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300d: /* dmuls.l Rm,Rn */ { TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64); TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64); tcg_gen_ext_i32_i64(tmp1, REG(B7_4)); tcg_gen_ext_i32_i64(tmp2, REG(B11_8)); tcg_gen_mul_i64(tmp1, tmp1, tmp2); tcg_gen_trunc_i64_i32(cpu_macl, tmp1); tcg_gen_shri_i64(tmp1, tmp1, 32); tcg_gen_trunc_i64_i32(cpu_mach, tmp1); tcg_temp_free(tmp2); tcg_temp_free(tmp1); } return; case 0x3005: /* dmulu.l Rm,Rn */ { TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64); TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64); tcg_gen_extu_i32_i64(tmp1, REG(B7_4)); tcg_gen_extu_i32_i64(tmp2, REG(B11_8)); tcg_gen_mul_i64(tmp1, tmp1, tmp2); tcg_gen_trunc_i64_i32(cpu_macl, tmp1); tcg_gen_shri_i64(tmp1, tmp1, 32); tcg_gen_trunc_i64_i32(cpu_mach, tmp1); tcg_temp_free(tmp2); tcg_temp_free(tmp1); } return; case 0x600e: /* exts.b Rm,Rn */ tcg_gen_ext8s_i32(REG(B11_8), REG(B7_4)); return; case 0x600f: /* exts.w Rm,Rn */ tcg_gen_ext16s_i32(REG(B11_8), REG(B7_4)); return; case 0x600c: /* extu.b Rm,Rn */ tcg_gen_ext8u_i32(REG(B11_8), REG(B7_4)); return; case 0x600d: /* extu.w Rm,Rn */ tcg_gen_ext16u_i32(REG(B11_8), REG(B7_4)); return; case 0x000f: /* mac.l @Rm+,@Rn+ */ { TCGv arg0, arg1; arg0 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx); arg1 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx); tcg_gen_helper_0_2(helper_macl, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x400f: /* mac.w @Rm+,@Rn+ */ { TCGv arg0, arg1; arg0 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx); arg1 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx); tcg_gen_helper_0_2(helper_macw, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 2); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 2); } return; case 0x0007: /* mul.l Rm,Rn */ tcg_gen_mul_i32(cpu_macl, REG(B7_4), REG(B11_8)); return; case 0x200f: /* muls.w Rm,Rn */ { TCGv arg0, arg1; arg0 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16s_i32(arg0, REG(B7_4)); arg1 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16s_i32(arg1, REG(B11_8)); tcg_gen_mul_i32(cpu_macl, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); } return; case 0x200e: /* mulu.w Rm,Rn */ { TCGv arg0, arg1; arg0 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16u_i32(arg0, REG(B7_4)); arg1 = tcg_temp_new(TCG_TYPE_I32); tcg_gen_ext16u_i32(arg1, REG(B11_8)); tcg_gen_mul_i32(cpu_macl, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); } return; case 0x600b: /* neg Rm,Rn */ tcg_gen_neg_i32(REG(B11_8), REG(B7_4)); return; case 0x600a: /* negc Rm,Rn */ tcg_gen_helper_1_1(helper_negc, REG(B11_8), REG(B7_4)); return; case 0x6007: /* not Rm,Rn */ tcg_gen_not_i32(REG(B11_8), REG(B7_4)); return; case 0x200b: /* or Rm,Rn */ tcg_gen_or_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x400c: /* shad Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); int label3 = gen_new_label(); int label4 = gen_new_label(); TCGv shift = tcg_temp_local_new(TCG_TYPE_I32); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B7_4), 0, label1); /* Rm positive, shift to the left */ tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_shl_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label4); /* Rm negative, shift to the right */ gen_set_label(label1); tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_brcondi_i32(TCG_COND_EQ, shift, 0, label2); tcg_gen_not_i32(shift, REG(B7_4)); tcg_gen_andi_i32(shift, shift, 0x1f); tcg_gen_addi_i32(shift, shift, 1); tcg_gen_sar_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label4); /* Rm = -32 */ gen_set_label(label2); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B11_8), 0, label3); tcg_gen_movi_i32(REG(B11_8), 0); tcg_gen_br(label4); gen_set_label(label3); tcg_gen_movi_i32(REG(B11_8), 0xffffffff); gen_set_label(label4); tcg_temp_free(shift); } return; case 0x400d: /* shld Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); int label3 = gen_new_label(); TCGv shift = tcg_temp_local_new(TCG_TYPE_I32); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B7_4), 0, label1); /* Rm positive, shift to the left */ tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_shl_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label3); /* Rm negative, shift to the right */ gen_set_label(label1); tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_brcondi_i32(TCG_COND_EQ, shift, 0, label2); tcg_gen_not_i32(shift, REG(B7_4)); tcg_gen_andi_i32(shift, shift, 0x1f); tcg_gen_addi_i32(shift, shift, 1); tcg_gen_shr_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label3); /* Rm = -32 */ gen_set_label(label2); tcg_gen_movi_i32(REG(B11_8), 0); gen_set_label(label3); tcg_temp_free(shift); } return; case 0x3008: /* sub Rm,Rn */ tcg_gen_sub_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x300a: /* subc Rm,Rn */ tcg_gen_helper_1_2(helper_subc, REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300b: /* subv Rm,Rn */ tcg_gen_helper_1_2(helper_subv, REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x2008: /* tst Rm,Rn */ { TCGv val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_and_i32(val, REG(B7_4), REG(B11_8)); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0x200a: /* xor Rm,Rn */ tcg_gen_xor_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0xf00c: /* fmov {F,D,X}Rm,{F,D,X}Rn - FPSCR: Nothing */ if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, XREG(B7_4)); gen_store_fpr64(fp, XREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B7_4)); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf00a: /* fmov {F,D,X}Rm,@Rn - FPSCR: Nothing */ if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, XREG(B7_4)); tcg_gen_qemu_st64(fp, REG(B11_8), ctx->memidx); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B7_4)); tcg_gen_qemu_st32(fp, REG(B11_8), ctx->memidx); tcg_temp_free(fp); } return; case 0xf008: /* fmov @Rm,{F,D,X}Rn - FPSCR: Nothing */ if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); tcg_gen_qemu_ld64(fp, REG(B7_4), ctx->memidx); gen_store_fpr64(fp, XREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32u(fp, REG(B7_4), ctx->memidx); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf009: /* fmov @Rm+,{F,D,X}Rn - FPSCR: Nothing */ if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); tcg_gen_qemu_ld64(fp, REG(B7_4), ctx->memidx); gen_store_fpr64(fp, XREG(B11_8)); tcg_temp_free(fp); tcg_gen_addi_i32(REG(B7_4),REG(B7_4), 8); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32u(fp, REG(B7_4), ctx->memidx); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); } return; case 0xf00b: /* fmov {F,D,X}Rm,@-Rn - FPSCR: Nothing */ if (ctx->fpscr & FPSCR_SZ) { TCGv addr, fp; addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 8); fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, XREG(B7_4)); tcg_gen_qemu_st64(fp, addr, ctx->memidx); tcg_temp_free(fp); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 8); } else { TCGv addr, fp; addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 4); fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B7_4)); tcg_gen_qemu_st32(fp, addr, ctx->memidx); tcg_temp_free(fp); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0xf006: /* fmov @(R0,Rm),{F,D,X}Rm - FPSCR: Nothing */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); tcg_gen_qemu_ld64(fp, addr, ctx->memidx); gen_store_fpr64(fp, XREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32u(fp, addr, ctx->memidx); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } tcg_temp_free(addr); } return; case 0xf007: /* fmov {F,D,X}Rn,@(R0,Rn) - FPSCR: Nothing */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); if (ctx->fpscr & FPSCR_SZ) { TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, XREG(B7_4)); tcg_gen_qemu_st64(fp, addr, ctx->memidx); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B7_4)); tcg_gen_qemu_st32(fp, addr, ctx->memidx); tcg_temp_free(fp); } tcg_temp_free(addr); } return; case 0xf000: /* fadd Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf001: /* fsub Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf002: /* fmul Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf003: /* fdiv Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf004: /* fcmp/eq Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ case 0xf005: /* fcmp/gt Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ { TCGv fp0, fp1; if (ctx->fpscr & FPSCR_PR) { if (ctx->opcode & 0x0110) break; /* illegal instruction */ fp0 = tcg_temp_new(TCG_TYPE_I64); fp1 = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp0, DREG(B11_8)); gen_load_fpr64(fp1, DREG(B7_4)); } else { fp0 = tcg_temp_new(TCG_TYPE_I32); fp1 = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp0, FREG(B11_8)); gen_load_fpr32(fp1, FREG(B7_4)); } switch (ctx->opcode & 0xf00f) { case 0xf000: /* fadd Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_1_2(helper_fadd_DT, fp0, fp0, fp1); else tcg_gen_helper_1_2(helper_fadd_FT, fp0, fp0, fp1); break; case 0xf001: /* fsub Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_1_2(helper_fsub_DT, fp0, fp0, fp1); else tcg_gen_helper_1_2(helper_fsub_FT, fp0, fp0, fp1); break; case 0xf002: /* fmul Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_1_2(helper_fmul_DT, fp0, fp0, fp1); else tcg_gen_helper_1_2(helper_fmul_FT, fp0, fp0, fp1); break; case 0xf003: /* fdiv Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_1_2(helper_fdiv_DT, fp0, fp0, fp1); else tcg_gen_helper_1_2(helper_fdiv_FT, fp0, fp0, fp1); break; case 0xf004: /* fcmp/eq Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_0_2(helper_fcmp_eq_DT, fp0, fp1); else tcg_gen_helper_0_2(helper_fcmp_eq_FT, fp0, fp1); return; case 0xf005: /* fcmp/gt Rm,Rn */ if (ctx->fpscr & FPSCR_PR) tcg_gen_helper_0_2(helper_fcmp_gt_DT, fp0, fp1); else tcg_gen_helper_0_2(helper_fcmp_gt_FT, fp0, fp1); return; } if (ctx->fpscr & FPSCR_PR) { gen_store_fpr64(fp0, DREG(B11_8)); } else { gen_store_fpr32(fp0, FREG(B11_8)); } tcg_temp_free(fp1); tcg_temp_free(fp0); } return; } switch (ctx->opcode & 0xff00) { case 0xc900: /* and #imm,R0 */ tcg_gen_andi_i32(REG(0), REG(0), B7_0); return; case 0xcd00: /* and.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_andi_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0x8b00: /* bf label */ CHECK_NOT_DELAY_SLOT gen_conditional_jump(ctx, ctx->pc + 2, ctx->pc + 4 + B7_0s * 2); ctx->bstate = BS_BRANCH; return; case 0x8f00: /* bf/s label */ CHECK_NOT_DELAY_SLOT gen_branch_slot(ctx->delayed_pc = ctx->pc + 4 + B7_0s * 2, 0); ctx->flags |= DELAY_SLOT_CONDITIONAL; return; case 0x8900: /* bt label */ CHECK_NOT_DELAY_SLOT gen_conditional_jump(ctx, ctx->pc + 4 + B7_0s * 2, ctx->pc + 2); ctx->bstate = BS_BRANCH; return; case 0x8d00: /* bt/s label */ CHECK_NOT_DELAY_SLOT gen_branch_slot(ctx->delayed_pc = ctx->pc + 4 + B7_0s * 2, 1); ctx->flags |= DELAY_SLOT_CONDITIONAL; return; case 0x8800: /* cmp/eq #imm,R0 */ gen_cmp_imm(TCG_COND_EQ, REG(0), B7_0s); return; case 0xc400: /* mov.b @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0); tcg_gen_qemu_ld8s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc500: /* mov.w @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 2); tcg_gen_qemu_ld16s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc600: /* mov.l @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 4); tcg_gen_qemu_ld32s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc000: /* mov.b R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0); tcg_gen_qemu_st8(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc100: /* mov.w R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 2); tcg_gen_qemu_st16(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc200: /* mov.l R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 4); tcg_gen_qemu_st32(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8000: /* mov.b R0,@(disp,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B7_4), B3_0); tcg_gen_qemu_st8(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8100: /* mov.w R0,@(disp,Rn) */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 2); tcg_gen_qemu_st16(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8400: /* mov.b @(disp,Rn),R0 */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B7_4), B3_0); tcg_gen_qemu_ld8s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8500: /* mov.w @(disp,Rn),R0 */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 2); tcg_gen_qemu_ld16s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc700: /* mova @(disp,PC),R0 */ tcg_gen_movi_i32(REG(0), ((ctx->pc & 0xfffffffc) + 4 + B7_0 * 4) & ~3); return; case 0xcb00: /* or #imm,R0 */ tcg_gen_ori_i32(REG(0), REG(0), B7_0); return; case 0xcf00: /* or.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_ori_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0xc300: /* trapa #imm */ { TCGv imm; CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pc, ctx->pc); imm = tcg_const_i32(B7_0); tcg_gen_helper_0_1(helper_trapa, imm); tcg_temp_free(imm); ctx->bstate = BS_BRANCH; } return; case 0xc800: /* tst #imm,R0 */ { TCGv val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_andi_i32(val, REG(0), B7_0); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0xcc00: /* tst.b #imm,@(R0,GBR) */ { TCGv val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(val, REG(0), cpu_gbr); tcg_gen_qemu_ld8u(val, val, ctx->memidx); tcg_gen_andi_i32(val, val, B7_0); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0xca00: /* xor #imm,R0 */ tcg_gen_xori_i32(REG(0), REG(0), B7_0); return; case 0xce00: /* xor.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_xori_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; } switch (ctx->opcode & 0xf08f) { case 0x408e: /* ldc Rm,Rn_BANK */ tcg_gen_mov_i32(ALTREG(B6_4), REG(B11_8)); return; case 0x4087: /* ldc.l @Rm+,Rn_BANK */ tcg_gen_qemu_ld32s(ALTREG(B6_4), REG(B11_8), ctx->memidx); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); return; case 0x0082: /* stc Rm_BANK,Rn */ tcg_gen_mov_i32(REG(B11_8), ALTREG(B6_4)); return; case 0x4083: /* stc.l Rm_BANK,@-Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(ALTREG(B6_4), addr, ctx->memidx); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; } switch (ctx->opcode & 0xf0ff) { case 0x0023: /* braf Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->pc + 4); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0003: /* bsrf Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x4015: /* cmp/pl Rn */ gen_cmp_imm(TCG_COND_GT, REG(B11_8), 0); return; case 0x4011: /* cmp/pz Rn */ gen_cmp_imm(TCG_COND_GE, REG(B11_8), 0); return; case 0x4010: /* dt Rn */ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 1); gen_cmp_imm(TCG_COND_EQ, REG(B11_8), 0); return; case 0x402b: /* jmp @Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8)); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x400b: /* jsr @Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8)); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x400e: /* lds Rm,SR */ tcg_gen_andi_i32(cpu_sr, REG(B11_8), 0x700083f3); ctx->bstate = BS_STOP; return; case 0x4007: /* lds.l @Rm+,SR */ { TCGv val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(val, REG(B11_8), ctx->memidx); tcg_gen_andi_i32(cpu_sr, val, 0x700083f3); tcg_temp_free(val); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); ctx->bstate = BS_STOP; } return; case 0x0002: /* sts SR,Rn */ tcg_gen_mov_i32(REG(B11_8), cpu_sr); return; case 0x4003: /* sts SR,@-Rn */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(cpu_sr, addr, ctx->memidx); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; #define LDST(reg,ldnum,ldpnum,stnum,stpnum) \ case ldnum: \ tcg_gen_mov_i32 (cpu_##reg, REG(B11_8)); \ return; \ case ldpnum: \ tcg_gen_qemu_ld32s (cpu_##reg, REG(B11_8), ctx->memidx); \ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); \ return; \ case stnum: \ tcg_gen_mov_i32 (REG(B11_8), cpu_##reg); \ return; \ case stpnum: \ { \ TCGv addr = tcg_temp_new(TCG_TYPE_I32); \ tcg_gen_subi_i32(addr, REG(B11_8), 4); \ tcg_gen_qemu_st32 (cpu_##reg, addr, ctx->memidx); \ tcg_temp_free(addr); \ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); \ } \ return; LDST(gbr, 0x401e, 0x4017, 0x0012, 0x4013) LDST(vbr, 0x402e, 0x4027, 0x0022, 0x4023) LDST(ssr, 0x403e, 0x4037, 0x0032, 0x4033) LDST(spc, 0x404e, 0x4047, 0x0042, 0x4043) LDST(dbr, 0x40fa, 0x40f6, 0x00fa, 0x40f2) LDST(mach, 0x400a, 0x4006, 0x000a, 0x4002) LDST(macl, 0x401a, 0x4016, 0x001a, 0x4012) LDST(pr, 0x402a, 0x4026, 0x002a, 0x4022) LDST(fpul, 0x405a, 0x4056, 0x005a, 0x4052) case 0x406a: /* lds Rm,FPSCR */ tcg_gen_helper_0_1(helper_ld_fpscr, REG(B11_8)); ctx->bstate = BS_STOP; return; case 0x4066: /* lds.l @Rm+,FPSCR */ { TCGv addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(addr, REG(B11_8), ctx->memidx); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); tcg_gen_helper_0_1(helper_ld_fpscr, addr); tcg_temp_free(addr); ctx->bstate = BS_STOP; } return; case 0x006a: /* sts FPSCR,Rn */ tcg_gen_andi_i32(REG(B11_8), cpu_fpscr, 0x003fffff); return; case 0x4062: /* sts FPSCR,@-Rn */ { TCGv addr, val; val = tcg_temp_new(TCG_TYPE_I32); tcg_gen_andi_i32(val, cpu_fpscr, 0x003fffff); addr = tcg_temp_new(TCG_TYPE_I32); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(val, addr, ctx->memidx); tcg_temp_free(addr); tcg_temp_free(val); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x00c3: /* movca.l R0,@Rm */ tcg_gen_qemu_st32(REG(0), REG(B11_8), ctx->memidx); return; case 0x0029: /* movt Rn */ tcg_gen_andi_i32(REG(B11_8), cpu_sr, SR_T); return; case 0x0093: /* ocbi @Rn */ { TCGv dummy = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x00a3: /* ocbp @Rn */ { TCGv dummy = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x00b3: /* ocbwb @Rn */ { TCGv dummy = tcg_temp_new(TCG_TYPE_I32); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x0083: /* pref @Rn */ return; case 0x4024: /* rotcl Rn */ { TCGv tmp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_mov_i32(tmp, cpu_sr); gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 0, tmp, 0); tcg_temp_free(tmp); } return; case 0x4025: /* rotcr Rn */ { TCGv tmp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_mov_i32(tmp, cpu_sr); gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 31, tmp, 0); tcg_temp_free(tmp); } return; case 0x4004: /* rotl Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 0, cpu_sr, 0); return; case 0x4005: /* rotr Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 31, cpu_sr, 0); return; case 0x4000: /* shll Rn */ case 0x4020: /* shal Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4021: /* shar Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_sari_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4001: /* shlr Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4008: /* shll2 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 2); return; case 0x4018: /* shll8 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 8); return; case 0x4028: /* shll16 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 16); return; case 0x4009: /* shlr2 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 2); return; case 0x4019: /* shlr8 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 8); return; case 0x4029: /* shlr16 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 16); return; case 0x401b: /* tas.b @Rn */ { TCGv addr, val; addr = tcg_temp_local_new(TCG_TYPE_I32); tcg_gen_mov_i32(addr, REG(B11_8)); val = tcg_temp_local_new(TCG_TYPE_I32); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_gen_ori_i32(val, val, 0x80); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0xf00d: /* fsts FPUL,FRn - FPSCR: Nothing */ { TCGv fp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_mov_i32(fp, cpu_fpul); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf01d: /* flds FRm,FPUL - FPSCR: Nothing */ { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B11_8)); tcg_gen_mov_i32(cpu_fpul, fp); tcg_temp_free(fp); } return; case 0xf02d: /* float FPUL,FRn/DRn - FPSCR: R[PR,Enable.I]/W[Cause,Flag] */ if (ctx->fpscr & FPSCR_PR) { TCGv fp; if (ctx->opcode & 0x0100) break; /* illegal instruction */ fp = tcg_temp_new(TCG_TYPE_I64); tcg_gen_helper_1_1(helper_float_DT, fp, cpu_fpul); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); tcg_gen_helper_1_1(helper_float_FT, fp, cpu_fpul); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf03d: /* ftrc FRm/DRm,FPUL - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ if (ctx->fpscr & FPSCR_PR) { TCGv fp; if (ctx->opcode & 0x0100) break; /* illegal instruction */ fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, DREG(B11_8)); tcg_gen_helper_1_1(helper_ftrc_DT, cpu_fpul, fp); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B11_8)); tcg_gen_helper_1_1(helper_ftrc_FT, cpu_fpul, fp); tcg_temp_free(fp); } return; case 0xf04d: /* fneg FRn/DRn - FPSCR: Nothing */ { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B11_8)); tcg_gen_helper_1_1(helper_fneg_T, fp, fp); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf05d: /* fabs FRn/DRn */ if (ctx->fpscr & FPSCR_PR) { if (ctx->opcode & 0x0100) break; /* illegal instruction */ TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, DREG(B11_8)); tcg_gen_helper_1_1(helper_fabs_DT, fp, fp); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B11_8)); tcg_gen_helper_1_1(helper_fabs_FT, fp, fp); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf06d: /* fsqrt FRn */ if (ctx->fpscr & FPSCR_PR) { if (ctx->opcode & 0x0100) break; /* illegal instruction */ TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, DREG(B11_8)); tcg_gen_helper_1_1(helper_fsqrt_DT, fp, fp); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free(fp); } else { TCGv fp = tcg_temp_new(TCG_TYPE_I32); gen_load_fpr32(fp, FREG(B11_8)); tcg_gen_helper_1_1(helper_fsqrt_FT, fp, fp); gen_store_fpr32(fp, FREG(B11_8)); tcg_temp_free(fp); } return; case 0xf07d: /* fsrra FRn */ break; case 0xf08d: /* fldi0 FRn - FPSCR: R[PR] */ if (!(ctx->fpscr & FPSCR_PR)) { TCGv val = tcg_const_i32(0); gen_load_fpr32(val, FREG(B11_8)); tcg_temp_free(val); return; } break; case 0xf09d: /* fldi1 FRn - FPSCR: R[PR] */ if (!(ctx->fpscr & FPSCR_PR)) { TCGv val = tcg_const_i32(0x3f800000); gen_load_fpr32(val, FREG(B11_8)); tcg_temp_free(val); return; } break; case 0xf0ad: /* fcnvsd FPUL,DRn */ { TCGv fp = tcg_temp_new(TCG_TYPE_I64); tcg_gen_helper_1_1(helper_fcnvsd_FT_DT, fp, cpu_fpul); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free(fp); } return; case 0xf0bd: /* fcnvds DRn,FPUL */ { TCGv fp = tcg_temp_new(TCG_TYPE_I64); gen_load_fpr64(fp, DREG(B11_8)); tcg_gen_helper_1_1(helper_fcnvds_DT_FT, cpu_fpul, fp); tcg_temp_free(fp); } return; } fprintf(stderr, ""unknown instruction 0x%04x at pc 0x%08x\n"", ctx->opcode, ctx->pc); tcg_gen_helper_0_0(helper_raise_illegal_instruction); ctx->bstate = BS_EXCP; }","Yes, it is vulnerable."627625,"static void a9_scu_write(void *opaque, target_phys_addr_t offset, uint64_t value, unsigned size) { a9mp_priv_state *s = (a9mp_priv_state *)opaque; uint32_t mask; uint32_t shift; switch (size) { case 1: mask = 0xff; break; case 2: mask = 0xffff; break; case 4: mask = 0xffffffff; break; default: fprintf(stderr, ""Invalid size %u in write to a9 scu register %x\n"", size, (unsigned)offset); return; } switch (offset) { case 0x00: /* Control */ s->scu_control = value & 1; break; case 0x4: /* Configuration: RO */ break; case 0x08: case 0x09: case 0x0A: case 0x0B: /* Power Control */ shift = (offset - 0x8) * 8; s->scu_status &= ~(mask << shift); s->scu_status |= ((value & mask) << shift); break; case 0x0c: /* Invalidate All Registers In Secure State */ /* no-op as we do not implement caches */ break; case 0x40: /* Filtering Start Address Register */ case 0x44: /* Filtering End Address Register */ /* RAZ/WI, like an implementation with only one AXI master */ break; case 0x50: /* SCU Access Control Register */ case 0x54: /* SCU Non-secure Access Control Register */ /* unimplemented, fall through */ default: break; } }","No, it is non-vulnerable."628626,"static void s390_virtio_net_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); VirtIOS390DeviceClass *k = VIRTIO_S390_DEVICE_CLASS(klass); k->init = s390_virtio_net_init; dc->props = s390_virtio_net_properties; dc->alias = ""virtio-net""; }","No, it is non-vulnerable."629627,"static void hb_synthesis(AMRWBContext *ctx, int subframe, float *samples, const float *exc, const float *isf, const float *isf_past) { float hb_lpc[LP_ORDER_16k]; enum Mode mode = ctx->fr_cur_mode; if (mode == MODE_6k60) { float e_isf[LP_ORDER_16k]; // ISF vector for extrapolation double e_isp[LP_ORDER_16k]; ff_weighted_vector_sumf(e_isf, isf_past, isf, isfp_inter[subframe], 1.0 - isfp_inter[subframe], LP_ORDER); extrapolate_isf(e_isf, e_isf); e_isf[LP_ORDER_16k - 1] *= 2.0; ff_acelp_lsf2lspd(e_isp, e_isf, LP_ORDER_16k); ff_amrwb_lsp2lpc(e_isp, hb_lpc, LP_ORDER_16k); lpc_weighting(hb_lpc, hb_lpc, 0.9, LP_ORDER_16k); } else { lpc_weighting(hb_lpc, ctx->lp_coef[subframe], 0.6, LP_ORDER); } ff_celp_lp_synthesis_filterf(samples, hb_lpc, exc, AMRWB_SFR_SIZE_16k, (mode == MODE_6k60) ? LP_ORDER_16k : LP_ORDER); }","No, it is non-vulnerable."630628,"static int qemu_savevm_state(QEMUFile *f, Error **errp) { int ret; MigrationParams params = { .blk = 0, .shared = 0 }; MigrationState *ms = migrate_init(&params); ms->to_dst_file = f; if (qemu_savevm_state_blocked(errp)) { return -EINVAL; } qemu_mutex_unlock_iothread(); qemu_savevm_state_header(f); qemu_savevm_state_begin(f, &params); qemu_mutex_lock_iothread(); while (qemu_file_get_error(f) == 0) { if (qemu_savevm_state_iterate(f, false) > 0) { break; } } ret = qemu_file_get_error(f); if (ret == 0) { qemu_savevm_state_complete_precopy(f, false); ret = qemu_file_get_error(f); } qemu_savevm_state_cleanup(); if (ret != 0) { error_setg_errno(errp, -ret, ""Error while writing VM state""); } return ret; }","Yes, it is vulnerable."631629,"static always_inline void dv_set_class_number(DCTELEM* blk, EncBlockInfo* bi, const uint8_t* zigzag_scan, int bias) { int i, area; int run; int classes[] = {12, 24, 36, 0xffff}; run = 0; bi->mb[0] = blk[0]; bi->cno = 0; for (area = 0; area < 4; area++) { bi->prev_run[area] = run; bi->bit_size[area] = 0; for (i=mb_area_start[area]; i<mb_area_start[area+1]; i++) { bi->mb[i] = (blk[zigzag_scan[i]] / 16); while ((bi->mb[i] ^ (bi->mb[i] >> 8)) > classes[bi->cno]) bi->cno++; if (bi->mb[i]) { bi->bit_size[area] += dv_rl2vlc_size(run, bi->mb[i]); run = 0; } else ++run; } } bi->bit_size[3] += 4; /* EOB marker */ bi->cno += bias; if (bi->cno >= 3) { /* FIXME: we have to recreate bit_size[], prev_run[] */ bi->cno = 3; for (i=1; i<64; i++) bi->mb[i] /= 2; } }","No, it is non-vulnerable."632630,"static void t_gen_lsl(TCGv d, TCGv a, TCGv b) { TCGv t0, t_31; t0 = tcg_temp_new(TCG_TYPE_TL); t_31 = tcg_temp_new(TCG_TYPE_TL); tcg_gen_shl_tl(d, a, b); tcg_gen_movi_tl(t_31, 31); tcg_gen_sub_tl(t0, t_31, b); tcg_gen_sar_tl(t0, t0, t_31); tcg_gen_and_tl(t0, t0, d); tcg_gen_xor_tl(d, d, t0); tcg_temp_free(t0); tcg_temp_free(t_31); }","Yes, it is vulnerable."633631,"bool virtio_scsi_handle_ctrl_vq(VirtIOSCSI *s, VirtQueue *vq) { VirtIOSCSIReq *req; bool progress = false; virtio_scsi_acquire(s); while ((req = virtio_scsi_pop_req(s, vq))) { progress = true; virtio_scsi_handle_ctrl_req(s, req); } virtio_scsi_release(s); return progress; }","Yes, it is vulnerable."634632,"static void gus_realizefn (DeviceState *dev, Error **errp) { ISADevice *d = ISA_DEVICE(dev); GUSState *s = GUS (dev); IsaDmaClass *k; struct audsettings as; AUD_register_card (""gus"", &s->card); as.freq = s->freq; as.nchannels = 2; as.fmt = AUD_FMT_S16; as.endianness = GUS_ENDIANNESS; s->voice = AUD_open_out ( &s->card, NULL, ""gus"", s, GUS_callback, &as ); if (!s->voice) { AUD_remove_card (&s->card); error_setg(errp, ""No voice""); return; } s->shift = 2; s->samples = AUD_get_buffer_size_out (s->voice) >> s->shift; s->mixbuf = g_malloc0 (s->samples << s->shift); isa_register_portio_list (d, s->port, gus_portio_list1, s, ""gus""); isa_register_portio_list (d, (s->port + 0x100) & 0xf00, gus_portio_list2, s, ""gus""); s->isa_dma = isa_get_dma(isa_bus_from_device(d), s->emu.gusdma); k = ISADMA_GET_CLASS(s->isa_dma); k->register_channel(s->isa_dma, s->emu.gusdma, GUS_read_DMA, s); s->emu.himemaddr = s->himem; s->emu.gusdatapos = s->emu.himemaddr + 1024 * 1024 + 32; s->emu.opaque = s; isa_init_irq (d, &s->pic, s->emu.gusirq); AUD_set_active_out (s->voice, 1); }","Yes, it is vulnerable."635633,"static inline bool migration_bitmap_clear_dirty(RAMState *rs, ram_addr_t addr) { bool ret; int nr = addr >> TARGET_PAGE_BITS; unsigned long *bitmap = atomic_rcu_read(&rs->ram_bitmap)->bmap; ret = test_and_clear_bit(nr, bitmap); if (ret) { rs->migration_dirty_pages--; } return ret; }","Yes, it is vulnerable."636634,"static int test_vector_fmul_window(AVFloatDSPContext *fdsp, AVFloatDSPContext *cdsp, const float *v1, const float *v2, const float *v3) { LOCAL_ALIGNED(32, float, cdst, [LEN]); LOCAL_ALIGNED(32, float, odst, [LEN]); int ret; cdsp->vector_fmul_window(cdst, v1, v2, v3, LEN / 2); fdsp->vector_fmul_window(odst, v1, v2, v3, LEN / 2); if (ret = compare_floats(cdst, odst, LEN, ARBITRARY_FMUL_WINDOW_CONST)) av_log(NULL, AV_LOG_ERROR, ""vector_fmul_window failed\n""); return ret; }","No, it is non-vulnerable."637635,"static void unassign_storage(SCLPDevice *sclp, SCCB *sccb) { MemoryRegion *mr = NULL; AssignStorage *assign_info = (AssignStorage *) sccb; sclpMemoryHotplugDev *mhd = get_sclp_memory_hotplug_dev(); ram_addr_t unassign_addr; MemoryRegion *sysmem = get_system_memory(); if (!mhd) { sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND); return; } unassign_addr = (assign_info->rn - 1) * mhd->rzm; /* if the addr is a multiple of 256 MB */ if ((unassign_addr % MEM_SECTION_SIZE == 0) && (unassign_addr >= mhd->padded_ram_size)) { mhd->standby_state_map[(unassign_addr - mhd->padded_ram_size) / MEM_SECTION_SIZE] = 0; /* find the specified memory region and destroy it */ mr = memory_region_find(sysmem, unassign_addr, 1).mr; memory_region_unref(mr); if (mr) { int i; int is_removable = 1; ram_addr_t map_offset = (unassign_addr - mhd->padded_ram_size - (unassign_addr - mhd->padded_ram_size) % mhd->standby_subregion_size); /* Mark all affected subregions as 'standby' once again */ for (i = 0; i < (mhd->standby_subregion_size / MEM_SECTION_SIZE); i++) { if (mhd->standby_state_map[i + map_offset / MEM_SECTION_SIZE]) { is_removable = 0; break; } } if (is_removable) { memory_region_del_subregion(sysmem, mr); object_unref(OBJECT(mr)); } } } sccb->h.response_code = cpu_to_be16(SCLP_RC_NORMAL_COMPLETION); }","Yes, it is vulnerable."638636,"matroska_parse_block(MatroskaDemuxContext *matroska, uint8_t *data, int size, int64_t pos, uint64_t cluster_time, uint64_t duration, int is_keyframe, int is_bframe) { int res = 0; int track; AVStream *st; AVPacket *pkt; uint8_t *origdata = data; int16_t block_time; uint32_t *lace_size = NULL; int n, flags, laces = 0; uint64_t num; int stream_index; /* first byte(s): tracknum */ if ((n = matroska_ebmlnum_uint(data, size, &num)) < 0) { av_log(matroska->ctx, AV_LOG_ERROR, ""EBML block data error\n""); av_free(origdata); return res; } data += n; size -= n; /* fetch track from num */ track = matroska_find_track_by_num(matroska, num); if (size <= 3 || track < 0 || track >= matroska->num_tracks) { av_log(matroska->ctx, AV_LOG_INFO, ""Invalid stream %d or size %u\n"", track, size); av_free(origdata); return res; } stream_index = matroska->tracks[track]->stream_index; if (stream_index < 0 || stream_index >= matroska->ctx->nb_streams) { av_free(origdata); return res; } st = matroska->ctx->streams[stream_index]; if (st->discard >= AVDISCARD_ALL) { av_free(origdata); return res; } if (duration == AV_NOPTS_VALUE) duration = matroska->tracks[track]->default_duration / matroska->time_scale; /* block_time (relative to cluster time) */ block_time = AV_RB16(data); data += 2; flags = *data++; size -= 3; if (is_keyframe == -1) is_keyframe = flags & 0x80 ? PKT_FLAG_KEY : 0; if (matroska->skip_to_keyframe) { if (!is_keyframe || st != matroska->skip_to_stream) { av_free(origdata); return res; } matroska->skip_to_keyframe = 0; } switch ((flags & 0x06) >> 1) { case 0x0: /* no lacing */ laces = 1; lace_size = av_mallocz(sizeof(int)); lace_size[0] = size; break; case 0x1: /* xiph lacing */ case 0x2: /* fixed-size lacing */ case 0x3: /* EBML lacing */ assert(size>0); // size <=3 is checked before size-=3 above laces = (*data) + 1; data += 1; size -= 1; lace_size = av_mallocz(laces * sizeof(int)); switch ((flags & 0x06) >> 1) { case 0x1: /* xiph lacing */ { uint8_t temp; uint32_t total = 0; for (n = 0; res == 0 && n < laces - 1; n++) { while (1) { if (size == 0) { res = -1; break; } temp = *data; lace_size[n] += temp; data += 1; size -= 1; if (temp != 0xff) break; } total += lace_size[n]; } lace_size[n] = size - total; break; } case 0x2: /* fixed-size lacing */ for (n = 0; n < laces; n++) lace_size[n] = size / laces; break; case 0x3: /* EBML lacing */ { uint32_t total; n = matroska_ebmlnum_uint(data, size, &num); if (n < 0) { av_log(matroska->ctx, AV_LOG_INFO, ""EBML block data error\n""); break; } data += n; size -= n; total = lace_size[0] = num; for (n = 1; res == 0 && n < laces - 1; n++) { int64_t snum; int r; r = matroska_ebmlnum_sint (data, size, &snum); if (r < 0) { av_log(matroska->ctx, AV_LOG_INFO, ""EBML block data error\n""); break; } data += r; size -= r; lace_size[n] = lace_size[n - 1] + snum; total += lace_size[n]; } lace_size[n] = size - total; break; } } break; } if (res == 0) { uint64_t timecode = AV_NOPTS_VALUE; if (cluster_time != (uint64_t)-1 && (block_time >= 0 || cluster_time >= -block_time)) timecode = cluster_time + block_time; for (n = 0; n < laces; n++) { if (st->codec->codec_id == CODEC_ID_RA_288 || st->codec->codec_id == CODEC_ID_COOK || st->codec->codec_id == CODEC_ID_ATRAC3) { MatroskaAudioTrack *audiotrack = (MatroskaAudioTrack *)matroska->tracks[track]; int a = st->codec->block_align; int sps = audiotrack->sub_packet_size; int cfs = audiotrack->coded_framesize; int h = audiotrack->sub_packet_h; int y = audiotrack->sub_packet_cnt; int w = audiotrack->frame_size; int x; if (!audiotrack->pkt_cnt) { if (st->codec->codec_id == CODEC_ID_RA_288) for (x=0; x<h/2; x++) memcpy(audiotrack->buf+x*2*w+y*cfs, data+x*cfs, cfs); else for (x=0; x<w/sps; x++) memcpy(audiotrack->buf+sps*(h*x+((h+1)/2)*(y&1)+(y>>1)), data+x*sps, sps); if (++audiotrack->sub_packet_cnt >= h) { audiotrack->sub_packet_cnt = 0; audiotrack->pkt_cnt = h*w / a; } } while (audiotrack->pkt_cnt) { pkt = av_mallocz(sizeof(AVPacket)); av_new_packet(pkt, a); memcpy(pkt->data, audiotrack->buf + a * (h*w / a - audiotrack->pkt_cnt--), a); pkt->pos = pos; pkt->stream_index = stream_index; matroska_queue_packet(matroska, pkt); } } else { int result, offset = 0, ilen, olen, pkt_size = lace_size[n]; uint8_t *pkt_data = data; if (matroska->tracks[track]->encoding_scope & 1) { switch (matroska->tracks[track]->encoding_algo) { case MATROSKA_TRACK_ENCODING_COMP_HEADERSTRIP: offset = matroska->tracks[track]->encoding_settings_len; break; case MATROSKA_TRACK_ENCODING_COMP_LZO: pkt_data = NULL; do { ilen = lace_size[n]; olen = pkt_size *= 3; pkt_data = av_realloc(pkt_data, pkt_size+LZO_OUTPUT_PADDING); result = lzo1x_decode(pkt_data, &olen, data, &ilen); } while (result==LZO_OUTPUT_FULL && pkt_size<10000000); if (result) { av_free(pkt_data); continue; } pkt_size -= olen; break; #ifdef CONFIG_ZLIB case MATROSKA_TRACK_ENCODING_COMP_ZLIB: { z_stream zstream = {0}; pkt_data = NULL; if (inflateInit(&zstream) != Z_OK) continue; zstream.next_in = data; zstream.avail_in = lace_size[n]; do { pkt_size *= 3; pkt_data = av_realloc(pkt_data, pkt_size); zstream.avail_out = pkt_size - zstream.total_out; zstream.next_out = pkt_data + zstream.total_out; result = inflate(&zstream, Z_NO_FLUSH); } while (result==Z_OK && pkt_size<10000000); pkt_size = zstream.total_out; inflateEnd(&zstream); if (result != Z_STREAM_END) { av_free(pkt_data); continue; } break; } #endif #ifdef CONFIG_BZLIB case MATROSKA_TRACK_ENCODING_COMP_BZLIB: { bz_stream bzstream = {0}; pkt_data = NULL; if (BZ2_bzDecompressInit(&bzstream, 0, 0) != BZ_OK) continue; bzstream.next_in = data; bzstream.avail_in = lace_size[n]; do { pkt_size *= 3; pkt_data = av_realloc(pkt_data, pkt_size); bzstream.avail_out = pkt_size - bzstream.total_out_lo32; bzstream.next_out = pkt_data + bzstream.total_out_lo32; result = BZ2_bzDecompress(&bzstream); } while (result==BZ_OK && pkt_size<10000000); pkt_size = bzstream.total_out_lo32; BZ2_bzDecompressEnd(&bzstream); if (result != BZ_STREAM_END) { av_free(pkt_data); continue; } break; } #endif } } pkt = av_mallocz(sizeof(AVPacket)); /* XXX: prevent data copy... */ if (av_new_packet(pkt, pkt_size+offset) < 0) { res = AVERROR(ENOMEM); n = laces-1; break; } if (offset) memcpy (pkt->data, matroska->tracks[track]->encoding_settings, offset); memcpy (pkt->data+offset, pkt_data, pkt_size); if (n == 0) pkt->flags = is_keyframe; pkt->stream_index = stream_index; pkt->pts = timecode; pkt->pos = pos; pkt->duration = duration; matroska_queue_packet(matroska, pkt); } if (timecode != AV_NOPTS_VALUE) timecode = duration ? timecode + duration : AV_NOPTS_VALUE; data += lace_size[n]; } } av_free(lace_size); av_free(origdata); return res; }","Yes, it is vulnerable."639637,"static void do_flush_queued_data(VirtIOSerialPort *port, VirtQueue *vq, VirtIODevice *vdev) { VirtIOSerialPortClass *vsc; assert(port); assert(virtio_queue_ready(vq)); vsc = VIRTIO_SERIAL_PORT_GET_CLASS(port); while (!port->throttled) { unsigned int i; /* Pop an elem only if we haven't left off a previous one mid-way */ if (!port->elem) { port->elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); if (!port->elem) { break; port->iov_idx = 0; port->iov_offset = 0; for (i = port->iov_idx; i < port->elem->out_num; i++) { size_t buf_size; ssize_t ret; buf_size = port->elem->out_sg[i].iov_len - port->iov_offset; ret = vsc->have_data(port, port->elem->out_sg[i].iov_base + port->iov_offset, buf_size); if (port->throttled) { port->iov_idx = i; if (ret > 0) { port->iov_offset += ret; break; port->iov_offset = 0; if (port->throttled) { break; virtqueue_push(vq, port->elem, 0); g_free(port->elem); port->elem = NULL; virtio_notify(vdev, vq);","Yes, it is vulnerable."640638,"yuv2planeX_16_c_template(const int16_t *filter, int filterSize, const int32_t **src, uint16_t *dest, int dstW, int big_endian, int output_bits) { int i; int shift = 15; av_assert0(output_bits == 16); for (i = 0; i < dstW; i++) { int val = 1 << (shift - 1); int j; /* range of val is [0,0x7FFFFFFF], so 31 bits, but with lanczos/spline * filters (or anything with negative coeffs, the range can be slightly * wider in both directions. To account for this overflow, we subtract * a constant so it always fits in the signed range (assuming a * reasonable filterSize), and re-add that at the end. */ val -= 0x40000000; for (j = 0; j < filterSize; j++) val += src[j][i] * filter[j]; output_pixel(&dest[i], val, 0x8000, int); } }","Yes, it is vulnerable."641639,"static int generate_coupling_coordinates(AC3DecodeContext * ctx) { ac3_audio_block *ab = &ctx->audio_block; uint8_t exp, mstrcplco; int16_t mant; uint32_t cplbndstrc = (1 << ab->ncplsubnd) >> 1; int ch, bnd, sbnd; float cplco; if (ab->cplcoe) for (ch = 0; ch < ctx->bsi.nfchans; ch++) if (ab->cplcoe & (1 << ch)) { mstrcplco = 3 * ab->mstrcplco[ch]; sbnd = ab->cplbegf; for (bnd = 0; bnd < ab->ncplbnd; bnd++) { exp = ab->cplcoexp[ch][bnd]; if (exp == 15) mant = ab->cplcomant[ch][bnd] <<= 14; else mant = (ab->cplcomant[ch][bnd] | 0x10) << 13; cplco = to_float(exp + mstrcplco, mant); if (ctx->bsi.acmod == 0x02 && (ab->flags & AC3_AB_PHSFLGINU) && ch == 1 && (ab->phsflg & (1 << bnd))) cplco = -cplco; /* invert the right channel */ ab->cplco[ch][sbnd++] = cplco; while (cplbndstrc & ab->cplbndstrc) { cplbndstrc >>= 1; ab->cplco[ch][sbnd++] = cplco; } cplbndstrc >>= 1; } } return 0; }","No, it is non-vulnerable."642640,static void fifo_deinit(AVFormatContext *avf) { FifoContext *fifo = avf->priv_data; av_dict_free(&fifo->format_options); avformat_free_context(fifo->avf); av_thread_message_queue_free(&fifo->queue); pthread_mutex_destroy(&fifo->overflow_flag_lock); },"Yes, it is vulnerable."643641,"static int v9fs_receive_response(V9fsProxy *proxy, int type, int *status, void *response) { int retval; ProxyHeader header; struct iovec *reply = &proxy->in_iovec; *status = 0; reply->iov_len = 0; retval = socket_read(proxy->sockfd, reply->iov_base, PROXY_HDR_SZ); if (retval < 0) { return retval; } reply->iov_len = PROXY_HDR_SZ; proxy_unmarshal(reply, 0, ""dd"", &header.type, &header.size); /* * if response size > PROXY_MAX_IO_SZ, read the response but ignore it and * return -ENOBUFS */ if (header.size > PROXY_MAX_IO_SZ) { int count; while (header.size > 0) { count = MIN(PROXY_MAX_IO_SZ, header.size); count = socket_read(proxy->sockfd, reply->iov_base, count); if (count < 0) { return count; } header.size -= count; } *status = -ENOBUFS; return 0; } retval = socket_read(proxy->sockfd, reply->iov_base + PROXY_HDR_SZ, header.size); if (retval < 0) { return retval; } reply->iov_len += header.size; /* there was an error during processing request */ if (header.type == T_ERROR) { int ret; ret = proxy_unmarshal(reply, PROXY_HDR_SZ, ""d"", status); if (ret < 0) { *status = ret; } return 0; } switch (type) { case T_LSTAT: { ProxyStat prstat; retval = proxy_unmarshal(reply, PROXY_HDR_SZ, ""qqqdddqqqqqqqqqq"", &prstat.st_dev, &prstat.st_ino, &prstat.st_nlink, &prstat.st_mode, &prstat.st_uid, &prstat.st_gid, &prstat.st_rdev, &prstat.st_size, &prstat.st_blksize, &prstat.st_blocks, &prstat.st_atim_sec, &prstat.st_atim_nsec, &prstat.st_mtim_sec, &prstat.st_mtim_nsec, &prstat.st_ctim_sec, &prstat.st_ctim_nsec); prstat_to_stat(response, &prstat); break; } case T_STATFS: { ProxyStatFS prstfs; retval = proxy_unmarshal(reply, PROXY_HDR_SZ, ""qqqqqqqqqqq"", &prstfs.f_type, &prstfs.f_bsize, &prstfs.f_blocks, &prstfs.f_bfree, &prstfs.f_bavail, &prstfs.f_files, &prstfs.f_ffree, &prstfs.f_fsid[0], &prstfs.f_fsid[1], &prstfs.f_namelen, &prstfs.f_frsize); prstatfs_to_statfs(response, &prstfs); break; } case T_READLINK: { V9fsString target; v9fs_string_init(&target); retval = proxy_unmarshal(reply, PROXY_HDR_SZ, ""s"", &target); strcpy(response, target.data); v9fs_string_free(&target); break; } case T_LGETXATTR: case T_LLISTXATTR: { V9fsString xattr; v9fs_string_init(&xattr); retval = proxy_unmarshal(reply, PROXY_HDR_SZ, ""s"", &xattr); memcpy(response, xattr.data, xattr.size); v9fs_string_free(&xattr); break; } case T_GETVERSION: proxy_unmarshal(reply, PROXY_HDR_SZ, ""q"", response); break; default: return -1; } if (retval < 0) { *status = retval; } return 0; }","No, it is non-vulnerable."644642,"static av_cold int vpx_init(AVCodecContext *avctx, const struct vpx_codec_iface *iface) { VP8Context *ctx = avctx->priv_data; struct vpx_codec_enc_cfg enccfg; int res; av_log(avctx, AV_LOG_INFO, ""%s\n"", vpx_codec_version_str()); av_log(avctx, AV_LOG_VERBOSE, ""%s\n"", vpx_codec_build_config()); if ((res = vpx_codec_enc_config_default(iface, &enccfg, 0)) != VPX_CODEC_OK) { av_log(avctx, AV_LOG_ERROR, ""Failed to get config: %s\n"", vpx_codec_err_to_string(res)); if(!avctx->bit_rate) if(avctx->rc_max_rate || avctx->rc_buffer_size || avctx->rc_initial_buffer_occupancy) { av_log( avctx, AV_LOG_ERROR, ""Rate control parameters set without a bitrate\n""); dump_enc_cfg(avctx, &enccfg); enccfg.g_w = avctx->width; enccfg.g_h = avctx->height; enccfg.g_timebase.num = avctx->time_base.num; enccfg.g_timebase.den = avctx->time_base.den; enccfg.g_threads = avctx->thread_count; enccfg.g_lag_in_frames= ctx->lag_in_frames; if (avctx->flags & CODEC_FLAG_PASS1) enccfg.g_pass = VPX_RC_FIRST_PASS; else if (avctx->flags & CODEC_FLAG_PASS2) enccfg.g_pass = VPX_RC_LAST_PASS; else enccfg.g_pass = VPX_RC_ONE_PASS; if (avctx->rc_min_rate == avctx->rc_max_rate && avctx->rc_min_rate == avctx->bit_rate && avctx->bit_rate) enccfg.rc_end_usage = VPX_CBR; else if (ctx->crf) enccfg.rc_end_usage = VPX_CQ; if (avctx->bit_rate) { enccfg.rc_target_bitrate = av_rescale_rnd(avctx->bit_rate, 1, 1000, AV_ROUND_NEAR_INF); } else { enccfg.rc_target_bitrate = 1000000; } else { avctx->bit_rate = enccfg.rc_target_bitrate * 1000; av_log(avctx, AV_LOG_WARNING, ""Neither bitrate nor constrained quality specified, using default bitrate of %dkbit/sec\n"", enccfg.rc_target_bitrate); if (avctx->qmin >= 0) enccfg.rc_min_quantizer = avctx->qmin; if (avctx->qmax > 0) enccfg.rc_max_quantizer = avctx->qmax; enccfg.rc_dropframe_thresh = avctx->frame_skip_threshold; //0-100 (0 => CBR, 100 => VBR) enccfg.rc_2pass_vbr_bias_pct = round(avctx->qcompress * 100); if (avctx->bit_rate) enccfg.rc_2pass_vbr_minsection_pct = avctx->rc_min_rate * 100LL / avctx->bit_rate; if (avctx->rc_max_rate) enccfg.rc_2pass_vbr_maxsection_pct = avctx->rc_max_rate * 100LL / avctx->bit_rate; if (avctx->rc_buffer_size) enccfg.rc_buf_sz = avctx->rc_buffer_size * 1000LL / avctx->bit_rate; if (avctx->rc_initial_buffer_occupancy) enccfg.rc_buf_initial_sz = avctx->rc_initial_buffer_occupancy * 1000LL / avctx->bit_rate; enccfg.rc_buf_optimal_sz = enccfg.rc_buf_sz * 5 / 6; enccfg.rc_undershoot_pct = round(avctx->rc_buffer_aggressivity * 100); //_enc_init() will balk if kf_min_dist differs from max w/VPX_KF_AUTO if (avctx->keyint_min >= 0 && avctx->keyint_min == avctx->gop_size) enccfg.kf_min_dist = avctx->keyint_min; if (avctx->gop_size >= 0) enccfg.kf_max_dist = avctx->gop_size; if (enccfg.g_pass == VPX_RC_FIRST_PASS) enccfg.g_lag_in_frames = 0; else if (enccfg.g_pass == VPX_RC_LAST_PASS) { int decode_size; if (!avctx->stats_in) { av_log(avctx, AV_LOG_ERROR, ""No stats file for second pass\n""); return AVERROR_INVALIDDATA; ctx->twopass_stats.sz = strlen(avctx->stats_in) * 3 / 4; ctx->twopass_stats.buf = av_malloc(ctx->twopass_stats.sz); if (!ctx->twopass_stats.buf) { ""Stat buffer alloc (%zu bytes) failed\n"", ctx->twopass_stats.sz); return AVERROR(ENOMEM); decode_size = av_base64_decode(ctx->twopass_stats.buf, avctx->stats_in, ctx->twopass_stats.sz); if (decode_size < 0) { av_log(avctx, AV_LOG_ERROR, ""Stat buffer decode failed\n""); return AVERROR_INVALIDDATA; ctx->twopass_stats.sz = decode_size; enccfg.rc_twopass_stats_in = ctx->twopass_stats; /* 0-3: For non-zero values the encoder increasingly optimizes for reduced complexity playback on low powered devices at the expense of encode quality. */ if (avctx->profile != FF_PROFILE_UNKNOWN) enccfg.g_profile = avctx->profile; enccfg.g_error_resilient = ctx->error_resilient || ctx->flags & VP8F_ERROR_RESILIENT; dump_enc_cfg(avctx, &enccfg); /* Construct Encoder Context */ res = vpx_codec_enc_init(&ctx->encoder, iface, &enccfg, 0); if (res != VPX_CODEC_OK) { log_encoder_error(avctx, ""Failed to initialize encoder""); //codec control failures are currently treated only as warnings av_log(avctx, AV_LOG_DEBUG, ""vpx_codec_control\n""); if (ctx->cpu_used != INT_MIN) codecctl_int(avctx, VP8E_SET_CPUUSED, ctx->cpu_used); if (ctx->flags & VP8F_AUTO_ALT_REF) ctx->auto_alt_ref = 1; if (ctx->auto_alt_ref >= 0) codecctl_int(avctx, VP8E_SET_ENABLEAUTOALTREF, ctx->auto_alt_ref); if (ctx->arnr_max_frames >= 0) codecctl_int(avctx, VP8E_SET_ARNR_MAXFRAMES, ctx->arnr_max_frames); if (ctx->arnr_strength >= 0) codecctl_int(avctx, VP8E_SET_ARNR_STRENGTH, ctx->arnr_strength); if (ctx->arnr_type >= 0) codecctl_int(avctx, VP8E_SET_ARNR_TYPE, ctx->arnr_type); codecctl_int(avctx, VP8E_SET_NOISE_SENSITIVITY, avctx->noise_reduction); codecctl_int(avctx, VP8E_SET_TOKEN_PARTITIONS, av_log2(avctx->slices)); codecctl_int(avctx, VP8E_SET_STATIC_THRESHOLD, avctx->mb_threshold); codecctl_int(avctx, VP8E_SET_CQ_LEVEL, ctx->crf); if (ctx->max_intra_rate >= 0) codecctl_int(avctx, VP8E_SET_MAX_INTRA_BITRATE_PCT, ctx->max_intra_rate); av_log(avctx, AV_LOG_DEBUG, ""Using deadline: %d\n"", ctx->deadline); //provide dummy value to initialize wrapper, values will be updated each _encode() vpx_img_wrap(&ctx->rawimg, VPX_IMG_FMT_I420, avctx->width, avctx->height, 1, (unsigned char*)1); avctx->coded_frame = avcodec_alloc_frame(); if (!avctx->coded_frame) { av_log(avctx, AV_LOG_ERROR, ""Error allocating coded frame\n""); vp8_free(avctx); return AVERROR(ENOMEM); return 0;","Yes, it is vulnerable."645643,"static int get_metadata_size(const uint8_t *buf, int buf_size) { int metadata_last, metadata_size; const uint8_t *buf_end = buf + buf_size; buf += 4; do { ff_flac_parse_block_header(buf, &metadata_last, NULL, &metadata_size); buf += 4; if (buf + metadata_size > buf_end) { /* need more data in order to read the complete header */ return 0; } buf += metadata_size; } while (!metadata_last); return buf_size - (buf_end - buf); }","Yes, it is vulnerable."646644,"static int usbredir_handle_interrupt_data(USBRedirDevice *dev, USBPacket *p, uint8_t ep) { if (ep & USB_DIR_IN) { /* Input interrupt endpoint, buffered packet input */ struct buf_packet *intp; int status, len; if (!dev->endpoint[EP2I(ep)].interrupt_started && !dev->endpoint[EP2I(ep)].interrupt_error) { struct usb_redir_start_interrupt_receiving_header start_int = { .endpoint = ep, }; /* No id, we look at the ep when receiving a status back */ usbredirparser_send_start_interrupt_receiving(dev->parser, 0, &start_int); usbredirparser_do_write(dev->parser); DPRINTF(""interrupt recv started ep %02X\n"", ep); dev->endpoint[EP2I(ep)].interrupt_started = 1; } intp = QTAILQ_FIRST(&dev->endpoint[EP2I(ep)].bufpq); if (intp == NULL) { DPRINTF2(""interrupt-token-in ep %02X, no intp\n"", ep); /* Check interrupt_error for stream errors */ status = dev->endpoint[EP2I(ep)].interrupt_error; dev->endpoint[EP2I(ep)].interrupt_error = 0; return usbredir_handle_status(dev, status, 0); } DPRINTF(""interrupt-token-in ep %02X status %d len %d\n"", ep, intp->status, intp->len); status = intp->status; if (status != usb_redir_success) { bufp_free(dev, intp, ep); return usbredir_handle_status(dev, status, 0); } len = intp->len; if (len > p->len) { ERROR(""received int data is larger then packet ep %02X\n"", ep); bufp_free(dev, intp, ep); return USB_RET_NAK; } memcpy(p->data, intp->data, len); bufp_free(dev, intp, ep); return len; } else { /* Output interrupt endpoint, normal async operation */ AsyncURB *aurb = async_alloc(dev, p); struct usb_redir_interrupt_packet_header interrupt_packet; DPRINTF(""interrupt-out ep %02X len %d id %u\n"", ep, p->len, aurb->packet_id); interrupt_packet.endpoint = ep; interrupt_packet.length = p->len; aurb->interrupt_packet = interrupt_packet; usbredir_log_data(dev, ""interrupt data out:"", p->data, p->len); usbredirparser_send_interrupt_packet(dev->parser, aurb->packet_id, &interrupt_packet, p->data, p->len); usbredirparser_do_write(dev->parser); return USB_RET_ASYNC; } }","Yes, it is vulnerable."647645,"static av_cold int msrle_decode_init(AVCodecContext *avctx) { MsrleContext *s = avctx->priv_data; int i; s->avctx = avctx; switch (avctx->bits_per_coded_sample) { case 1: avctx->pix_fmt = AV_PIX_FMT_MONOWHITE; break; case 4: case 8: avctx->pix_fmt = AV_PIX_FMT_PAL8; break; case 24: avctx->pix_fmt = AV_PIX_FMT_BGR24; break; default: av_log(avctx, AV_LOG_ERROR, ""unsupported bits per sample\n""); return -1; } avcodec_get_frame_defaults(&s->frame); s->frame.data[0] = NULL; if (avctx->extradata_size >= AVPALETTE_SIZE) for (i = 0; i < AVPALETTE_SIZE/4; i++) s->pal[i] = 0xFF<<24 | AV_RL32(avctx->extradata+4*i); return 0; }","Yes, it is vulnerable."648646,"static void nvme_clear_ctrl(NvmeCtrl *n) { int i; for (i = 0; i < n->num_queues; i++) { if (n->sq[i] != NULL) { nvme_free_sq(n->sq[i], n); } } for (i = 0; i < n->num_queues; i++) { if (n->cq[i] != NULL) { nvme_free_cq(n->cq[i], n); } } bdrv_flush(n->conf.bs); n->bar.cc = 0; }","No, it is non-vulnerable."649647,"void r4k_helper_tlbwi(CPUMIPSState *env) { r4k_tlb_t *tlb; int idx; target_ulong VPN; uint16_t ASID; bool G, V0, D0, V1, D1; idx = (env->CP0_Index & ~0x80000000) % env->tlb->nb_tlb; tlb = &env->tlb->mmu.r4k.tlb[idx]; VPN = env->CP0_EntryHi & (TARGET_PAGE_MASK << 1); #if defined(TARGET_MIPS64) VPN &= env->SEGMask; #endif ASID = env->CP0_EntryHi & env->CP0_EntryHi_ASID_mask; G = env->CP0_EntryLo0 & env->CP0_EntryLo1 & 1; V0 = (env->CP0_EntryLo0 & 2) != 0; D0 = (env->CP0_EntryLo0 & 4) != 0; V1 = (env->CP0_EntryLo1 & 2) != 0; D1 = (env->CP0_EntryLo1 & 4) != 0; /* Discard cached TLB entries, unless tlbwi is just upgrading access permissions on the current entry. */ if (tlb->VPN != VPN || tlb->ASID != ASID || tlb->G != G || (tlb->V0 && !V0) || (tlb->D0 && !D0) || (tlb->V1 && !V1) || (tlb->D1 && !D1)) { r4k_mips_tlb_flush_extra(env, env->tlb->nb_tlb); } r4k_invalidate_tlb(env, idx, 0); r4k_fill_tlb(env, idx); }","No, it is non-vulnerable."650648,"static void an5206_init(MachineState *machine) { ram_addr_t ram_size = machine->ram_size; const char *cpu_model = machine->cpu_model; const char *kernel_filename = machine->kernel_filename; M68kCPU *cpu; CPUM68KState *env; int kernel_size; uint64_t elf_entry; hwaddr entry; MemoryRegion *address_space_mem = get_system_memory(); MemoryRegion *ram = g_new(MemoryRegion, 1); MemoryRegion *sram = g_new(MemoryRegion, 1); if (!cpu_model) { cpu_model = ""m5206""; } cpu = M68K_CPU(cpu_generic_init(TYPE_M68K_CPU, cpu_model)); env = &cpu->env; /* Initialize CPU registers. */ env->vbr = 0; /* TODO: allow changing MBAR and RAMBAR. */ env->mbar = AN5206_MBAR_ADDR | 1; env->rambar0 = AN5206_RAMBAR_ADDR | 1; /* DRAM at address zero */ memory_region_allocate_system_memory(ram, NULL, ""an5206.ram"", ram_size); memory_region_add_subregion(address_space_mem, 0, ram); /* Internal SRAM. */ memory_region_init_ram(sram, NULL, ""an5206.sram"", 512, &error_fatal); memory_region_add_subregion(address_space_mem, AN5206_RAMBAR_ADDR, sram); mcf5206_init(address_space_mem, AN5206_MBAR_ADDR, cpu); /* Load kernel. */ if (!kernel_filename) { if (qtest_enabled()) { return; } fprintf(stderr, ""Kernel image must be specified\n""); exit(1); } kernel_size = load_elf(kernel_filename, NULL, NULL, &elf_entry, NULL, NULL, 1, EM_68K, 0, 0); entry = elf_entry; if (kernel_size < 0) { kernel_size = load_uimage(kernel_filename, &entry, NULL, NULL, NULL, NULL); } if (kernel_size < 0) { kernel_size = load_image_targphys(kernel_filename, KERNEL_LOAD_ADDR, ram_size - KERNEL_LOAD_ADDR); entry = KERNEL_LOAD_ADDR; } if (kernel_size < 0) { fprintf(stderr, ""qemu: could not load kernel '%s'\n"", kernel_filename); exit(1); } env->pc = entry; }","No, it is non-vulnerable."651649,"static inline int ape_decode_value(APEContext *ctx, APERice *rice) { int x, overflow; if (ctx->fileversion < 3990) { int tmpk; overflow = range_get_symbol(ctx, counts_3970, counts_diff_3970); if (overflow == (MODEL_ELEMENTS - 1)) { tmpk = range_decode_bits(ctx, 5); overflow = 0; } else tmpk = (rice->k < 1) ? 0 : rice->k - 1; if (tmpk <= 16) x = range_decode_bits(ctx, tmpk); else { x = range_decode_bits(ctx, 16); x |= (range_decode_bits(ctx, tmpk - 16) << 16); } x += overflow << tmpk; } else { int base, pivot; pivot = rice->ksum >> 5; if (pivot == 0) pivot = 1; overflow = range_get_symbol(ctx, counts_3980, counts_diff_3980); if (overflow == (MODEL_ELEMENTS - 1)) { overflow = range_decode_bits(ctx, 16) << 16; overflow |= range_decode_bits(ctx, 16); } if (pivot < 0x10000) { base = range_decode_culfreq(ctx, pivot); range_decode_update(ctx, 1, base); } else { int base_hi = pivot, base_lo; int bbits = 0; while (base_hi & ~0xFFFF) { base_hi >>= 1; bbits++; } base_hi = range_decode_culfreq(ctx, base_hi + 1); range_decode_update(ctx, 1, base_hi); base_lo = range_decode_culfreq(ctx, 1 << bbits); range_decode_update(ctx, 1, base_lo); base = (base_hi << bbits) + base_lo; } x = base + overflow * pivot; } update_rice(rice, x); /* Convert to signed */ if (x & 1) return (x >> 1) + 1; else return -(x >> 1); }","No, it is non-vulnerable."652650,"int ffio_ensure_seekback(AVIOContext *s, int buf_size) { uint8_t *buffer; int max_buffer_size = s->max_packet_size ? s->max_packet_size : IO_BUFFER_SIZE; buf_size += s->buf_ptr - s->buffer + max_buffer_size; if (buf_size < s->buffer_size || s->seekable) return 0; av_assert0(!s->write_flag); buffer = av_malloc(buf_size); if (!buffer) return AVERROR(ENOMEM); memcpy(buffer, s->buffer, s->buffer_size); av_free(s->buffer); s->buf_ptr = buffer + (s->buf_ptr - s->buffer); s->buf_end = buffer + (s->buf_end - s->buffer); s->buffer = buffer; s->buffer_size = buf_size; return 0; }","No, it is non-vulnerable."653651,static int film_probe(AVProbeData *p) { if (AV_RB32(&p->buf[0]) != FILM_TAG) return AVPROBE_SCORE_MAX; },"Yes, it is vulnerable."654652,"static uint8_t ide_wait_clear(uint8_t flag) { QPCIDevice *dev; QPCIBar bmdma_bar, ide_bar; uint8_t data; time_t st; dev = get_pci_device(&bmdma_bar, &ide_bar); /* Wait with a 5 second timeout */ time(&st); while (true) { data = qpci_io_readb(dev, ide_bar, reg_status); if (!(data & flag)) { return data; } if (difftime(time(NULL), st) > 5.0) { break; } nsleep(400); } g_assert_not_reached(); }","Yes, it is vulnerable."655653,"static void perf_lifecycle(void) { Coroutine *coroutine; unsigned int i, max; double duration; max = 1000000; g_test_timer_start(); for (i = 0; i < max; i++) { coroutine = qemu_coroutine_create(empty_coroutine); qemu_coroutine_enter(coroutine, NULL); } duration = g_test_timer_elapsed(); g_test_message(""Lifecycle %u iterations: %f s\n"", max, duration); }","Yes, it is vulnerable."656654,"static int plot_cqt(AVFilterLink *inlink) { AVFilterContext *ctx = inlink->dst; ShowCQTContext *s = ctx->priv; AVFilterLink *outlink = ctx->outputs[0]; int fft_len = 1 << s->fft_bits; FFTSample result[VIDEO_WIDTH][4]; int x, y, ret = 0; int linesize = s->outpicref->linesize[0]; int video_scale = s->fullhd ? 2 : 1; int video_width = (VIDEO_WIDTH/2) * video_scale; int spectogram_height = (SPECTOGRAM_HEIGHT/2) * video_scale; int spectogram_start = (SPECTOGRAM_START/2) * video_scale; int font_height = (FONT_HEIGHT/2) * video_scale; /* real part contains left samples, imaginary part contains right samples */ memcpy(s->fft_result, s->fft_data, fft_len * sizeof(*s->fft_data)); av_fft_permute(s->fft_context, s->fft_result); av_fft_calc(s->fft_context, s->fft_result); s->fft_result[fft_len] = s->fft_result[0]; /* calculating cqt */ for (x = 0; x < VIDEO_WIDTH; x++) { int u; FFTComplex v = {0,0}; FFTComplex w = {0,0}; FFTComplex l, r; for (u = 0; u < s->coeffs[x].len; u++) { FFTSample value = s->coeffs[x].values[u]; int index = s->coeffs[x].start + u; v.re += value * s->fft_result[index].re; v.im += value * s->fft_result[index].im; w.re += value * s->fft_result[fft_len - index].re; w.im += value * s->fft_result[fft_len - index].im; } /* separate left and right, (and multiply by 2.0) */ l.re = v.re + w.re; l.im = v.im - w.im; r.re = w.im + v.im; r.im = w.re - v.re; /* result is power, not amplitude */ result[x][0] = l.re * l.re + l.im * l.im; result[x][2] = r.re * r.re + r.im * r.im; result[x][1] = 0.5f * (result[x][0] + result[x][2]); if (s->gamma2 == 1.0f) result[x][3] = result[x][1]; else if (s->gamma2 == 2.0f) result[x][3] = sqrtf(result[x][1]); else if (s->gamma2 == 3.0f) result[x][3] = cbrtf(result[x][1]); else if (s->gamma2 == 4.0f) result[x][3] = sqrtf(sqrtf(result[x][1])); else result[x][3] = expf(logf(result[x][1]) * (1.0f / s->gamma2)); result[x][0] = FFMIN(1.0f, result[x][0]); result[x][1] = FFMIN(1.0f, result[x][1]); result[x][2] = FFMIN(1.0f, result[x][2]); if (s->gamma == 1.0f) { result[x][0] = 255.0f * result[x][0]; result[x][1] = 255.0f * result[x][1]; result[x][2] = 255.0f * result[x][2]; } else if (s->gamma == 2.0f) { result[x][0] = 255.0f * sqrtf(result[x][0]); result[x][1] = 255.0f * sqrtf(result[x][1]); result[x][2] = 255.0f * sqrtf(result[x][2]); } else if (s->gamma == 3.0f) { result[x][0] = 255.0f * cbrtf(result[x][0]); result[x][1] = 255.0f * cbrtf(result[x][1]); result[x][2] = 255.0f * cbrtf(result[x][2]); } else if (s->gamma == 4.0f) { result[x][0] = 255.0f * sqrtf(sqrtf(result[x][0])); result[x][1] = 255.0f * sqrtf(sqrtf(result[x][1])); result[x][2] = 255.0f * sqrtf(sqrtf(result[x][2])); } else { result[x][0] = 255.0f * expf(logf(result[x][0]) * (1.0f / s->gamma)); result[x][1] = 255.0f * expf(logf(result[x][1]) * (1.0f / s->gamma)); result[x][2] = 255.0f * expf(logf(result[x][2]) * (1.0f / s->gamma)); } } if (!s->fullhd) { for (x = 0; x < video_width; x++) { result[x][0] = 0.5f * (result[2*x][0] + result[2*x+1][0]); result[x][1] = 0.5f * (result[2*x][1] + result[2*x+1][1]); result[x][2] = 0.5f * (result[2*x][2] + result[2*x+1][2]); result[x][3] = 0.5f * (result[2*x][3] + result[2*x+1][3]); } } for (x = 0; x < video_width; x++) { s->spectogram[s->spectogram_index*linesize + 3*x] = result[x][0] + 0.5f; s->spectogram[s->spectogram_index*linesize + 3*x + 1] = result[x][1] + 0.5f; s->spectogram[s->spectogram_index*linesize + 3*x + 2] = result[x][2] + 0.5f; } /* drawing */ if (!s->spectogram_count) { uint8_t *data = (uint8_t*) s->outpicref->data[0]; float rcp_result[VIDEO_WIDTH]; int total_length = linesize * spectogram_height; int back_length = linesize * s->spectogram_index; for (x = 0; x < video_width; x++) rcp_result[x] = 1.0f / (result[x][3]+0.0001f); /* drawing bar */ for (y = 0; y < spectogram_height; y++) { float height = (spectogram_height - y) * (1.0f/spectogram_height); uint8_t *lineptr = data + y * linesize; for (x = 0; x < video_width; x++) { float mul; if (result[x][3] <= height) { *lineptr++ = 0; *lineptr++ = 0; *lineptr++ = 0; } else { mul = (result[x][3] - height) * rcp_result[x]; *lineptr++ = mul * result[x][0] + 0.5f; *lineptr++ = mul * result[x][1] + 0.5f; *lineptr++ = mul * result[x][2] + 0.5f; } } } /* drawing font */ if (s->font_alpha && s->draw_text) { for (y = 0; y < font_height; y++) { uint8_t *lineptr = data + (spectogram_height + y) * linesize; uint8_t *spectogram_src = s->spectogram + s->spectogram_index * linesize; uint8_t *fontcolor_value = s->fontcolor_value; for (x = 0; x < video_width; x++) { uint8_t alpha = s->font_alpha[y*video_width+x]; lineptr[3*x] = (spectogram_src[3*x] * (255-alpha) + fontcolor_value[0] * alpha + 255) >> 8; lineptr[3*x+1] = (spectogram_src[3*x+1] * (255-alpha) + fontcolor_value[1] * alpha + 255) >> 8; lineptr[3*x+2] = (spectogram_src[3*x+2] * (255-alpha) + fontcolor_value[2] * alpha + 255) >> 8; fontcolor_value += 3; } } } else if (s->draw_text) { for (y = 0; y < font_height; y++) { uint8_t *lineptr = data + (spectogram_height + y) * linesize; memcpy(lineptr, s->spectogram + s->spectogram_index * linesize, video_width*3); } for (x = 0; x < video_width; x += video_width/10) { int u; static const char str[] = ""EF G A BC D ""; uint8_t *startptr = data + spectogram_height * linesize + x * 3; for (u = 0; str[u]; u++) { int v; for (v = 0; v < 16; v++) { uint8_t *p = startptr + v * linesize * video_scale + 8 * 3 * u * video_scale; int ux = x + 8 * u * video_scale; int mask; for (mask = 0x80; mask; mask >>= 1) { if (mask & avpriv_vga16_font[str[u] * 16 + v]) { p[0] = s->fontcolor_value[3*ux]; p[1] = s->fontcolor_value[3*ux+1]; p[2] = s->fontcolor_value[3*ux+2]; if (video_scale == 2) { p[linesize] = p[0]; p[linesize+1] = p[1]; p[linesize+2] = p[2]; p[3] = p[linesize+3] = s->fontcolor_value[3*ux+3]; p[4] = p[linesize+4] = s->fontcolor_value[3*ux+4]; p[5] = p[linesize+5] = s->fontcolor_value[3*ux+5]; } } p += 3 * video_scale; ux += video_scale; } } } } } else { for (y = 0; y < font_height; y++) { uint8_t *lineptr = data + (spectogram_height + y) * linesize; uint8_t *spectogram_src = s->spectogram + s->spectogram_index * linesize; for (x = 0; x < video_width; x++) { lineptr[3*x] = spectogram_src[3*x]; lineptr[3*x+1] = spectogram_src[3*x+1]; lineptr[3*x+2] = spectogram_src[3*x+2]; } } } /* drawing spectogram/sonogram */ data += spectogram_start * linesize; memcpy(data, s->spectogram + s->spectogram_index*linesize, total_length - back_length); data += total_length - back_length; if (back_length) memcpy(data, s->spectogram, back_length); s->outpicref->pts = s->frame_count; ret = ff_filter_frame(outlink, av_frame_clone(s->outpicref)); s->req_fullfilled = 1; s->frame_count++; } s->spectogram_count = (s->spectogram_count + 1) % s->count; s->spectogram_index = (s->spectogram_index + spectogram_height - 1) % spectogram_height; return ret; }","No, it is non-vulnerable."657655,"void do_4xx_tlbsx_ (void) { int tmp = xer_ov; T0 = ppcemb_tlb_search(env, T0, env->spr[SPR_40x_PID]); if (T0 != -1) tmp |= 0x02; env->crf[0] = tmp; }","Yes, it is vulnerable."658656,"static void decode_bol_opc(CPUTriCoreState *env, DisasContext *ctx, int32_t op1) { int r1, r2; int32_t address; TCGv temp; r1 = MASK_OP_BOL_S1D(ctx->opcode); r2 = MASK_OP_BOL_S2(ctx->opcode); address = MASK_OP_BOL_OFF16_SEXT(ctx->opcode); switch (op1) { case OPC1_32_BOL_LD_A_LONGOFF: temp = tcg_temp_new(); tcg_gen_addi_tl(temp, cpu_gpr_a[r2], address); tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LEUL); tcg_temp_free(temp); break; case OPC1_32_BOL_LD_W_LONGOFF: temp = tcg_temp_new(); tcg_gen_addi_tl(temp, cpu_gpr_a[r2], address); tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUL); tcg_temp_free(temp); break; case OPC1_32_BOL_LEA_LONGOFF: tcg_gen_addi_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], address); break; case OPC1_32_BOL_ST_A_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_st(ctx, cpu_gpr_a[r1], cpu_gpr_a[r2], address, MO_LEUL); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_ST_W_LONGOFF: gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_LEUL); break; case OPC1_32_BOL_LD_B_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_SB); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_LD_BU_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_UB); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_LD_H_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_LESW); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_LD_HU_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_LEUW); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_ST_B_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_SB); } else { /* raise illegal opcode trap */ } break; case OPC1_32_BOL_ST_H_LONGOFF: if (tricore_feature(env, TRICORE_FEATURE_16)) { gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], address, MO_LESW); } else { /* raise illegal opcode trap */ } break; } }","Yes, it is vulnerable."659657,"static void virtconsole_realize(DeviceState *dev, Error **errp) { VirtIOSerialPort *port = VIRTIO_SERIAL_PORT(dev); VirtConsole *vcon = VIRTIO_CONSOLE(dev); VirtIOSerialPortClass *k = VIRTIO_SERIAL_PORT_GET_CLASS(dev); if (port->id == 0 && !k->is_console) { error_setg(errp, ""Port number 0 on virtio-serial devices reserved "" ""for virtconsole devices for backward compatibility.""); return; } if (vcon->chr) { vcon->chr->explicit_fe_open = 1; qemu_chr_add_handlers(vcon->chr, chr_can_read, chr_read, chr_event, vcon); } }","Yes, it is vulnerable."660658,"static void pc_q35_init(MachineState *machine) { PCMachineState *pc_machine = PC_MACHINE(machine); ram_addr_t below_4g_mem_size, above_4g_mem_size; Q35PCIHost *q35_host; PCIHostState *phb; PCIBus *host_bus; PCIDevice *lpc; BusState *idebus[MAX_SATA_PORTS]; ISADevice *rtc_state; ISADevice *floppy; MemoryRegion *pci_memory; MemoryRegion *rom_memory; MemoryRegion *ram_memory; GSIState *gsi_state; ISABus *isa_bus; int pci_enabled = 1; qemu_irq *cpu_irq; qemu_irq *gsi; qemu_irq *i8259; int i; ICH9LPCState *ich9_lpc; PCIDevice *ahci; DeviceState *icc_bridge; PcGuestInfo *guest_info; ram_addr_t lowmem; /* Check whether RAM fits below 4G (leaving 1/2 GByte for IO memory * and 256 Mbytes for PCI Express Enhanced Configuration Access Mapping * also known as MMCFG). * If it doesn't, we need to split it in chunks below and above 4G. * In any case, try to make sure that guest addresses aligned at * 1G boundaries get mapped to host addresses aligned at 1G boundaries. * For old machine types, use whatever split we used historically to avoid * breaking migration. if (machine->ram_size >= 0xb0000000) { lowmem = gigabyte_align ? 0x80000000 : 0xb0000000; } else { lowmem = 0xb0000000; } /* Handle the machine opt max-ram-below-4g. It is basically doing * min(qemu limit, user limit). if (lowmem > pc_machine->max_ram_below_4g) { lowmem = pc_machine->max_ram_below_4g; if (machine->ram_size - lowmem > lowmem && lowmem & ((1ULL << 30) - 1)) { error_report(""Warning: Large machine and max_ram_below_4g(%""PRIu64 "") not a multiple of 1G; possible bad performance."", pc_machine->max_ram_below_4g); } } if (machine->ram_size >= lowmem) { above_4g_mem_size = machine->ram_size - lowmem; below_4g_mem_size = lowmem; } else { above_4g_mem_size = 0; below_4g_mem_size = machine->ram_size; } if (xen_enabled() && xen_hvm_init(&below_4g_mem_size, &above_4g_mem_size, &ram_memory) != 0) { fprintf(stderr, ""xen hardware virtual machine initialisation failed\n""); exit(1); } icc_bridge = qdev_create(NULL, TYPE_ICC_BRIDGE); object_property_add_child(qdev_get_machine(), ""icc-bridge"", OBJECT(icc_bridge), NULL); pc_cpus_init(machine->cpu_model, icc_bridge); pc_acpi_init(""q35-acpi-dsdt.aml""); kvmclock_create(); /* pci enabled */ if (pci_enabled) { pci_memory = g_new(MemoryRegion, 1); memory_region_init(pci_memory, NULL, ""pci"", UINT64_MAX); rom_memory = pci_memory; } else { pci_memory = NULL; rom_memory = get_system_memory(); } guest_info = pc_guest_info_init(below_4g_mem_size, above_4g_mem_size); guest_info->has_pci_info = has_pci_info; guest_info->isapc_ram_fw = false; guest_info->has_acpi_build = has_acpi_build; guest_info->has_reserved_memory = has_reserved_memory; if (smbios_defaults) { MachineClass *mc = MACHINE_GET_CLASS(machine); /* These values are guest ABI, do not change */ smbios_set_defaults(""QEMU"", ""Standard PC (Q35 + ICH9, 2009)"", mc->name, smbios_legacy_mode); } /* allocate ram and load rom/bios */ if (!xen_enabled()) { pc_memory_init(machine, get_system_memory(), below_4g_mem_size, above_4g_mem_size, rom_memory, &ram_memory, guest_info); } /* irq lines */ gsi_state = g_malloc0(sizeof(*gsi_state)); if (kvm_irqchip_in_kernel()) { kvm_pc_setup_irq_routing(pci_enabled); gsi = qemu_allocate_irqs(kvm_pc_gsi_handler, gsi_state, GSI_NUM_PINS); } else { gsi = qemu_allocate_irqs(gsi_handler, gsi_state, GSI_NUM_PINS); } /* create pci host bus */ q35_host = Q35_HOST_DEVICE(qdev_create(NULL, TYPE_Q35_HOST_DEVICE)); object_property_add_child(qdev_get_machine(), ""q35"", OBJECT(q35_host), NULL); q35_host->mch.ram_memory = ram_memory; q35_host->mch.pci_address_space = pci_memory; q35_host->mch.system_memory = get_system_memory(); q35_host->mch.address_space_io = get_system_io(); q35_host->mch.below_4g_mem_size = below_4g_mem_size; q35_host->mch.above_4g_mem_size = above_4g_mem_size; q35_host->mch.guest_info = guest_info; /* pci */ qdev_init_nofail(DEVICE(q35_host)); phb = PCI_HOST_BRIDGE(q35_host); host_bus = phb->bus; /* create ISA bus */ lpc = pci_create_simple_multifunction(host_bus, PCI_DEVFN(ICH9_LPC_DEV, ICH9_LPC_FUNC), true, TYPE_ICH9_LPC_DEVICE); object_property_add_link(OBJECT(machine), PC_MACHINE_ACPI_DEVICE_PROP, TYPE_HOTPLUG_HANDLER, (Object **)&pc_machine->acpi_dev, object_property_allow_set_link, OBJ_PROP_LINK_UNREF_ON_RELEASE, &error_abort); object_property_set_link(OBJECT(machine), OBJECT(lpc), PC_MACHINE_ACPI_DEVICE_PROP, &error_abort); ich9_lpc = ICH9_LPC_DEVICE(lpc); ich9_lpc->pic = gsi; ich9_lpc->ioapic = gsi_state->ioapic_irq; pci_bus_irqs(host_bus, ich9_lpc_set_irq, ich9_lpc_map_irq, ich9_lpc, ICH9_LPC_NB_PIRQS); pci_bus_set_route_irq_fn(host_bus, ich9_route_intx_pin_to_irq); isa_bus = ich9_lpc->isa_bus; /*end early*/ isa_bus_irqs(isa_bus, gsi); if (kvm_irqchip_in_kernel()) { i8259 = kvm_i8259_init(isa_bus); } else if (xen_enabled()) { i8259 = xen_interrupt_controller_init(); } else { cpu_irq = pc_allocate_cpu_irq(); i8259 = i8259_init(isa_bus, cpu_irq[0]); } for (i = 0; i < ISA_NUM_IRQS; i++) { gsi_state->i8259_irq[i] = i8259[i]; } if (pci_enabled) { ioapic_init_gsi(gsi_state, NULL); } qdev_init_nofail(icc_bridge); pc_register_ferr_irq(gsi[13]); /* init basic PC hardware */ pc_basic_device_init(isa_bus, gsi, &rtc_state, &floppy, false, 0xff0104); /* connect pm stuff to lpc */ ich9_lpc_pm_init(lpc); /* ahci and SATA device, for q35 1 ahci controller is built-in */ ahci = pci_create_simple_multifunction(host_bus, PCI_DEVFN(ICH9_SATA1_DEV, ICH9_SATA1_FUNC), true, ""ich9-ahci""); idebus[0] = qdev_get_child_bus(&ahci->qdev, ""ide.0""); idebus[1] = qdev_get_child_bus(&ahci->qdev, ""ide.1""); if (usb_enabled(false)) { /* Should we create 6 UHCI according to ich9 spec? */ ehci_create_ich9_with_companions(host_bus, 0x1d); } /* TODO: Populate SPD eeprom data. */ smbus_eeprom_init(ich9_smb_init(host_bus, PCI_DEVFN(ICH9_SMB_DEV, ICH9_SMB_FUNC), 0xb100), 8, NULL, 0); pc_cmos_init(below_4g_mem_size, above_4g_mem_size, machine->boot_order, floppy, idebus[0], idebus[1], rtc_state); /* the rest devices to which pci devfn is automatically assigned */ pc_vga_init(isa_bus, host_bus); pc_nic_init(isa_bus, host_bus); if (pci_enabled) { pc_pci_device_init(host_bus); } }","Yes, it is vulnerable."661659,"static int vpc_open(BlockDriverState *bs, QDict *options, int flags, Error **errp) { BDRVVPCState *s = bs->opaque; int i; VHDFooter *footer; VHDDynDiskHeader *dyndisk_header; uint8_t buf[HEADER_SIZE]; uint32_t checksum; int disk_type = VHD_DYNAMIC; int ret; ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE); if (ret < 0) { goto fail; } footer = (VHDFooter *) s->footer_buf; if (strncmp(footer->creator, ""conectix"", 8)) { int64_t offset = bdrv_getlength(bs->file); if (offset < 0) { ret = offset; goto fail; } else if (offset < HEADER_SIZE) { ret = -EINVAL; goto fail; } /* If a fixed disk, the footer is found only at the end of the file */ ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf, HEADER_SIZE); if (ret < 0) { goto fail; } if (strncmp(footer->creator, ""conectix"", 8)) { error_setg(errp, ""invalid VPC image""); ret = -EINVAL; goto fail; } disk_type = VHD_FIXED; } checksum = be32_to_cpu(footer->checksum); footer->checksum = 0; if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum) fprintf(stderr, ""block-vpc: The header checksum of '%s' is "" ""incorrect.\n"", bs->filename); /* Write 'checksum' back to footer, or else will leave it with zero. */ footer->checksum = be32_to_cpu(checksum); // The visible size of a image in Virtual PC depends on the geometry // rather than on the size stored in the footer (the size in the footer // is too large usually) bs->total_sectors = (int64_t) be16_to_cpu(footer->cyls) * footer->heads * footer->secs_per_cyl; /* images created with disk2vhd report a far higher virtual size * than expected with the cyls * heads * sectors_per_cyl formula. * use the footer->size instead if the image was created with * disk2vhd. */ if (!strncmp(footer->creator_app, ""d2v"", 4)) { bs->total_sectors = be64_to_cpu(footer->size) / BDRV_SECTOR_SIZE; } /* Allow a maximum disk size of approximately 2 TB */ if (bs->total_sectors >= 65535LL * 255 * 255) { ret = -EFBIG; goto fail; } if (disk_type == VHD_DYNAMIC) { ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf, HEADER_SIZE); if (ret < 0) { goto fail; } dyndisk_header = (VHDDynDiskHeader *) buf; if (strncmp(dyndisk_header->magic, ""cxsparse"", 8)) { ret = -EINVAL; goto fail; } s->block_size = be32_to_cpu(dyndisk_header->block_size); s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511; s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries); s->pagetable = g_malloc(s->max_table_entries * 4); s->bat_offset = be64_to_cpu(dyndisk_header->table_offset); ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable, s->max_table_entries * 4); if (ret < 0) { goto fail; } s->free_data_block_offset = (s->bat_offset + (s->max_table_entries * 4) + 511) & ~511; for (i = 0; i < s->max_table_entries; i++) { be32_to_cpus(&s->pagetable[i]); if (s->pagetable[i] != 0xFFFFFFFF) { int64_t next = (512 * (int64_t) s->pagetable[i]) + s->bitmap_size + s->block_size; if (next > s->free_data_block_offset) { s->free_data_block_offset = next; } } } if (s->free_data_block_offset > bdrv_getlength(bs->file)) { error_setg(errp, ""block-vpc: free_data_block_offset points after "" ""the end of file. The image has been truncated.""); ret = -EINVAL; goto fail; } s->last_bitmap_offset = (int64_t) -1; #ifdef CACHE s->pageentry_u8 = g_malloc(512); s->pageentry_u32 = s->pageentry_u8; s->pageentry_u16 = s->pageentry_u8; s->last_pagetable = -1; #endif } qemu_co_mutex_init(&s->lock); /* Disable migration when VHD images are used */ error_set(&s->migration_blocker, QERR_BLOCK_FORMAT_FEATURE_NOT_SUPPORTED, ""vpc"", bs->device_name, ""live migration""); migrate_add_blocker(s->migration_blocker); return 0; fail: g_free(s->pagetable); #ifdef CACHE g_free(s->pageentry_u8); #endif return ret; }","Yes, it is vulnerable."662660,"void helper_done(CPUSPARCState *env) { trap_state *tsptr = cpu_tsptr(env); env->pc = tsptr->tnpc; env->npc = tsptr->tnpc + 4; cpu_put_ccr(env, tsptr->tstate >> 32); env->asi = (tsptr->tstate >> 24) & 0xff; cpu_change_pstate(env, (tsptr->tstate >> 8) & 0xf3f); cpu_put_cwp64(env, tsptr->tstate & 0xff); if (cpu_has_hypervisor(env)) { uint32_t new_gl = (tsptr->tstate >> 40) & 7; env->hpstate = env->htstate[env->tl]; cpu_gl_switch_gregs(env, new_gl); env->gl = new_gl; } env->tl--; trace_win_helper_done(env->tl); #if !defined(CONFIG_USER_ONLY) if (cpu_interrupts_enabled(env)) { cpu_check_irqs(env); } #endif }","Yes, it is vulnerable."663661,"void CALLBACK host_alarm_handler(UINT uTimerID, UINT uMsg, DWORD_PTR dwUser, DWORD_PTR dw1, DWORD_PTR dw2) #else static void host_alarm_handler(int host_signum) #endif { #if 0 #define DISP_FREQ 1000 { static int64_t delta_min = INT64_MAX; static int64_t delta_max, delta_cum, last_clock, delta, ti; static int count; ti = qemu_get_clock(vm_clock); if (last_clock != 0) { delta = ti - last_clock; if (delta < delta_min) delta_min = delta; if (delta > delta_max) delta_max = delta; delta_cum += delta; if (++count == DISP_FREQ) { printf(""timer: min=%"" PRId64 "" us max=%"" PRId64 "" us avg=%"" PRId64 "" us avg_freq=%0.3f Hz\n"", muldiv64(delta_min, 1000000, ticks_per_sec), muldiv64(delta_max, 1000000, ticks_per_sec), muldiv64(delta_cum, 1000000 / DISP_FREQ, ticks_per_sec), (double)ticks_per_sec / ((double)delta_cum / DISP_FREQ)); count = 0; delta_min = INT64_MAX; delta_max = 0; delta_cum = 0; } } last_clock = ti; } #endif if (alarm_has_dynticks(alarm_timer) || qemu_timer_expired(active_timers[QEMU_TIMER_VIRTUAL], qemu_get_clock(vm_clock)) || qemu_timer_expired(active_timers[QEMU_TIMER_REALTIME], qemu_get_clock(rt_clock))) { #ifdef _WIN32 struct qemu_alarm_win32 *data = ((struct qemu_alarm_timer*)dwUser)->priv; SetEvent(data->host_alarm); #endif CPUState *env = next_cpu; /* stop the currently executing cpu because a timer occured */ cpu_interrupt(env, CPU_INTERRUPT_EXIT); #ifdef USE_KQEMU if (env->kqemu_enabled) { kqemu_cpu_interrupt(env); } #endif event_pending = 1; } }","Yes, it is vulnerable."664662,"static void tqi_calculate_qtable(TqiContext *t, int quant) { const int qscale = (215 - 2*quant)*5; int i; t->intra_matrix[0] = (ff_inv_aanscales[0] * ff_mpeg1_default_intra_matrix[0]) >> 11; for(i=1; i<64; i++) t->intra_matrix[i] = (ff_inv_aanscales[i] * ff_mpeg1_default_intra_matrix[i] * qscale + 32) >> 14; }","Yes, it is vulnerable."665663,"static void free_input_threads(void) { int i; if (nb_input_files == 1) return; transcoding_finished = 1; for (i = 0; i < nb_input_files; i++) { InputFile *f = input_files[i]; AVPacket pkt; if (f->joined) continue; pthread_mutex_lock(&f->fifo_lock); while (av_fifo_size(f->fifo)) { av_fifo_generic_read(f->fifo, &pkt, sizeof(pkt), NULL); av_free_packet(&pkt); } pthread_cond_signal(&f->fifo_cond); pthread_mutex_unlock(&f->fifo_lock); pthread_join(f->thread, NULL); f->joined = 1; while (av_fifo_size(f->fifo)) { av_fifo_generic_read(f->fifo, &pkt, sizeof(pkt), NULL); av_free_packet(&pkt); } av_fifo_free(f->fifo); } }","No, it is non-vulnerable."666664,"static void tcp_chr_disconnect(CharDriverState *chr) { TCPCharDriver *s = chr->opaque; if (!s->connected) { return; } s->connected = 0; if (s->listen_ioc) { s->listen_tag = qio_channel_add_watch( QIO_CHANNEL(s->listen_ioc), G_IO_IN, tcp_chr_accept, chr, NULL); } tcp_set_msgfds(chr, NULL, 0); remove_fd_in_watch(chr); object_unref(OBJECT(s->sioc)); s->sioc = NULL; object_unref(OBJECT(s->ioc)); s->ioc = NULL; g_free(chr->filename); chr->filename = SocketAddress_to_str(""disconnected:"", s->addr, s->is_listen, s->is_telnet); qemu_chr_be_event(chr, CHR_EVENT_CLOSED); if (s->reconnect_time) { qemu_chr_socket_restart_timer(chr); } }","Yes, it is vulnerable."667665,static inline void menelaus_rtc_stop(MenelausState *s) { qemu_del_timer(s->rtc.hz_tm); s->rtc.next -= qemu_get_clock(rt_clock); if (s->rtc.next < 1) s->rtc.next = 1; },"No, it is non-vulnerable."668666,"int ide_get_geometry(BusState *bus, int unit, int16_t *cyls, int8_t *heads, int8_t *secs) { IDEState *s = &DO_UPCAST(IDEBus, qbus, bus)->ifs[unit]; if (s->drive_kind != IDE_HD || !s->bs) { return -1; } *cyls = s->cylinders; *heads = s->heads; *secs = s->sectors; return 0; }","No, it is non-vulnerable."669667,"static int vc1_decode_p_block(VC1Context *v, DCTELEM block[64], int n, int mquant, int ttmb, int first_block, uint8_t *dst, int linesize, int skip_block, int apply_filter, int cbp_top, int cbp_left) { MpegEncContext *s = &v->s; GetBitContext *gb = &s->gb; int i, j; int subblkpat = 0; int scale, off, idx, last, skip, value; int ttblk = ttmb & 7; int pat = 0; if(ttmb == -1) { ttblk = ff_vc1_ttblk_to_tt[v->tt_index][get_vlc2(gb, ff_vc1_ttblk_vlc[v->tt_index].table, VC1_TTBLK_VLC_BITS, 1)]; } if(ttblk == TT_4X4) { subblkpat = ~(get_vlc2(gb, ff_vc1_subblkpat_vlc[v->tt_index].table, VC1_SUBBLKPAT_VLC_BITS, 1) + 1); } if((ttblk != TT_8X8 && ttblk != TT_4X4) && (v->ttmbf || (ttmb != -1 && (ttmb & 8) && !first_block))) { subblkpat = decode012(gb); if(subblkpat) subblkpat ^= 3; //swap decoded pattern bits if(ttblk == TT_8X4_TOP || ttblk == TT_8X4_BOTTOM) ttblk = TT_8X4; if(ttblk == TT_4X8_RIGHT || ttblk == TT_4X8_LEFT) ttblk = TT_4X8; } scale = 2 * mquant + ((v->pq == mquant) ? v->halfpq : 0); // convert transforms like 8X4_TOP to generic TT and SUBBLKPAT if(ttblk == TT_8X4_TOP || ttblk == TT_8X4_BOTTOM) { subblkpat = 2 - (ttblk == TT_8X4_TOP); ttblk = TT_8X4; } if(ttblk == TT_4X8_RIGHT || ttblk == TT_4X8_LEFT) { subblkpat = 2 - (ttblk == TT_4X8_LEFT); ttblk = TT_4X8; } switch(ttblk) { case TT_8X8: pat = 0xF; i = 0; last = 0; while (!last) { vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); i += skip; if(i > 63) break; idx = wmv1_scantable[0][i++]; block[idx] = value * scale; if(!v->pquantizer) block[idx] += (block[idx] < 0) ? -mquant : mquant; } if(!skip_block){ s->dsp.vc1_inv_trans_8x8(block); s->dsp.add_pixels_clamped(block, dst, linesize); if(apply_filter && cbp_top & 0xC) vc1_loop_filter(dst, 1, linesize, 8, mquant); if(apply_filter && cbp_left & 0xA) vc1_loop_filter(dst, linesize, 1, 8, mquant); } break; case TT_4X4: pat = ~subblkpat & 0xF; for(j = 0; j < 4; j++) { last = subblkpat & (1 << (3 - j)); i = 0; off = (j & 1) * 4 + (j & 2) * 16; while (!last) { vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); i += skip; if(i > 15) break; idx = ff_vc1_simple_progressive_4x4_zz[i++]; block[idx + off] = value * scale; if(!v->pquantizer) block[idx + off] += (block[idx + off] < 0) ? -mquant : mquant; } if(!(subblkpat & (1 << (3 - j))) && !skip_block){ s->dsp.vc1_inv_trans_4x4(dst + (j&1)*4 + (j&2)*2*linesize, linesize, block + off); if(apply_filter && (j&2 ? pat & (1<<(j-2)) : (cbp_top & (1 << (j + 2))))) vc1_loop_filter(dst + (j&1)*4 + (j&2)*2*linesize, 1, linesize, 4, mquant); if(apply_filter && (j&1 ? pat & (1<<(j-1)) : (cbp_left & (1 << (j + 1))))) vc1_loop_filter(dst + (j&1)*4 + (j&2)*2*linesize, linesize, 1, 4, mquant); } } break; case TT_8X4: pat = ~((subblkpat & 2)*6 + (subblkpat & 1)*3) & 0xF; for(j = 0; j < 2; j++) { last = subblkpat & (1 << (1 - j)); i = 0; off = j * 32; while (!last) { vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); i += skip; if(i > 31) break; idx = v->zz_8x4[i++]+off; block[idx] = value * scale; if(!v->pquantizer) block[idx] += (block[idx] < 0) ? -mquant : mquant; } if(!(subblkpat & (1 << (1 - j))) && !skip_block){ s->dsp.vc1_inv_trans_8x4(dst + j*4*linesize, linesize, block + off); if(apply_filter && j ? pat & 0x3 : (cbp_top & 0xC)) vc1_loop_filter(dst + j*4*linesize, 1, linesize, 8, mquant); if(apply_filter && cbp_left & (2 << j)) vc1_loop_filter(dst + j*4*linesize, linesize, 1, 4, mquant); } } break; case TT_4X8: pat = ~(subblkpat*5) & 0xF; for(j = 0; j < 2; j++) { last = subblkpat & (1 << (1 - j)); i = 0; off = j * 4; while (!last) { vc1_decode_ac_coeff(v, &last, &skip, &value, v->codingset2); i += skip; if(i > 31) break; idx = v->zz_4x8[i++]+off; block[idx] = value * scale; if(!v->pquantizer) block[idx] += (block[idx] < 0) ? -mquant : mquant; } if(!(subblkpat & (1 << (1 - j))) && !skip_block){ s->dsp.vc1_inv_trans_4x8(dst + j*4, linesize, block + off); if(apply_filter && cbp_top & (2 << j)) vc1_loop_filter(dst + j*4, 1, linesize, 4, mquant); if(apply_filter && j ? pat & 0x5 : (cbp_left & 0xA)) vc1_loop_filter(dst + j*4, linesize, 1, 8, mquant); } } break; } return pat; }","No, it is non-vulnerable."670668,"static void gen_dcread(DisasContext *ctx) { #if defined(CONFIG_USER_ONLY) gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC); #else TCGv EA, val; if (unlikely(ctx->pr)) { gen_inval_exception(ctx, POWERPC_EXCP_PRIV_OPC); return; } gen_set_access_type(ctx, ACCESS_CACHE); EA = tcg_temp_new(); gen_addr_reg_index(ctx, EA); val = tcg_temp_new(); gen_qemu_ld32u(ctx, val, EA); tcg_temp_free(val); tcg_gen_mov_tl(cpu_gpr[rD(ctx->opcode)], EA); tcg_temp_free(EA); #endif }","Yes, it is vulnerable."671669,"uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs, uint64_t offset, int compressed_size) { BDRVQcowState *s = bs->opaque; int l2_index, ret; uint64_t *l2_table; int64_t cluster_offset; int nb_csectors; ret = get_cluster_table(bs, offset, &l2_table, &l2_index); if (ret < 0) { return 0; } cluster_offset = be64_to_cpu(l2_table[l2_index]); if (cluster_offset & QCOW_OFLAG_COPIED) { qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); return 0; } if (cluster_offset) qcow2_free_any_clusters(bs, cluster_offset, 1); cluster_offset = qcow2_alloc_bytes(bs, compressed_size); if (cluster_offset < 0) { qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); return 0; } nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) - (cluster_offset >> 9); cluster_offset |= QCOW_OFLAG_COMPRESSED | ((uint64_t)nb_csectors << s->csize_shift); /* update L2 table */ /* compressed clusters never have the copied flag */ BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED); qcow2_cache_entry_mark_dirty(s->l2_table_cache, l2_table); l2_table[l2_index] = cpu_to_be64(cluster_offset); ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); if (ret < 0) { return 0; } return cluster_offset; }","Yes, it is vulnerable."672670,"static int ac3_eac3_probe(AVProbeData *p, enum AVCodecID expected_codec_id) { int max_frames, first_frames = 0, frames; uint8_t *buf, *buf2, *end; AC3HeaderInfo hdr; GetBitContext gbc; enum AVCodecID codec_id = AV_CODEC_ID_AC3; max_frames = 0; buf = p->buf; end = buf + p->buf_size; for(; buf < end; buf++) { if(buf > p->buf && !(buf[0] == 0x0B && buf[1] == 0x77) && !(buf[0] == 0x77 && buf[1] == 0x0B) ) continue; buf2 = buf; for(frames = 0; buf2 < end; frames++) { uint8_t buf3[4096]; int i; if(!memcmp(buf2, ""\x1\x10\0\0\0\0\0\0"", 8)) buf2+=16; if (buf[0] == 0x77 && buf[1] == 0x0B) { for(i=0; i<8; i+=2) { buf3[i ] = buf[i+1]; buf3[i+1] = buf[i ]; } init_get_bits(&gbc, buf3, 54); }else init_get_bits(&gbc, buf2, 54); if(avpriv_ac3_parse_header(&gbc, &hdr) < 0) break; if(buf2 + hdr.frame_size > end) break; if (buf[0] == 0x77 && buf[1] == 0x0B) { av_assert0(hdr.frame_size <= sizeof(buf3)); for(; i<hdr.frame_size; i+=2) { buf3[i ] = buf[i+1]; buf3[i+1] = buf[i ]; } } if(av_crc(av_crc_get_table(AV_CRC_16_ANSI), 0, gbc.buffer + 2, hdr.frame_size - 2)) break; if (hdr.bitstream_id > 10) codec_id = AV_CODEC_ID_EAC3; buf2 += hdr.frame_size; } max_frames = FFMAX(max_frames, frames); if(buf == p->buf) first_frames = frames; } if(codec_id != expected_codec_id) return 0; // keep this in sync with mp3 probe, both need to avoid // issues with MPEG-files! if (first_frames>=4) return AVPROBE_SCORE_MAX/2+1; else if(max_frames>200)return AVPROBE_SCORE_MAX/2; else if(max_frames>=4) return AVPROBE_SCORE_MAX/4; else if(max_frames>=1) return 1; else return 0; }","Yes, it is vulnerable."673671,"static int asf_read_frame_header(AVFormatContext *s, AVIOContext *pb){ ASFContext *asf = s->priv_data; int rsize = 1; int num = avio_r8(pb); int64_t ts0, ts1; asf->packet_segments--; asf->packet_key_frame = num >> 7; asf->stream_index = asf->asfid2avid[num & 0x7f]; // sequence should be ignored! DO_2BITS(asf->packet_property >> 4, asf->packet_seq, 0); DO_2BITS(asf->packet_property >> 2, asf->packet_frag_offset, 0); DO_2BITS(asf->packet_property, asf->packet_replic_size, 0); //printf(""key:%d stream:%d seq:%d offset:%d replic_size:%d\n"", asf->packet_key_frame, asf->stream_index, asf->packet_seq, //asf->packet_frag_offset, asf->packet_replic_size); if (asf->packet_replic_size >= 8) { asf->packet_obj_size = avio_rl32(pb); if(asf->packet_obj_size >= (1<<24) || asf->packet_obj_size <= 0){ av_log(s, AV_LOG_ERROR, ""packet_obj_size invalid\n""); asf->packet_frag_timestamp = avio_rl32(pb); // timestamp if(asf->packet_replic_size >= 8+38+4){ // for(i=0; i<asf->packet_replic_size-8; i++) // av_log(s, AV_LOG_DEBUG, ""%02X "",avio_r8(pb)); // av_log(s, AV_LOG_DEBUG, ""\n""); avio_skip(pb, 10); ts0= avio_rl64(pb); ts1= avio_rl64(pb); avio_skip(pb, 12); avio_rl32(pb); avio_skip(pb, asf->packet_replic_size - 8 - 38 - 4); if(ts0!= -1) asf->packet_frag_timestamp= ts0/10000; else asf->packet_frag_timestamp= AV_NOPTS_VALUE; }else avio_skip(pb, asf->packet_replic_size - 8); rsize += asf->packet_replic_size; // FIXME - check validity } else if (asf->packet_replic_size==1){ // multipacket - frag_offset is beginning timestamp asf->packet_time_start = asf->packet_frag_offset; asf->packet_frag_offset = 0; asf->packet_frag_timestamp = asf->packet_timestamp; asf->packet_time_delta = avio_r8(pb); rsize++; }else if(asf->packet_replic_size!=0){ av_log(s, AV_LOG_ERROR, ""unexpected packet_replic_size of %d\n"", asf->packet_replic_size); if (asf->packet_flags & 0x01) { DO_2BITS(asf->packet_segsizetype >> 6, asf->packet_frag_size, 0); // 0 is illegal if(asf->packet_frag_size > asf->packet_size_left - rsize){ if (asf->packet_frag_size > asf->packet_size_left - rsize + asf->packet_padsize) { av_log(s, AV_LOG_ERROR, ""packet_frag_size is invalid (%d-%d)\n"", asf->packet_size_left, rsize); } else { int diff = asf->packet_frag_size - (asf->packet_size_left - rsize); asf->packet_size_left += diff; asf->packet_padsize -= diff; //printf(""Fragsize %d\n"", asf->packet_frag_size); } else { asf->packet_frag_size = asf->packet_size_left - rsize; //printf(""Using rest %d %d %d\n"", asf->packet_frag_size, asf->packet_size_left, rsize); if (asf->packet_replic_size == 1) { asf->packet_multi_size = asf->packet_frag_size; if (asf->packet_multi_size > asf->packet_size_left) asf->packet_size_left -= rsize; //printf(""___objsize____ %d %d rs:%d\n"", asf->packet_obj_size, asf->packet_frag_offset, rsize); return 0;","Yes, it is vulnerable."674672,"static void mp_decode_line(MotionPixelsContext *mp, GetBitContext *gb, int y) { YuvPixel p; const int y0 = y * mp->avctx->width; int w, i, x = 0; p = mp->vpt[y]; if (mp->changes_map[y0 + x] == 0) { memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale)); ++x; } while (x < mp->avctx->width) { w = mp->changes_map[y0 + x]; if (w != 0) { if ((y & 3) == 0) { if (mp->changes_map[y0 + x + mp->avctx->width] < w || mp->changes_map[y0 + x + mp->avctx->width * 2] < w || mp->changes_map[y0 + x + mp->avctx->width * 3] < w) { for (i = (x + 3) & ~3; i < x + w; i += 4) { mp->hpt[((y / 4) * mp->avctx->width + i) / 4] = mp_get_yuv_from_rgb(mp, i, y); } } } x += w; memset(mp->gradient_scale, 1, sizeof(mp->gradient_scale)); p = mp_get_yuv_from_rgb(mp, x - 1, y); } else { p.y += mp_gradient(mp, 0, mp_get_vlc(mp, gb)); if ((x & 3) == 0) { if ((y & 3) == 0) { p.v += mp_gradient(mp, 1, mp_get_vlc(mp, gb)); p.u += mp_gradient(mp, 2, mp_get_vlc(mp, gb)); mp->hpt[((y / 4) * mp->avctx->width + x) / 4] = p; } else { p.v = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].v; p.u = mp->hpt[((y / 4) * mp->avctx->width + x) / 4].u; } } mp_set_rgb_from_yuv(mp, x, y, &p); ++x; } } }","Yes, it is vulnerable."675673,"int fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value) { uint64_t *copy; copy = g_malloc(sizeof(value)); *copy = cpu_to_le64(value); return fw_cfg_add_bytes(s, key, (uint8_t *)copy, sizeof(value)); }","Yes, it is vulnerable."676674,"void avcodec_string(char *buf, int buf_size, AVCodecContext *enc, int encode) { const char *codec_type; const char *codec_name; const char *profile = NULL; const AVCodec *p; int64_t bitrate; int new_line = 0; AVRational display_aspect_ratio; const char *separator = enc->dump_separator ? (const char *)enc->dump_separator : "", ""; if (!buf || buf_size <= 0) return; codec_type = av_get_media_type_string(enc->codec_type); codec_name = avcodec_get_name(enc->codec_id); if (enc->profile != FF_PROFILE_UNKNOWN) { if (enc->codec) p = enc->codec; else p = encode ? avcodec_find_encoder(enc->codec_id) : avcodec_find_decoder(enc->codec_id); if (p) profile = av_get_profile_name(p, enc->profile); } snprintf(buf, buf_size, ""%s: %s"", codec_type ? codec_type : ""unknown"", codec_name); buf[0] ^= 'a' ^ 'A'; /* first letter in uppercase */ if (enc->codec && strcmp(enc->codec->name, codec_name)) snprintf(buf + strlen(buf), buf_size - strlen(buf), "" (%s)"", enc->codec->name); if (profile) snprintf(buf + strlen(buf), buf_size - strlen(buf), "" (%s)"", profile); if ( enc->codec_type == AVMEDIA_TYPE_VIDEO && av_log_get_level() >= AV_LOG_VERBOSE && enc->refs) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %d reference frame%s"", enc->refs, enc->refs > 1 ? ""s"" : """"); if (enc->codec_tag) { char tag_buf[32]; av_get_codec_tag_string(tag_buf, sizeof(tag_buf), enc->codec_tag); snprintf(buf + strlen(buf), buf_size - strlen(buf), "" (%s / 0x%04X)"", tag_buf, enc->codec_tag); } switch (enc->codec_type) { case AVMEDIA_TYPE_VIDEO: { char detail[256] = ""(""; av_strlcat(buf, separator, buf_size); snprintf(buf + strlen(buf), buf_size - strlen(buf), ""%s"", enc->pix_fmt == AV_PIX_FMT_NONE ? ""none"" : av_get_pix_fmt_name(enc->pix_fmt)); if (enc->bits_per_raw_sample && enc->pix_fmt != AV_PIX_FMT_NONE && enc->bits_per_raw_sample < av_pix_fmt_desc_get(enc->pix_fmt)->comp[0].depth) av_strlcatf(detail, sizeof(detail), ""%d bpc, "", enc->bits_per_raw_sample); if (enc->color_range != AVCOL_RANGE_UNSPECIFIED) av_strlcatf(detail, sizeof(detail), ""%s, "", av_color_range_name(enc->color_range)); if (enc->colorspace != AVCOL_SPC_UNSPECIFIED || enc->color_primaries != AVCOL_PRI_UNSPECIFIED || enc->color_trc != AVCOL_TRC_UNSPECIFIED) { if (enc->colorspace != (int)enc->color_primaries || enc->colorspace != (int)enc->color_trc) { new_line = 1; av_strlcatf(detail, sizeof(detail), ""%s/%s/%s, "", av_color_space_name(enc->colorspace), av_color_primaries_name(enc->color_primaries), av_color_transfer_name(enc->color_trc)); } else av_strlcatf(detail, sizeof(detail), ""%s, "", av_get_colorspace_name(enc->colorspace)); } if (av_log_get_level() >= AV_LOG_DEBUG && enc->chroma_sample_location != AVCHROMA_LOC_UNSPECIFIED) av_strlcatf(detail, sizeof(detail), ""%s, "", av_chroma_location_name(enc->chroma_sample_location)); if (strlen(detail) > 1) { detail[strlen(detail) - 2] = 0; av_strlcatf(buf, buf_size, ""%s)"", detail); } } if (enc->width) { av_strlcat(buf, new_line ? separator : "", "", buf_size); snprintf(buf + strlen(buf), buf_size - strlen(buf), ""%dx%d"", enc->width, enc->height); if (av_log_get_level() >= AV_LOG_VERBOSE && (enc->width != enc->coded_width || enc->height != enc->coded_height)) snprintf(buf + strlen(buf), buf_size - strlen(buf), "" (%dx%d)"", enc->coded_width, enc->coded_height); if (enc->sample_aspect_ratio.num) { av_reduce(&display_aspect_ratio.num, &display_aspect_ratio.den, enc->width * enc->sample_aspect_ratio.num, enc->height * enc->sample_aspect_ratio.den, 1024 * 1024); snprintf(buf + strlen(buf), buf_size - strlen(buf), "" [SAR %d:%d DAR %d:%d]"", enc->sample_aspect_ratio.num, enc->sample_aspect_ratio.den, display_aspect_ratio.num, display_aspect_ratio.den); } if (av_log_get_level() >= AV_LOG_DEBUG) { int g = av_gcd(enc->time_base.num, enc->time_base.den); snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %d/%d"", enc->time_base.num / g, enc->time_base.den / g); } } if (encode) { snprintf(buf + strlen(buf), buf_size - strlen(buf), "", q=%d-%d"", enc->qmin, enc->qmax); } else { if (enc->properties & FF_CODEC_PROPERTY_CLOSED_CAPTIONS) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", Closed Captions""); if (enc->properties & FF_CODEC_PROPERTY_LOSSLESS) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", lossless""); } break; case AVMEDIA_TYPE_AUDIO: av_strlcat(buf, separator, buf_size); if (enc->sample_rate) { snprintf(buf + strlen(buf), buf_size - strlen(buf), ""%d Hz, "", enc->sample_rate); } av_get_channel_layout_string(buf + strlen(buf), buf_size - strlen(buf), enc->channels, enc->channel_layout); if (enc->sample_fmt != AV_SAMPLE_FMT_NONE) { snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %s"", av_get_sample_fmt_name(enc->sample_fmt)); } if ( enc->bits_per_raw_sample > 0 && enc->bits_per_raw_sample != av_get_bytes_per_sample(enc->sample_fmt) * 8) snprintf(buf + strlen(buf), buf_size - strlen(buf), "" (%d bit)"", enc->bits_per_raw_sample); break; case AVMEDIA_TYPE_DATA: if (av_log_get_level() >= AV_LOG_DEBUG) { int g = av_gcd(enc->time_base.num, enc->time_base.den); if (g) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %d/%d"", enc->time_base.num / g, enc->time_base.den / g); } break; case AVMEDIA_TYPE_SUBTITLE: if (enc->width) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %dx%d"", enc->width, enc->height); break; default: return; } if (encode) { if (enc->flags & AV_CODEC_FLAG_PASS1) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", pass 1""); if (enc->flags & AV_CODEC_FLAG_PASS2) snprintf(buf + strlen(buf), buf_size - strlen(buf), "", pass 2""); } bitrate = get_bit_rate(enc); if (bitrate != 0) { snprintf(buf + strlen(buf), buf_size - strlen(buf), "", %""PRId64"" kb/s"", bitrate / 1000); } else if (enc->rc_max_rate > 0) { snprintf(buf + strlen(buf), buf_size - strlen(buf), "", max. %""PRId64"" kb/s"", (int64_t)enc->rc_max_rate / 1000); } }","Yes, it is vulnerable."677675,"static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeCmd *cmd) { NvmeDeleteQ *c = (NvmeDeleteQ *)cmd; NvmeRequest *req, *next; NvmeSQueue *sq; NvmeCQueue *cq; uint16_t qid = le16_to_cpu(c->qid); if (!qid || nvme_check_sqid(n, qid)) { return NVME_INVALID_QID | NVME_DNR; } sq = n->sq[qid]; while (!QTAILQ_EMPTY(&sq->out_req_list)) { req = QTAILQ_FIRST(&sq->out_req_list); assert(req->aiocb); bdrv_aio_cancel(req->aiocb); } if (!nvme_check_cqid(n, sq->cqid)) { cq = n->cq[sq->cqid]; QTAILQ_REMOVE(&cq->sq_list, sq, entry); nvme_post_cqes(cq); QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) { if (req->sq == sq) { QTAILQ_REMOVE(&cq->req_list, req, entry); QTAILQ_INSERT_TAIL(&sq->req_list, req, entry); } } } nvme_free_sq(sq, n); return NVME_SUCCESS; }","No, it is non-vulnerable."678676,"static void qmp_query_auth(VncDisplay *vd, VncInfo2 *info) { switch (vd->auth) { case VNC_AUTH_VNC: info->auth = VNC_PRIMARY_AUTH_VNC; break; case VNC_AUTH_RA2: info->auth = VNC_PRIMARY_AUTH_RA2; break; case VNC_AUTH_RA2NE: info->auth = VNC_PRIMARY_AUTH_RA2NE; break; case VNC_AUTH_TIGHT: info->auth = VNC_PRIMARY_AUTH_TIGHT; break; case VNC_AUTH_ULTRA: info->auth = VNC_PRIMARY_AUTH_ULTRA; break; case VNC_AUTH_TLS: info->auth = VNC_PRIMARY_AUTH_TLS; break; case VNC_AUTH_VENCRYPT: info->auth = VNC_PRIMARY_AUTH_VENCRYPT; info->has_vencrypt = true; switch (vd->subauth) { case VNC_AUTH_VENCRYPT_PLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSNONE: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_NONE; break; case VNC_AUTH_VENCRYPT_TLSVNC: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_VNC; break; case VNC_AUTH_VENCRYPT_TLSPLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_PLAIN; break; case VNC_AUTH_VENCRYPT_X509NONE: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_NONE; break; case VNC_AUTH_VENCRYPT_X509VNC: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_VNC; break; case VNC_AUTH_VENCRYPT_X509PLAIN: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_PLAIN; break; case VNC_AUTH_VENCRYPT_TLSSASL: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_TLS_SASL; break; case VNC_AUTH_VENCRYPT_X509SASL: info->vencrypt = VNC_VENCRYPT_SUB_AUTH_X509_SASL; break; default: info->has_vencrypt = false; break; } break; case VNC_AUTH_SASL: info->auth = VNC_PRIMARY_AUTH_SASL; break; case VNC_AUTH_NONE: default: info->auth = VNC_PRIMARY_AUTH_NONE; break; } }","No, it is non-vulnerable."679677,"static inline void gen_op_multiply(TCGv dst, TCGv src1, TCGv src2, int sign_ext) { TCGv_i32 r_src1, r_src2; TCGv_i64 r_temp, r_temp2; r_src1 = tcg_temp_new_i32(); r_src2 = tcg_temp_new_i32(); tcg_gen_trunc_tl_i32(r_src1, src1); tcg_gen_trunc_tl_i32(r_src2, src2); r_temp = tcg_temp_new_i64(); r_temp2 = tcg_temp_new_i64(); if (sign_ext) { tcg_gen_ext_i32_i64(r_temp, r_src2); tcg_gen_ext_i32_i64(r_temp2, r_src1); } else { tcg_gen_extu_i32_i64(r_temp, r_src2); tcg_gen_extu_i32_i64(r_temp2, r_src1); } tcg_gen_mul_i64(r_temp2, r_temp, r_temp2); tcg_gen_shri_i64(r_temp, r_temp2, 32); tcg_gen_trunc_i64_tl(cpu_tmp0, r_temp); tcg_temp_free_i64(r_temp); tcg_gen_andi_tl(cpu_y, cpu_tmp0, 0xffffffff); tcg_gen_trunc_i64_tl(dst, r_temp2); tcg_temp_free_i64(r_temp2); tcg_temp_free_i32(r_src1); tcg_temp_free_i32(r_src2); }","No, it is non-vulnerable."680678,"AioContext *aio_context_new(void) { return (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext)); }","No, it is non-vulnerable."681679,"static int check_refcounts_l1(BlockDriverState *bs, BdrvCheckResult *res, uint16_t *refcount_table, int refcount_table_size, int64_t l1_table_offset, int l1_size, int flags) { BDRVQcowState *s = bs->opaque; uint64_t *l1_table, l2_offset, l1_size2; int i, ret; l1_size2 = l1_size * sizeof(uint64_t); /* Mark L1 table as used */ inc_refcounts(bs, res, refcount_table, refcount_table_size, l1_table_offset, l1_size2); /* Read L1 table entries from disk */ if (l1_size2 == 0) { l1_table = NULL; } else { l1_table = g_try_malloc(l1_size2); if (l1_table == NULL) { ret = -ENOMEM; goto fail; } if (bdrv_pread(bs->file, l1_table_offset, l1_table, l1_size2) != l1_size2) goto fail; for(i = 0;i < l1_size; i++) be64_to_cpus(&l1_table[i]); } /* Do the actual checks */ for(i = 0; i < l1_size; i++) { l2_offset = l1_table[i]; if (l2_offset) { /* Mark L2 table as used */ l2_offset &= L1E_OFFSET_MASK; inc_refcounts(bs, res, refcount_table, refcount_table_size, l2_offset, s->cluster_size); /* L2 tables are cluster aligned */ if (offset_into_cluster(s, l2_offset)) { fprintf(stderr, ""ERROR l2_offset=%"" PRIx64 "": Table is not "" ""cluster aligned; L1 entry corrupted\n"", l2_offset); res->corruptions++; } /* Process and check L2 entries */ ret = check_refcounts_l2(bs, res, refcount_table, refcount_table_size, l2_offset, flags); if (ret < 0) { goto fail; } } } g_free(l1_table); return 0; fail: fprintf(stderr, ""ERROR: I/O error in check_refcounts_l1\n""); res->check_errors++; g_free(l1_table); return -EIO; }","No, it is non-vulnerable."682680,"void ppce500_init(QEMUMachineInitArgs *args, PPCE500Params *params) { MemoryRegion *address_space_mem = get_system_memory(); MemoryRegion *ram = g_new(MemoryRegion, 1); PCIBus *pci_bus; CPUPPCState *env = NULL; uint64_t elf_entry; uint64_t elf_lowaddr; hwaddr entry=0; hwaddr loadaddr=UIMAGE_LOAD_BASE; target_long kernel_size=0; target_ulong dt_base = 0; target_ulong initrd_base = 0; target_long initrd_size = 0; target_ulong cur_base = 0; int i; unsigned int pci_irq_nrs[4] = {1, 2, 3, 4}; qemu_irq **irqs, *mpic; DeviceState *dev; CPUPPCState *firstenv = NULL; MemoryRegion *ccsr_addr_space; SysBusDevice *s; PPCE500CCSRState *ccsr; /* Setup CPUs */ if (args->cpu_model == NULL) { args->cpu_model = ""e500v2_v30""; } irqs = g_malloc0(smp_cpus * sizeof(qemu_irq *)); irqs[0] = g_malloc0(smp_cpus * sizeof(qemu_irq) * OPENPIC_OUTPUT_NB); for (i = 0; i < smp_cpus; i++) { PowerPCCPU *cpu; CPUState *cs; qemu_irq *input; cpu = cpu_ppc_init(args->cpu_model); if (cpu == NULL) { fprintf(stderr, ""Unable to initialize CPU!\n""); exit(1); } env = &cpu->env; cs = CPU(cpu); if (!firstenv) { firstenv = env; } irqs[i] = irqs[0] + (i * OPENPIC_OUTPUT_NB); input = (qemu_irq *)env->irq_inputs; irqs[i][OPENPIC_OUTPUT_INT] = input[PPCE500_INPUT_INT]; irqs[i][OPENPIC_OUTPUT_CINT] = input[PPCE500_INPUT_CINT]; env->spr[SPR_BOOKE_PIR] = cs->cpu_index = i; env->mpic_iack = MPC8544_CCSRBAR_BASE + MPC8544_MPIC_REGS_OFFSET + 0xa0; ppc_booke_timers_init(cpu, 400000000, PPC_TIMER_E500); /* Register reset handler */ if (!i) { /* Primary CPU */ struct boot_info *boot_info; boot_info = g_malloc0(sizeof(struct boot_info)); qemu_register_reset(ppce500_cpu_reset, cpu); env->load_info = boot_info; } else { /* Secondary CPUs */ qemu_register_reset(ppce500_cpu_reset_sec, cpu); } } env = firstenv; /* Fixup Memory size on a alignment boundary */ ram_size &= ~(RAM_SIZES_ALIGN - 1); args->ram_size = ram_size; /* Register Memory */ memory_region_init_ram(ram, NULL, ""mpc8544ds.ram"", ram_size); vmstate_register_ram_global(ram); memory_region_add_subregion(address_space_mem, 0, ram); dev = qdev_create(NULL, ""e500-ccsr""); object_property_add_child(qdev_get_machine(), ""e500-ccsr"", OBJECT(dev), NULL); qdev_init_nofail(dev); ccsr = CCSR(dev); ccsr_addr_space = &ccsr->ccsr_space; memory_region_add_subregion(address_space_mem, MPC8544_CCSRBAR_BASE, ccsr_addr_space); mpic = ppce500_init_mpic(params, ccsr_addr_space, irqs); /* Serial */ if (serial_hds[0]) { serial_mm_init(ccsr_addr_space, MPC8544_SERIAL0_REGS_OFFSET, 0, mpic[42], 399193, serial_hds[0], DEVICE_BIG_ENDIAN); } if (serial_hds[1]) { serial_mm_init(ccsr_addr_space, MPC8544_SERIAL1_REGS_OFFSET, 0, mpic[42], 399193, serial_hds[1], DEVICE_BIG_ENDIAN); } /* General Utility device */ dev = qdev_create(NULL, ""mpc8544-guts""); qdev_init_nofail(dev); s = SYS_BUS_DEVICE(dev); memory_region_add_subregion(ccsr_addr_space, MPC8544_UTIL_OFFSET, sysbus_mmio_get_region(s, 0)); /* PCI */ dev = qdev_create(NULL, ""e500-pcihost""); qdev_prop_set_uint32(dev, ""first_slot"", params->pci_first_slot); qdev_init_nofail(dev); s = SYS_BUS_DEVICE(dev); sysbus_connect_irq(s, 0, mpic[pci_irq_nrs[0]]); sysbus_connect_irq(s, 1, mpic[pci_irq_nrs[1]]); sysbus_connect_irq(s, 2, mpic[pci_irq_nrs[2]]); sysbus_connect_irq(s, 3, mpic[pci_irq_nrs[3]]); memory_region_add_subregion(ccsr_addr_space, MPC8544_PCI_REGS_OFFSET, sysbus_mmio_get_region(s, 0)); pci_bus = (PCIBus *)qdev_get_child_bus(dev, ""pci.0""); if (!pci_bus) printf(""couldn't create PCI controller!\n""); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 1, MPC8544_PCI_IO); if (pci_bus) { /* Register network interfaces. */ for (i = 0; i < nb_nics; i++) { pci_nic_init_nofail(&nd_table[i], pci_bus, ""virtio"", NULL); } } /* Register spinning region */ sysbus_create_simple(""e500-spin"", MPC8544_SPIN_BASE, NULL); /* Load kernel. */ if (args->kernel_filename) { kernel_size = load_uimage(args->kernel_filename, &entry, &loadaddr, NULL); if (kernel_size < 0) { kernel_size = load_elf(args->kernel_filename, NULL, NULL, &elf_entry, &elf_lowaddr, NULL, 1, ELF_MACHINE, 0); entry = elf_entry; loadaddr = elf_lowaddr; } /* XXX try again as binary */ if (kernel_size < 0) { fprintf(stderr, ""qemu: could not load kernel '%s'\n"", args->kernel_filename); exit(1); } cur_base = loadaddr + kernel_size; /* Reserve space for dtb */ dt_base = (cur_base + DTC_LOAD_PAD) & ~DTC_PAD_MASK; cur_base += DTB_MAX_SIZE; } /* Load initrd. */ if (args->initrd_filename) { initrd_base = (cur_base + INITRD_LOAD_PAD) & ~INITRD_PAD_MASK; initrd_size = load_image_targphys(args->initrd_filename, initrd_base, ram_size - initrd_base); if (initrd_size < 0) { fprintf(stderr, ""qemu: could not load initial ram disk '%s'\n"", args->initrd_filename); exit(1); } cur_base = initrd_base + initrd_size; } /* If we're loading a kernel directly, we must load the device tree too. */ if (args->kernel_filename) { struct boot_info *boot_info; int dt_size; dt_size = ppce500_load_device_tree(env, args, params, dt_base, initrd_base, initrd_size); if (dt_size < 0) { fprintf(stderr, ""couldn't load device tree\n""); exit(1); } assert(dt_size < DTB_MAX_SIZE); boot_info = env->load_info; boot_info->entry = entry; boot_info->dt_base = dt_base; boot_info->dt_size = dt_size; } if (kvm_enabled()) { kvmppc_init(); } }","No, it is non-vulnerable."683681,"static int write_f(BlockBackend *blk, int argc, char **argv) { struct timeval t1, t2; int Cflag = 0, pflag = 0, qflag = 0, bflag = 0, Pflag = 0, zflag = 0; int cflag = 0; int c, cnt; char *buf = NULL; int64_t offset; int count; /* Some compilers get confused and warn if this is not initialized. */ int total = 0; int pattern = 0xcd; while ((c = getopt(argc, argv, ""bcCpP:qz"")) != EOF) { switch (c) { case 'b': bflag = 1; break; case 'c': cflag = 1; break; case 'C': Cflag = 1; break; case 'p': pflag = 1; break; case 'P': Pflag = 1; pattern = parse_pattern(optarg); if (pattern < 0) { return 0; } break; case 'q': qflag = 1; break; case 'z': zflag = 1; break; default: return qemuio_command_usage(&write_cmd); } } if (optind != argc - 2) { return qemuio_command_usage(&write_cmd); } if (bflag + pflag + zflag > 1) { printf(""-b, -p, or -z cannot be specified at the same time\n""); return 0; } if (zflag && Pflag) { printf(""-z and -P cannot be specified at the same time\n""); return 0; } offset = cvtnum(argv[optind]); if (offset < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } optind++; count = cvtnum(argv[optind]); if (count < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } if (!pflag) { if (offset & 0x1ff) { printf(""offset %"" PRId64 "" is not sector aligned\n"", offset); return 0; } if (count & 0x1ff) { printf(""count %d is not sector aligned\n"", count); return 0; } } if (!zflag) { buf = qemu_io_alloc(blk, count, pattern); } gettimeofday(&t1, NULL); if (pflag) { cnt = do_pwrite(blk, buf, offset, count, &total); } else if (bflag) { cnt = do_save_vmstate(blk, buf, offset, count, &total); } else if (zflag) { cnt = do_co_write_zeroes(blk, offset, count, &total); } else if (cflag) { cnt = do_write_compressed(blk, buf, offset, count, &total); } else { cnt = do_write(blk, buf, offset, count, &total); } gettimeofday(&t2, NULL); if (cnt < 0) { printf(""write failed: %s\n"", strerror(-cnt)); goto out; } if (qflag) { goto out; } /* Finally, report back -- -C gives a parsable format */ t2 = tsub(t2, t1); print_report(""wrote"", &t2, offset, count, total, cnt, Cflag); out: if (!zflag) { qemu_io_free(buf); } return 0; }","No, it is non-vulnerable."684682,"static int lance_init(SysBusDevice *dev) { SysBusPCNetState *d = FROM_SYSBUS(SysBusPCNetState, dev); PCNetState *s = &d->state; memory_region_init_io(&s->mmio, &lance_mem_ops, s, ""lance-mmio"", 4); qdev_init_gpio_in(&dev->qdev, parent_lance_reset, 1); sysbus_init_mmio_region(dev, &s->mmio); sysbus_init_irq(dev, &s->irq); s->phys_mem_read = ledma_memory_read; s->phys_mem_write = ledma_memory_write; return pcnet_common_init(&dev->qdev, s, &net_lance_info); }","Yes, it is vulnerable."685683,"static int decode_slice_header(H264Context *h, H264Context *h0) { unsigned int first_mb_in_slice; unsigned int pps_id; int ret; unsigned int slice_type, tmp, i, j; int default_ref_list_done = 0; int last_pic_structure, last_pic_droppable; int needs_reinit = 0; int field_pic_flag, bottom_field_flag; h->me.qpel_put = h->h264qpel.put_h264_qpel_pixels_tab; h->me.qpel_avg = h->h264qpel.avg_h264_qpel_pixels_tab; first_mb_in_slice = get_ue_golomb(&h->gb); if (first_mb_in_slice == 0) { // FIXME better field boundary detection if (h0->current_slice && h->cur_pic_ptr && FIELD_PICTURE(h)) { field_end(h, 1); } h0->current_slice = 0; if (!h0->first_field) { if (h->cur_pic_ptr && !h->droppable) { ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX, h->picture_structure == PICT_BOTTOM_FIELD); } h->cur_pic_ptr = NULL; } } slice_type = get_ue_golomb_31(&h->gb); if (slice_type > 9) { av_log(h->avctx, AV_LOG_ERROR, ""slice type %d too large at %d %d\n"", slice_type, h->mb_x, h->mb_y); return AVERROR_INVALIDDATA; } if (slice_type > 4) { slice_type -= 5; h->slice_type_fixed = 1; } else h->slice_type_fixed = 0; slice_type = golomb_to_pict_type[slice_type]; if (slice_type == AV_PICTURE_TYPE_I || (h0->current_slice != 0 && slice_type == h0->last_slice_type)) { default_ref_list_done = 1; } h->slice_type = slice_type; h->slice_type_nos = slice_type & 3; if (h->nal_unit_type == NAL_IDR_SLICE && h->slice_type_nos != AV_PICTURE_TYPE_I) { av_log(h->avctx, AV_LOG_ERROR, ""A non-intra slice in an IDR NAL unit.\n""); return AVERROR_INVALIDDATA; } // to make a few old functions happy, it's wrong though h->pict_type = h->slice_type; pps_id = get_ue_golomb(&h->gb); if (pps_id >= MAX_PPS_COUNT) { av_log(h->avctx, AV_LOG_ERROR, ""pps_id %u out of range\n"", pps_id); return AVERROR_INVALIDDATA; } if (!h0->pps_buffers[pps_id]) { av_log(h->avctx, AV_LOG_ERROR, ""non-existing PPS %u referenced\n"", pps_id); return AVERROR_INVALIDDATA; } h->pps = *h0->pps_buffers[pps_id]; if (!h0->sps_buffers[h->pps.sps_id]) { av_log(h->avctx, AV_LOG_ERROR, ""non-existing SPS %u referenced\n"", h->pps.sps_id); return AVERROR_INVALIDDATA; } if (h->pps.sps_id != h->sps.sps_id || h0->sps_buffers[h->pps.sps_id]->new) { h0->sps_buffers[h->pps.sps_id]->new = 0; h->sps = *h0->sps_buffers[h->pps.sps_id]; if (h->bit_depth_luma != h->sps.bit_depth_luma || h->chroma_format_idc != h->sps.chroma_format_idc) { h->bit_depth_luma = h->sps.bit_depth_luma; h->chroma_format_idc = h->sps.chroma_format_idc; needs_reinit = 1; } if ((ret = h264_set_parameter_from_sps(h)) < 0) return ret; } h->avctx->profile = ff_h264_get_profile(&h->sps); h->avctx->level = h->sps.level_idc; h->avctx->refs = h->sps.ref_frame_count; if (h->mb_width != h->sps.mb_width || h->mb_height != h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag)) needs_reinit = 1; h->mb_width = h->sps.mb_width; h->mb_height = h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag); h->mb_num = h->mb_width * h->mb_height; h->mb_stride = h->mb_width + 1; h->b_stride = h->mb_width * 4; h->chroma_y_shift = h->sps.chroma_format_idc <= 1; // 400 uses yuv420p h->width = 16 * h->mb_width; h->height = 16 * h->mb_height; ret = init_dimensions(h); if (ret < 0) return ret; if (h->sps.video_signal_type_present_flag) { h->avctx->color_range = h->sps.full_range ? AVCOL_RANGE_JPEG : AVCOL_RANGE_MPEG; if (h->sps.colour_description_present_flag) { if (h->avctx->colorspace != h->sps.colorspace) needs_reinit = 1; h->avctx->color_primaries = h->sps.color_primaries; h->avctx->color_trc = h->sps.color_trc; h->avctx->colorspace = h->sps.colorspace; } } if (h->context_initialized && (h->width != h->avctx->coded_width || h->height != h->avctx->coded_height || needs_reinit)) { if (h != h0) { av_log(h->avctx, AV_LOG_ERROR, ""changing width %d -> %d / height %d -> %d on "" ""slice %d\n"", h->width, h->avctx->coded_width, h->height, h->avctx->coded_height, h0->current_slice + 1); return AVERROR_INVALIDDATA; } flush_change(h); if ((ret = get_pixel_format(h)) < 0) return ret; h->avctx->pix_fmt = ret; av_log(h->avctx, AV_LOG_INFO, ""Reinit context to %dx%d, "" ""pix_fmt: %d\n"", h->width, h->height, h->avctx->pix_fmt); if ((ret = h264_slice_header_init(h, 1)) < 0) { av_log(h->avctx, AV_LOG_ERROR, ""h264_slice_header_init() failed\n""); return ret; } } if (!h->context_initialized) { if (h != h0) { av_log(h->avctx, AV_LOG_ERROR, ""Cannot (re-)initialize context during parallel decoding.\n""); return AVERROR_PATCHWELCOME; } if ((ret = get_pixel_format(h)) < 0) return ret; h->avctx->pix_fmt = ret; if ((ret = h264_slice_header_init(h, 0)) < 0) { av_log(h->avctx, AV_LOG_ERROR, ""h264_slice_header_init() failed\n""); return ret; } } if (h == h0 && h->dequant_coeff_pps != pps_id) { h->dequant_coeff_pps = pps_id; init_dequant_tables(h); } h->frame_num = get_bits(&h->gb, h->sps.log2_max_frame_num); h->mb_mbaff = 0; h->mb_aff_frame = 0; last_pic_structure = h0->picture_structure; last_pic_droppable = h0->droppable; h->droppable = h->nal_ref_idc == 0; if (h->sps.frame_mbs_only_flag) { h->picture_structure = PICT_FRAME; } else { field_pic_flag = get_bits1(&h->gb); if (field_pic_flag) { bottom_field_flag = get_bits1(&h->gb); h->picture_structure = PICT_TOP_FIELD + bottom_field_flag; } else { h->picture_structure = PICT_FRAME; h->mb_aff_frame = h->sps.mb_aff; } } h->mb_field_decoding_flag = h->picture_structure != PICT_FRAME; if (h0->current_slice != 0) { if (last_pic_structure != h->picture_structure || last_pic_droppable != h->droppable) { av_log(h->avctx, AV_LOG_ERROR, ""Changing field mode (%d -> %d) between slices is not allowed\n"", last_pic_structure, h->picture_structure); h->picture_structure = last_pic_structure; h->droppable = last_pic_droppable; return AVERROR_INVALIDDATA; } else if (!h0->cur_pic_ptr) { av_log(h->avctx, AV_LOG_ERROR, ""unset cur_pic_ptr on slice %d\n"", h0->current_slice + 1); return AVERROR_INVALIDDATA; } } else { /* Shorten frame num gaps so we don't have to allocate reference * frames just to throw them away */ if (h->frame_num != h->prev_frame_num) { int unwrap_prev_frame_num = h->prev_frame_num; int max_frame_num = 1 << h->sps.log2_max_frame_num; if (unwrap_prev_frame_num > h->frame_num) unwrap_prev_frame_num -= max_frame_num; if ((h->frame_num - unwrap_prev_frame_num) > h->sps.ref_frame_count) { unwrap_prev_frame_num = (h->frame_num - h->sps.ref_frame_count) - 1; if (unwrap_prev_frame_num < 0) unwrap_prev_frame_num += max_frame_num; h->prev_frame_num = unwrap_prev_frame_num; } } /* See if we have a decoded first field looking for a pair... * Here, we're using that to see if we should mark previously * decode frames as ""finished"". * We have to do that before the ""dummy"" in-between frame allocation, * since that can modify s->current_picture_ptr. */ if (h0->first_field) { assert(h0->cur_pic_ptr); assert(h0->cur_pic_ptr->f.buf[0]); assert(h0->cur_pic_ptr->reference != DELAYED_PIC_REF); /* figure out if we have a complementary field pair */ if (!FIELD_PICTURE(h) || h->picture_structure == last_pic_structure) { /* Previous field is unmatched. Don't display it, but let it * remain for reference if marked as such. */ if (!last_pic_droppable && last_pic_structure != PICT_FRAME) { ff_thread_report_progress(&h0->cur_pic_ptr->tf, INT_MAX, last_pic_structure == PICT_TOP_FIELD); } } else { if (h0->cur_pic_ptr->frame_num != h->frame_num) { /* This and previous field were reference, but had * different frame_nums. Consider this field first in * pair. Throw away previous field except for reference * purposes. */ if (!last_pic_droppable && last_pic_structure != PICT_FRAME) { ff_thread_report_progress(&h0->cur_pic_ptr->tf, INT_MAX, last_pic_structure == PICT_TOP_FIELD); } } else { /* Second field in complementary pair */ if (!((last_pic_structure == PICT_TOP_FIELD && h->picture_structure == PICT_BOTTOM_FIELD) || (last_pic_structure == PICT_BOTTOM_FIELD && h->picture_structure == PICT_TOP_FIELD))) { av_log(h->avctx, AV_LOG_ERROR, ""Invalid field mode combination %d/%d\n"", last_pic_structure, h->picture_structure); h->picture_structure = last_pic_structure; h->droppable = last_pic_droppable; return AVERROR_INVALIDDATA; } else if (last_pic_droppable != h->droppable) { avpriv_request_sample(h->avctx, ""Found reference and non-reference fields in the same frame, which""); h->picture_structure = last_pic_structure; h->droppable = last_pic_droppable; return AVERROR_PATCHWELCOME; } } } } while (h->frame_num != h->prev_frame_num && h->frame_num != (h->prev_frame_num + 1) % (1 << h->sps.log2_max_frame_num)) { Picture *prev = h->short_ref_count ? h->short_ref[0] : NULL; av_log(h->avctx, AV_LOG_DEBUG, ""Frame num gap %d %d\n"", h->frame_num, h->prev_frame_num); ret = h264_frame_start(h); if (ret < 0) { h0->first_field = 0; return ret; } h->prev_frame_num++; h->prev_frame_num %= 1 << h->sps.log2_max_frame_num; h->cur_pic_ptr->frame_num = h->prev_frame_num; ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX, 0); ff_thread_report_progress(&h->cur_pic_ptr->tf, INT_MAX, 1); ret = ff_generate_sliding_window_mmcos(h, 1); if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE)) return ret; ret = ff_h264_execute_ref_pic_marking(h, h->mmco, h->mmco_index); if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE)) return ret; /* Error concealment: If a ref is missing, copy the previous ref * in its place. * FIXME: Avoiding a memcpy would be nice, but ref handling makes * many assumptions about there being no actual duplicates. * FIXME: This does not copy padding for out-of-frame motion * vectors. Given we are concealing a lost frame, this probably * is not noticeable by comparison, but it should be fixed. */ if (h->short_ref_count) { if (prev) { av_image_copy(h->short_ref[0]->f.data, h->short_ref[0]->f.linesize, (const uint8_t **)prev->f.data, prev->f.linesize, h->avctx->pix_fmt, h->mb_width * 16, h->mb_height * 16); h->short_ref[0]->poc = prev->poc + 2; } h->short_ref[0]->frame_num = h->prev_frame_num; } } /* See if we have a decoded first field looking for a pair... * We're using that to see whether to continue decoding in that * frame, or to allocate a new one. */ if (h0->first_field) { assert(h0->cur_pic_ptr); assert(h0->cur_pic_ptr->f.buf[0]); assert(h0->cur_pic_ptr->reference != DELAYED_PIC_REF); /* figure out if we have a complementary field pair */ if (!FIELD_PICTURE(h) || h->picture_structure == last_pic_structure) { /* Previous field is unmatched. Don't display it, but let it * remain for reference if marked as such. */ h0->cur_pic_ptr = NULL; h0->first_field = FIELD_PICTURE(h); } else { if (h0->cur_pic_ptr->frame_num != h->frame_num) { /* This and the previous field had different frame_nums. * Consider this field first in pair. Throw away previous * one except for reference purposes. */ h0->first_field = 1; h0->cur_pic_ptr = NULL; } else { /* Second field in complementary pair */ h0->first_field = 0; } } } else { /* Frame or first field in a potentially complementary pair */ h0->first_field = FIELD_PICTURE(h); } if (!FIELD_PICTURE(h) || h0->first_field) { if (h264_frame_start(h) < 0) { h0->first_field = 0; return AVERROR_INVALIDDATA; } } else { release_unused_pictures(h, 0); } } if (h != h0 && (ret = clone_slice(h, h0)) < 0) return ret; h->cur_pic_ptr->frame_num = h->frame_num; // FIXME frame_num cleanup assert(h->mb_num == h->mb_width * h->mb_height); if (first_mb_in_slice << FIELD_OR_MBAFF_PICTURE(h) >= h->mb_num || first_mb_in_slice >= h->mb_num) { av_log(h->avctx, AV_LOG_ERROR, ""first_mb_in_slice overflow\n""); return AVERROR_INVALIDDATA; } h->resync_mb_x = h->mb_x = first_mb_in_slice % h->mb_width; h->resync_mb_y = h->mb_y = (first_mb_in_slice / h->mb_width) << FIELD_OR_MBAFF_PICTURE(h); if (h->picture_structure == PICT_BOTTOM_FIELD) h->resync_mb_y = h->mb_y = h->mb_y + 1; assert(h->mb_y < h->mb_height); if (h->picture_structure == PICT_FRAME) { h->curr_pic_num = h->frame_num; h->max_pic_num = 1 << h->sps.log2_max_frame_num; } else { h->curr_pic_num = 2 * h->frame_num + 1; h->max_pic_num = 1 << (h->sps.log2_max_frame_num + 1); } if (h->nal_unit_type == NAL_IDR_SLICE) get_ue_golomb(&h->gb); /* idr_pic_id */ if (h->sps.poc_type == 0) { h->poc_lsb = get_bits(&h->gb, h->sps.log2_max_poc_lsb); if (h->pps.pic_order_present == 1 && h->picture_structure == PICT_FRAME) h->delta_poc_bottom = get_se_golomb(&h->gb); } if (h->sps.poc_type == 1 && !h->sps.delta_pic_order_always_zero_flag) { h->delta_poc[0] = get_se_golomb(&h->gb); if (h->pps.pic_order_present == 1 && h->picture_structure == PICT_FRAME) h->delta_poc[1] = get_se_golomb(&h->gb); } ff_init_poc(h, h->cur_pic_ptr->field_poc, &h->cur_pic_ptr->poc); if (h->pps.redundant_pic_cnt_present) h->redundant_pic_count = get_ue_golomb(&h->gb); ret = ff_set_ref_count(h); if (ret < 0) return ret; else if (ret == 1) default_ref_list_done = 0; if (!default_ref_list_done) ff_h264_fill_default_ref_list(h); if (h->slice_type_nos != AV_PICTURE_TYPE_I) { ret = ff_h264_decode_ref_pic_list_reordering(h); if (ret < 0) { h->ref_count[1] = h->ref_count[0] = 0; return ret; } } if ((h->pps.weighted_pred && h->slice_type_nos == AV_PICTURE_TYPE_P) || (h->pps.weighted_bipred_idc == 1 && h->slice_type_nos == AV_PICTURE_TYPE_B)) ff_pred_weight_table(h); else if (h->pps.weighted_bipred_idc == 2 && h->slice_type_nos == AV_PICTURE_TYPE_B) { implicit_weight_table(h, -1); } else { h->use_weight = 0; for (i = 0; i < 2; i++) { h->luma_weight_flag[i] = 0; h->chroma_weight_flag[i] = 0; } } // If frame-mt is enabled, only update mmco tables for the first slice // in a field. Subsequent slices can temporarily clobber h->mmco_index // or h->mmco, which will cause ref list mix-ups and decoding errors // further down the line. This may break decoding if the first slice is // corrupt, thus we only do this if frame-mt is enabled. if (h->nal_ref_idc) { ret = ff_h264_decode_ref_pic_marking(h0, &h->gb, !(h->avctx->active_thread_type & FF_THREAD_FRAME) || h0->current_slice == 0); if (ret < 0 && (h->avctx->err_recognition & AV_EF_EXPLODE)) return AVERROR_INVALIDDATA; } if (FRAME_MBAFF(h)) { ff_h264_fill_mbaff_ref_list(h); if (h->pps.weighted_bipred_idc == 2 && h->slice_type_nos == AV_PICTURE_TYPE_B) { implicit_weight_table(h, 0); implicit_weight_table(h, 1); } } if (h->slice_type_nos == AV_PICTURE_TYPE_B && !h->direct_spatial_mv_pred) ff_h264_direct_dist_scale_factor(h); ff_h264_direct_ref_list_init(h); if (h->slice_type_nos != AV_PICTURE_TYPE_I && h->pps.cabac) { tmp = get_ue_golomb_31(&h->gb); if (tmp > 2) { av_log(h->avctx, AV_LOG_ERROR, ""cabac_init_idc %u overflow\n"", tmp); return AVERROR_INVALIDDATA; } h->cabac_init_idc = tmp; } h->last_qscale_diff = 0; tmp = h->pps.init_qp + get_se_golomb(&h->gb); if (tmp > 51 + 6 * (h->sps.bit_depth_luma - 8)) { av_log(h->avctx, AV_LOG_ERROR, ""QP %u out of range\n"", tmp); return AVERROR_INVALIDDATA; } h->qscale = tmp; h->chroma_qp[0] = get_chroma_qp(h, 0, h->qscale); h->chroma_qp[1] = get_chroma_qp(h, 1, h->qscale); // FIXME qscale / qp ... stuff if (h->slice_type == AV_PICTURE_TYPE_SP) get_bits1(&h->gb); /* sp_for_switch_flag */ if (h->slice_type == AV_PICTURE_TYPE_SP || h->slice_type == AV_PICTURE_TYPE_SI) get_se_golomb(&h->gb); /* slice_qs_delta */ h->deblocking_filter = 1; h->slice_alpha_c0_offset = 52; h->slice_beta_offset = 52; if (h->pps.deblocking_filter_parameters_present) { tmp = get_ue_golomb_31(&h->gb); if (tmp > 2) { av_log(h->avctx, AV_LOG_ERROR, ""deblocking_filter_idc %u out of range\n"", tmp); return AVERROR_INVALIDDATA; } h->deblocking_filter = tmp; if (h->deblocking_filter < 2) h->deblocking_filter ^= 1; // 1<->0 if (h->deblocking_filter) { h->slice_alpha_c0_offset += get_se_golomb(&h->gb) << 1; h->slice_beta_offset += get_se_golomb(&h->gb) << 1; if (h->slice_alpha_c0_offset > 104U || h->slice_beta_offset > 104U) { av_log(h->avctx, AV_LOG_ERROR, ""deblocking filter parameters %d %d out of range\n"", h->slice_alpha_c0_offset, h->slice_beta_offset); return AVERROR_INVALIDDATA; } } } if (h->avctx->skip_loop_filter >= AVDISCARD_ALL || (h->avctx->skip_loop_filter >= AVDISCARD_NONKEY && h->slice_type_nos != AV_PICTURE_TYPE_I) || (h->avctx->skip_loop_filter >= AVDISCARD_BIDIR && h->slice_type_nos == AV_PICTURE_TYPE_B) || (h->avctx->skip_loop_filter >= AVDISCARD_NONREF && h->nal_ref_idc == 0)) h->deblocking_filter = 0; if (h->deblocking_filter == 1 && h0->max_contexts > 1) { if (h->avctx->flags2 & CODEC_FLAG2_FAST) { /* Cheat slightly for speed: * Do not bother to deblock across slices. */ h->deblocking_filter = 2; } else { h0->max_contexts = 1; if (!h0->single_decode_warning) { av_log(h->avctx, AV_LOG_INFO, ""Cannot parallelize deblocking type 1, decoding such frames in sequential order\n""); h0->single_decode_warning = 1; } if (h != h0) { av_log(h->avctx, AV_LOG_ERROR, ""Deblocking switched inside frame.\n""); return 1; } } } h->qp_thresh = 15 + 52 - FFMIN(h->slice_alpha_c0_offset, h->slice_beta_offset) - FFMAX3(0, h->pps.chroma_qp_index_offset[0], h->pps.chroma_qp_index_offset[1]) + 6 * (h->sps.bit_depth_luma - 8); h0->last_slice_type = slice_type; h->slice_num = ++h0->current_slice; if (h->slice_num >= MAX_SLICES) { av_log(h->avctx, AV_LOG_ERROR, ""Too many slices, increase MAX_SLICES and recompile\n""); } for (j = 0; j < 2; j++) { int id_list[16]; int *ref2frm = h->ref2frm[h->slice_num & (MAX_SLICES - 1)][j]; for (i = 0; i < 16; i++) { id_list[i] = 60; if (j < h->list_count && i < h->ref_count[j] && h->ref_list[j][i].f.buf[0]) { int k; AVBuffer *buf = h->ref_list[j][i].f.buf[0]->buffer; for (k = 0; k < h->short_ref_count; k++) if (h->short_ref[k]->f.buf[0]->buffer == buf) { id_list[i] = k; break; } for (k = 0; k < h->long_ref_count; k++) if (h->long_ref[k] && h->long_ref[k]->f.buf[0]->buffer == buf) { id_list[i] = h->short_ref_count + k; break; } } } ref2frm[0] = ref2frm[1] = -1; for (i = 0; i < 16; i++) ref2frm[i + 2] = 4 * id_list[i] + (h->ref_list[j][i].reference & 3); ref2frm[18 + 0] = ref2frm[18 + 1] = -1; for (i = 16; i < 48; i++) ref2frm[i + 4] = 4 * id_list[(i - 16) >> 1] + (h->ref_list[j][i].reference & 3); } if (h->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(h->avctx, AV_LOG_DEBUG, ""slice:%d %s mb:%d %c%s%s pps:%u frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\n"", h->slice_num, (h->picture_structure == PICT_FRAME ? ""F"" : h->picture_structure == PICT_TOP_FIELD ? ""T"" : ""B""), first_mb_in_slice, av_get_picture_type_char(h->slice_type), h->slice_type_fixed ? "" fix"" : """", h->nal_unit_type == NAL_IDR_SLICE ? "" IDR"" : """", pps_id, h->frame_num, h->cur_pic_ptr->field_poc[0], h->cur_pic_ptr->field_poc[1], h->ref_count[0], h->ref_count[1], h->qscale, h->deblocking_filter, h->slice_alpha_c0_offset / 2 - 26, h->slice_beta_offset / 2 - 26, h->use_weight, h->use_weight == 1 && h->use_weight_chroma ? ""c"" : """", h->slice_type == AV_PICTURE_TYPE_B ? (h->direct_spatial_mv_pred ? ""SPAT"" : ""TEMP"") : """"); } return 0; }","No, it is non-vulnerable."686684,void bdrv_drained_begin(BlockDriverState *bs) { if (!bs->quiesce_counter++) { aio_disable_external(bdrv_get_aio_context(bs)); bdrv_parent_drained_begin(bs); } bdrv_io_unplugged_begin(bs); bdrv_drain_recurse(bs); if (qemu_in_coroutine()) { bdrv_co_yield_to_drain(bs); } else { bdrv_drain_poll(bs); } bdrv_io_unplugged_end(bs); },"No, it is non-vulnerable."687685,"static ssize_t block_crypto_init_func(QCryptoBlock *block, void *opaque, size_t headerlen, Error **errp) { struct BlockCryptoCreateData *data = opaque; int ret; /* User provided size should reflect amount of space made * available to the guest, so we must take account of that * which will be used by the crypto header */ data->size += headerlen; qemu_opt_set_number(data->opts, BLOCK_OPT_SIZE, data->size, &error_abort); ret = bdrv_create_file(data->filename, data->opts, errp); if (ret < 0) { return -1; } data->blk = blk_new_open(data->filename, NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL, errp); if (!data->blk) { return -1; } return 0; }","No, it is non-vulnerable."688686,"ram_addr_t qemu_ram_alloc(DeviceState *dev, const char *name, ram_addr_t size) { RAMBlock *new_block, *block; size = TARGET_PAGE_ALIGN(size); new_block = qemu_mallocz(sizeof(*new_block)); if (dev && dev->parent_bus && dev->parent_bus->info->get_dev_path) { char *id = dev->parent_bus->info->get_dev_path(dev); if (id) { snprintf(new_block->idstr, sizeof(new_block->idstr), ""%s/"", id); qemu_free(id); } } pstrcat(new_block->idstr, sizeof(new_block->idstr), name); QLIST_FOREACH(block, &ram_list.blocks, next) { if (!strcmp(block->idstr, new_block->idstr)) { fprintf(stderr, ""RAMBlock \""%s\"" already registered, abort!\n"", new_block->idstr); abort(); } } if (mem_path) { #if defined (__linux__) && !defined(TARGET_S390X) new_block->host = file_ram_alloc(new_block, size, mem_path); if (!new_block->host) { new_block->host = qemu_vmalloc(size); #ifdef MADV_MERGEABLE madvise(new_block->host, size, MADV_MERGEABLE); #endif } #else fprintf(stderr, ""-mem-path option unsupported\n""); exit(1); #endif } else { #if defined(TARGET_S390X) && defined(CONFIG_KVM) /* XXX S390 KVM requires the topmost vma of the RAM to be < 256GB */ new_block->host = mmap((void*)0x1000000, size, PROT_EXEC|PROT_READ|PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); #else new_block->host = qemu_vmalloc(size); #endif #ifdef MADV_MERGEABLE madvise(new_block->host, size, MADV_MERGEABLE); #endif } new_block->offset = find_ram_offset(size); new_block->length = size; QLIST_INSERT_HEAD(&ram_list.blocks, new_block, next); ram_list.phys_dirty = qemu_realloc(ram_list.phys_dirty, last_ram_offset() >> TARGET_PAGE_BITS); memset(ram_list.phys_dirty + (new_block->offset >> TARGET_PAGE_BITS), 0xff, size >> TARGET_PAGE_BITS); if (kvm_enabled()) kvm_setup_guest_memory(new_block->host, size); return new_block->offset; }","No, it is non-vulnerable."689687,"void HELPER(ucf64_set_fpscr)(CPUUniCore32State *env, uint32_t val) { int i; uint32_t changed; changed = env->ucf64.xregs[UC32_UCF64_FPSCR]; env->ucf64.xregs[UC32_UCF64_FPSCR] = (val & UCF64_FPSCR_MASK); changed ^= val; if (changed & (UCF64_FPSCR_RND_MASK)) { i = UCF64_FPSCR_RND(val); switch (i) { case 0: i = float_round_nearest_even; break; case 1: i = float_round_to_zero; break; case 2: i = float_round_up; break; case 3: i = float_round_down; break; default: /* 100 and 101 not implement */ cpu_abort(env, ""Unsupported UniCore-F64 round mode""); } set_float_rounding_mode(i, &env->ucf64.fp_status); } i = ucf64_exceptbits_to_host(UCF64_FPSCR_TRAPEN(val)); set_float_exception_flags(i, &env->ucf64.fp_status); }","No, it is non-vulnerable."690688,"static void qemu_rbd_close(BlockDriverState *bs) { BDRVRBDState *s = bs->opaque; close(s->fds[0]); close(s->fds[1]); qemu_aio_set_fd_handler(s->fds[RBD_FD_READ], NULL, NULL, NULL); rbd_close(s->image); rados_ioctx_destroy(s->io_ctx); g_free(s->snap); rados_shutdown(s->cluster); }","Yes, it is vulnerable."691689,"static av_cold int channelmap_init(AVFilterContext *ctx) { ChannelMapContext *s = ctx->priv; int ret; char *mapping, separator = '|'; int map_entries = 0; char buf[256]; enum MappingMode mode; uint64_t out_ch_mask = 0; int i; mapping = s->mapping_str; if (!mapping) { mode = MAP_NONE; } else { char *dash = strchr(mapping, '-'); if (!dash) { // short mapping if (av_isdigit(*mapping)) mode = MAP_ONE_INT; else mode = MAP_ONE_STR; } else if (av_isdigit(*mapping)) { if (av_isdigit(*(dash+1))) mode = MAP_PAIR_INT_INT; else mode = MAP_PAIR_INT_STR; } else { if (av_isdigit(*(dash+1))) mode = MAP_PAIR_STR_INT; else mode = MAP_PAIR_STR_STR; } #if FF_API_OLD_FILTER_OPTS if (strchr(mapping, ',')) { av_log(ctx, AV_LOG_WARNING, ""This syntax is deprecated, use "" ""'|' to separate the mappings.\n""); separator = ','; } #endif } if (mode != MAP_NONE) { char *sep = mapping; map_entries = 1; while ((sep = strchr(sep, separator))) { if (*++sep) // Allow trailing comma map_entries++; } } if (map_entries > MAX_CH) { av_log(ctx, AV_LOG_ERROR, ""Too many channels mapped: '%d'.\n"", map_entries); ret = AVERROR(EINVAL); goto fail; } for (i = 0; i < map_entries; i++) { int in_ch_idx = -1, out_ch_idx = -1; uint64_t in_ch = 0, out_ch = 0; static const char err[] = ""Failed to parse channel map\n""; switch (mode) { case MAP_ONE_INT: if (get_channel_idx(&mapping, &in_ch_idx, separator, MAX_CH) < 0) { ret = AVERROR(EINVAL); av_log(ctx, AV_LOG_ERROR, err); goto fail; } s->map[i].in_channel_idx = in_ch_idx; s->map[i].out_channel_idx = i; break; case MAP_ONE_STR: if (!get_channel(&mapping, &in_ch, separator)) { av_log(ctx, AV_LOG_ERROR, err); ret = AVERROR(EINVAL); goto fail; } s->map[i].in_channel = in_ch; s->map[i].out_channel_idx = i; break; case MAP_PAIR_INT_INT: if (get_channel_idx(&mapping, &in_ch_idx, '-', MAX_CH) < 0 || get_channel_idx(&mapping, &out_ch_idx, separator, MAX_CH) < 0) { av_log(ctx, AV_LOG_ERROR, err); ret = AVERROR(EINVAL); goto fail; } s->map[i].in_channel_idx = in_ch_idx; s->map[i].out_channel_idx = out_ch_idx; break; case MAP_PAIR_INT_STR: if (get_channel_idx(&mapping, &in_ch_idx, '-', MAX_CH) < 0 || get_channel(&mapping, &out_ch, separator) < 0 || out_ch & out_ch_mask) { av_log(ctx, AV_LOG_ERROR, err); ret = AVERROR(EINVAL); goto fail; } s->map[i].in_channel_idx = in_ch_idx; s->map[i].out_channel = out_ch; out_ch_mask |= out_ch; break; case MAP_PAIR_STR_INT: if (get_channel(&mapping, &in_ch, '-') < 0 || get_channel_idx(&mapping, &out_ch_idx, separator, MAX_CH) < 0) { av_log(ctx, AV_LOG_ERROR, err); ret = AVERROR(EINVAL); goto fail; } s->map[i].in_channel = in_ch; s->map[i].out_channel_idx = out_ch_idx; break; case MAP_PAIR_STR_STR: if (get_channel(&mapping, &in_ch, '-') < 0 || get_channel(&mapping, &out_ch, separator) < 0 || out_ch & out_ch_mask) { av_log(ctx, AV_LOG_ERROR, err); ret = AVERROR(EINVAL); goto fail; } s->map[i].in_channel = in_ch; s->map[i].out_channel = out_ch; out_ch_mask |= out_ch; break; } } s->mode = mode; s->nch = map_entries; s->output_layout = out_ch_mask ? out_ch_mask : av_get_default_channel_layout(map_entries); if (s->channel_layout_str) { uint64_t fmt; if ((fmt = av_get_channel_layout(s->channel_layout_str)) == 0) { av_log(ctx, AV_LOG_ERROR, ""Error parsing channel layout: '%s'.\n"", s->channel_layout_str); ret = AVERROR(EINVAL); goto fail; } if (mode == MAP_NONE) { int i; s->nch = av_get_channel_layout_nb_channels(fmt); for (i = 0; i < s->nch; i++) { s->map[i].in_channel_idx = i; s->map[i].out_channel_idx = i; } } else if (out_ch_mask && out_ch_mask != fmt) { av_get_channel_layout_string(buf, sizeof(buf), 0, out_ch_mask); av_log(ctx, AV_LOG_ERROR, ""Output channel layout '%s' does not match the list of channel mapped: '%s'.\n"", s->channel_layout_str, buf); ret = AVERROR(EINVAL); goto fail; } else if (s->nch != av_get_channel_layout_nb_channels(fmt)) { av_log(ctx, AV_LOG_ERROR, ""Output channel layout %s does not match the number of channels mapped %d.\n"", s->channel_layout_str, s->nch); ret = AVERROR(EINVAL); goto fail; } s->output_layout = fmt; } ff_add_channel_layout(&s->channel_layouts, s->output_layout); if (mode == MAP_PAIR_INT_STR || mode == MAP_PAIR_STR_STR) { for (i = 0; i < s->nch; i++) { s->map[i].out_channel_idx = av_get_channel_layout_channel_index( s->output_layout, s->map[i].out_channel); } } fail: av_opt_free(s); return ret; }","Yes, it is vulnerable."692690,"static void pred_weight_table(HEVCContext *s, GetBitContext *gb) { int i = 0; int j = 0; uint8_t luma_weight_l0_flag[16]; uint8_t chroma_weight_l0_flag[16]; uint8_t luma_weight_l1_flag[16]; uint8_t chroma_weight_l1_flag[16]; int luma_log2_weight_denom; luma_log2_weight_denom = get_ue_golomb_long(gb); if (luma_log2_weight_denom < 0 || luma_log2_weight_denom > 7) av_log(s->avctx, AV_LOG_ERROR, ""luma_log2_weight_denom %d is invalid\n"", luma_log2_weight_denom); s->sh.luma_log2_weight_denom = av_clip_uintp2(luma_log2_weight_denom, 3); if (s->ps.sps->chroma_format_idc != 0) { int delta = get_se_golomb(gb); s->sh.chroma_log2_weight_denom = av_clip_uintp2(s->sh.luma_log2_weight_denom + delta, 3); } for (i = 0; i < s->sh.nb_refs[L0]; i++) { luma_weight_l0_flag[i] = get_bits1(gb); if (!luma_weight_l0_flag[i]) { s->sh.luma_weight_l0[i] = 1 << s->sh.luma_log2_weight_denom; s->sh.luma_offset_l0[i] = 0; } } if (s->ps.sps->chroma_format_idc != 0) { for (i = 0; i < s->sh.nb_refs[L0]; i++) chroma_weight_l0_flag[i] = get_bits1(gb); } else { for (i = 0; i < s->sh.nb_refs[L0]; i++) chroma_weight_l0_flag[i] = 0; } for (i = 0; i < s->sh.nb_refs[L0]; i++) { if (luma_weight_l0_flag[i]) { int delta_luma_weight_l0 = get_se_golomb(gb); s->sh.luma_weight_l0[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l0; s->sh.luma_offset_l0[i] = get_se_golomb(gb); } if (chroma_weight_l0_flag[i]) { for (j = 0; j < 2; j++) { int delta_chroma_weight_l0 = get_se_golomb(gb); int delta_chroma_offset_l0 = get_se_golomb(gb); s->sh.chroma_weight_l0[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l0; s->sh.chroma_offset_l0[i][j] = av_clip((delta_chroma_offset_l0 - ((128 * s->sh.chroma_weight_l0[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); } } else { s->sh.chroma_weight_l0[i][0] = 1 << s->sh.chroma_log2_weight_denom; s->sh.chroma_offset_l0[i][0] = 0; s->sh.chroma_weight_l0[i][1] = 1 << s->sh.chroma_log2_weight_denom; s->sh.chroma_offset_l0[i][1] = 0; } } if (s->sh.slice_type == HEVC_SLICE_B) { for (i = 0; i < s->sh.nb_refs[L1]; i++) { luma_weight_l1_flag[i] = get_bits1(gb); if (!luma_weight_l1_flag[i]) { s->sh.luma_weight_l1[i] = 1 << s->sh.luma_log2_weight_denom; s->sh.luma_offset_l1[i] = 0; } } if (s->ps.sps->chroma_format_idc != 0) { for (i = 0; i < s->sh.nb_refs[L1]; i++) chroma_weight_l1_flag[i] = get_bits1(gb); } else { for (i = 0; i < s->sh.nb_refs[L1]; i++) chroma_weight_l1_flag[i] = 0; } for (i = 0; i < s->sh.nb_refs[L1]; i++) { if (luma_weight_l1_flag[i]) { int delta_luma_weight_l1 = get_se_golomb(gb); s->sh.luma_weight_l1[i] = (1 << s->sh.luma_log2_weight_denom) + delta_luma_weight_l1; s->sh.luma_offset_l1[i] = get_se_golomb(gb); } if (chroma_weight_l1_flag[i]) { for (j = 0; j < 2; j++) { int delta_chroma_weight_l1 = get_se_golomb(gb); int delta_chroma_offset_l1 = get_se_golomb(gb); s->sh.chroma_weight_l1[i][j] = (1 << s->sh.chroma_log2_weight_denom) + delta_chroma_weight_l1; s->sh.chroma_offset_l1[i][j] = av_clip((delta_chroma_offset_l1 - ((128 * s->sh.chroma_weight_l1[i][j]) >> s->sh.chroma_log2_weight_denom) + 128), -128, 127); } } else { s->sh.chroma_weight_l1[i][0] = 1 << s->sh.chroma_log2_weight_denom; s->sh.chroma_offset_l1[i][0] = 0; s->sh.chroma_weight_l1[i][1] = 1 << s->sh.chroma_log2_weight_denom; s->sh.chroma_offset_l1[i][1] = 0; } } } }","Yes, it is vulnerable."693691,"void slirp_output(const uint8_t *pkt, int pkt_len) { #ifdef DEBUG_SLIRP printf(""slirp output:\n""); hex_dump(stdout, pkt, pkt_len); #endif if (!slirp_vc) return; qemu_send_packet(slirp_vc, pkt, pkt_len); }","No, it is non-vulnerable."694692,"static void filter_mb_mbaff_edgev( H264Context *h, uint8_t *pix, int stride, int16_t bS[8], int qp[2] ) { int i; for( i = 0; i < 16; i++, pix += stride) { int index_a; int alpha; int beta; int qp_index; int bS_index = (i >> 1); if (!MB_FIELD) { bS_index &= ~1; bS_index |= (i & 1); } if( bS[bS_index] == 0 ) { continue; } qp_index = MB_FIELD ? (i >> 3) : (i & 1); index_a = qp[qp_index] + h->slice_alpha_c0_offset; alpha = (alpha_table+52)[index_a]; beta = (beta_table+52)[qp[qp_index] + h->slice_beta_offset]; if( bS[bS_index] < 4 ) { const int tc0 = (tc0_table+52)[index_a][bS[bS_index] - 1]; const int p0 = pix[-1]; const int p1 = pix[-2]; const int p2 = pix[-3]; const int q0 = pix[0]; const int q1 = pix[1]; const int q2 = pix[2]; if( FFABS( p0 - q0 ) < alpha && FFABS( p1 - p0 ) < beta && FFABS( q1 - q0 ) < beta ) { int tc = tc0; int i_delta; if( FFABS( p2 - p0 ) < beta ) { pix[-2] = p1 + av_clip( ( p2 + ( ( p0 + q0 + 1 ) >> 1 ) - ( p1 << 1 ) ) >> 1, -tc0, tc0 ); tc++; } if( FFABS( q2 - q0 ) < beta ) { pix[1] = q1 + av_clip( ( q2 + ( ( p0 + q0 + 1 ) >> 1 ) - ( q1 << 1 ) ) >> 1, -tc0, tc0 ); tc++; } i_delta = av_clip( (((q0 - p0 ) << 2) + (p1 - q1) + 4) >> 3, -tc, tc ); pix[-1] = av_clip_uint8( p0 + i_delta ); /* p0' */ pix[0] = av_clip_uint8( q0 - i_delta ); /* q0' */ tprintf(h->s.avctx, ""filter_mb_mbaff_edgev i:%d, qp:%d, indexA:%d, alpha:%d, beta:%d, tc:%d\n# bS:%d -> [%02x, %02x, %02x, %02x, %02x, %02x] =>[%02x, %02x, %02x, %02x]\n"", i, qp[qp_index], index_a, alpha, beta, tc, bS[bS_index], pix[-3], p1, p0, q0, q1, pix[2], p1, pix[-1], pix[0], q1); } }else{ const int p0 = pix[-1]; const int p1 = pix[-2]; const int p2 = pix[-3]; const int q0 = pix[0]; const int q1 = pix[1]; const int q2 = pix[2]; if( FFABS( p0 - q0 ) < alpha && FFABS( p1 - p0 ) < beta && FFABS( q1 - q0 ) < beta ) { if(FFABS( p0 - q0 ) < (( alpha >> 2 ) + 2 )){ if( FFABS( p2 - p0 ) < beta) { const int p3 = pix[-4]; /* p0', p1', p2' */ pix[-1] = ( p2 + 2*p1 + 2*p0 + 2*q0 + q1 + 4 ) >> 3; pix[-2] = ( p2 + p1 + p0 + q0 + 2 ) >> 2; pix[-3] = ( 2*p3 + 3*p2 + p1 + p0 + q0 + 4 ) >> 3; } else { /* p0' */ pix[-1] = ( 2*p1 + p0 + q1 + 2 ) >> 2; } if( FFABS( q2 - q0 ) < beta) { const int q3 = pix[3]; /* q0', q1', q2' */ pix[0] = ( p1 + 2*p0 + 2*q0 + 2*q1 + q2 + 4 ) >> 3; pix[1] = ( p0 + q0 + q1 + q2 + 2 ) >> 2; pix[2] = ( 2*q3 + 3*q2 + q1 + q0 + p0 + 4 ) >> 3; } else { /* q0' */ pix[0] = ( 2*q1 + q0 + p1 + 2 ) >> 2; } }else{ /* p0', q0' */ pix[-1] = ( 2*p1 + p0 + q1 + 2 ) >> 2; pix[ 0] = ( 2*q1 + q0 + p1 + 2 ) >> 2; } tprintf(h->s.avctx, ""filter_mb_mbaff_edgev i:%d, qp:%d, indexA:%d, alpha:%d, beta:%d\n# bS:4 -> [%02x, %02x, %02x, %02x, %02x, %02x] =>[%02x, %02x, %02x, %02x, %02x, %02x]\n"", i, qp[qp_index], index_a, alpha, beta, p2, p1, p0, q0, q1, q2, pix[-3], pix[-2], pix[-1], pix[0], pix[1], pix[2]); } } } }","No, it is non-vulnerable."695693,"static void do_audio_out(AVFormatContext *s, AVOutputStream *ost, AVInputStream *ist, unsigned char *buf, int size) { uint8_t *buftmp; static uint8_t *audio_buf = NULL; static uint8_t *audio_out = NULL; const int audio_out_size= 4*MAX_AUDIO_PACKET_SIZE; int size_out, frame_bytes, ret; AVCodecContext *enc; /* SC: dynamic allocation of buffers */ if (!audio_buf) audio_buf = av_malloc(2*MAX_AUDIO_PACKET_SIZE); if (!audio_out) audio_out = av_malloc(audio_out_size); if (!audio_buf || !audio_out) return; /* Should signal an error ! */ enc = &ost->st->codec; if (ost->audio_resample) { buftmp = audio_buf; size_out = audio_resample(ost->resample, (short *)buftmp, (short *)buf, size / (ist->st->codec.channels * 2)); size_out = size_out * enc->channels * 2; } else { buftmp = buf; size_out = size; } /* now encode as many frames as possible */ if (enc->frame_size > 1) { /* output resampled raw samples */ fifo_write(&ost->fifo, buftmp, size_out, &ost->fifo.wptr); frame_bytes = enc->frame_size * 2 * enc->channels; while (fifo_read(&ost->fifo, audio_buf, frame_bytes, &ost->fifo.rptr) == 0) { AVPacket pkt; av_init_packet(&pkt); ret = avcodec_encode_audio(enc, audio_out, audio_out_size, (short *)audio_buf); audio_size += ret; pkt.stream_index= ost->index; pkt.data= audio_out; pkt.size= ret; if(enc->coded_frame) pkt.pts= enc->coded_frame->pts; pkt.flags |= PKT_FLAG_KEY; av_write_frame(s, &pkt); } } else { AVPacket pkt; av_init_packet(&pkt); /* output a pcm frame */ /* XXX: change encoding codec API to avoid this ? */ switch(enc->codec->id) { case CODEC_ID_PCM_S16LE: case CODEC_ID_PCM_S16BE: case CODEC_ID_PCM_U16LE: case CODEC_ID_PCM_U16BE: break; default: size_out = size_out >> 1; break; } ret = avcodec_encode_audio(enc, audio_out, size_out, (short *)buftmp); audio_size += ret; pkt.stream_index= ost->index; pkt.data= audio_out; pkt.size= ret; if(enc->coded_frame) pkt.pts= enc->coded_frame->pts; pkt.flags |= PKT_FLAG_KEY; av_write_frame(s, &pkt); } }","No, it is non-vulnerable."696694,"static int libopus_encode(AVCodecContext *avctx, AVPacket *avpkt, const AVFrame *frame, int *got_packet_ptr) { LibopusEncContext *opus = avctx->priv_data; const int sample_size = avctx->channels * av_get_bytes_per_sample(avctx->sample_fmt); uint8_t *audio; int ret; int discard_padding; if (frame) { ret = ff_af_queue_add(&opus->afq, frame); if (ret < 0) return ret; if (frame->nb_samples < opus->opts.packet_size) { audio = opus->samples; memcpy(audio, frame->data[0], frame->nb_samples * sample_size); } else audio = frame->data[0]; } else { if (!opus->afq.remaining_samples) return 0; audio = opus->samples; memset(audio, 0, opus->opts.packet_size * sample_size); } /* Maximum packet size taken from opusenc in opus-tools. 60ms packets * consist of 3 frames in one packet. The maximum frame size is 1275 * bytes along with the largest possible packet header of 7 bytes. */ if ((ret = ff_alloc_packet2(avctx, avpkt, (1275 * 3 + 7) * opus->stream_count, 0)) < 0) return ret; if (avctx->sample_fmt == AV_SAMPLE_FMT_FLT) ret = opus_multistream_encode_float(opus->enc, (float *)audio, opus->opts.packet_size, avpkt->data, avpkt->size); else ret = opus_multistream_encode(opus->enc, (opus_int16 *)audio, opus->opts.packet_size, avpkt->data, avpkt->size); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Error encoding frame: %s\n"", opus_strerror(ret)); return ff_opus_error_to_averror(ret); } av_shrink_packet(avpkt, ret); ff_af_queue_remove(&opus->afq, opus->opts.packet_size, &avpkt->pts, &avpkt->duration); discard_padding = opus->opts.packet_size - avpkt->duration; // Check if subtraction resulted in an overflow if ((discard_padding < opus->opts.packet_size) != (avpkt->duration > 0)) { av_free_packet(avpkt); av_free(avpkt); return AVERROR(EINVAL); } if (discard_padding > 0) { uint8_t* side_data = av_packet_new_side_data(avpkt, AV_PKT_DATA_SKIP_SAMPLES, 10); if(!side_data) { av_free_packet(avpkt); av_free(avpkt); return AVERROR(ENOMEM); } AV_WL32(side_data + 4, discard_padding); } *got_packet_ptr = 1; return 0; }","No, it is non-vulnerable."697695,"static void vnc_connect(VncDisplay *vd, int csock, int skipauth, bool websocket) { VncState *vs = g_malloc0(sizeof(VncState)); int i; vs->csock = csock; if (skipauth) { vs->auth = VNC_AUTH_NONE; #ifdef CONFIG_VNC_TLS vs->subauth = VNC_AUTH_INVALID; #endif } else { vs->auth = vd->auth; #ifdef CONFIG_VNC_TLS vs->subauth = vd->subauth; #endif } vs->lossy_rect = g_malloc0(VNC_STAT_ROWS * sizeof (*vs->lossy_rect)); for (i = 0; i < VNC_STAT_ROWS; ++i) { vs->lossy_rect[i] = g_malloc0(VNC_STAT_COLS * sizeof (uint8_t)); } VNC_DEBUG(""New client on socket %d\n"", csock); dcl->idle = 0; socket_set_nonblock(vs->csock); #ifdef CONFIG_VNC_WS if (websocket) { vs->websocket = 1; qemu_set_fd_handler2(vs->csock, NULL, vncws_handshake_read, NULL, vs); } else #endif /* CONFIG_VNC_WS */ { qemu_set_fd_handler2(vs->csock, NULL, vnc_client_read, NULL, vs); } vnc_client_cache_addr(vs); vnc_qmp_event(vs, QEVENT_VNC_CONNECTED); vnc_set_share_mode(vs, VNC_SHARE_MODE_CONNECTING); vs->vd = vd; #ifdef CONFIG_VNC_WS if (!vs->websocket) #endif { vnc_init_state(vs); } }","Yes, it is vulnerable."698696,"static void v9fs_open(void *opaque) { int flags; int iounit; int32_t fid; int32_t mode; V9fsQID qid; ssize_t err = 0; size_t offset = 7; struct stat stbuf; V9fsFidState *fidp; V9fsPDU *pdu = opaque; V9fsState *s = pdu->s; if (s->proto_version == V9FS_PROTO_2000L) { pdu_unmarshal(pdu, offset, ""dd"", &fid, &mode); } else { pdu_unmarshal(pdu, offset, ""db"", &fid, &mode); } trace_v9fs_open(pdu->tag, pdu->id, fid, mode); fidp = get_fid(pdu, fid); if (fidp == NULL) { err = -ENOENT; goto out_nofid; } BUG_ON(fidp->fid_type != P9_FID_NONE); err = v9fs_co_lstat(pdu, &fidp->path, &stbuf); if (err < 0) { goto out; } stat_to_qid(&stbuf, &qid); if (S_ISDIR(stbuf.st_mode)) { err = v9fs_co_opendir(pdu, fidp); if (err < 0) { goto out; } fidp->fid_type = P9_FID_DIR; offset += pdu_marshal(pdu, offset, ""Qd"", &qid, 0); err = offset; } else { if (s->proto_version == V9FS_PROTO_2000L) { flags = get_dotl_openflags(s, mode); } else { flags = omode_to_uflags(mode); } err = v9fs_co_open(pdu, fidp, flags); if (err < 0) { goto out; } fidp->fid_type = P9_FID_FILE; fidp->open_flags = flags; if (flags & O_EXCL) { /* * We let the host file system do O_EXCL check * We should not reclaim such fd */ fidp->flags |= FID_NON_RECLAIMABLE; } iounit = get_iounit(pdu, &fidp->path); offset += pdu_marshal(pdu, offset, ""Qd"", &qid, iounit); err = offset; } out: put_fid(pdu, fidp); out_nofid: complete_pdu(s, pdu, err); }","Yes, it is vulnerable."699697,"static void tcp_chr_disconnect(CharDriverState *chr) { TCPCharDriver *s = chr->opaque; s->connected = 0; if (s->listen_chan) { s->listen_tag = g_io_add_watch(s->listen_chan, G_IO_IN, tcp_chr_accept, chr); } remove_fd_in_watch(chr); g_io_channel_unref(s->chan); s->chan = NULL; closesocket(s->fd); s->fd = -1; SocketAddress_to_str(chr->filename, CHR_MAX_FILENAME_SIZE, ""disconnected:"", s->addr, s->is_listen, s->is_telnet); qemu_chr_be_event(chr, CHR_EVENT_CLOSED); if (s->reconnect_time) { qemu_chr_socket_restart_timer(chr); } }","No, it is non-vulnerable."700698,"float64 HELPER(ucf64_si2df)(float32 x, CPUUniCore32State *env) { return int32_to_float64(ucf64_stoi(x), &env->ucf64.fp_status); }","No, it is non-vulnerable."701699,"static QObject *parse_literal(JSONParserContext *ctxt) { QObject *token; token = parser_context_pop_token(ctxt); assert(token); switch (token_get_type(token)) { case JSON_STRING: return QOBJECT(qstring_from_escaped_str(ctxt, token)); case JSON_INTEGER: { /* A possibility exists that this is a whole-valued float where the * fractional part was left out due to being 0 (.0). It's not a big * deal to treat these as ints in the parser, so long as users of the * resulting QObject know to expect a QInt in place of a QFloat in * cases like these. * * However, in some cases these values will overflow/underflow a * QInt/int64 container, thus we should assume these are to be handled * as QFloats/doubles rather than silently changing their values. * * strtoll() indicates these instances by setting errno to ERANGE */ int64_t value; errno = 0; /* strtoll doesn't set errno on success */ value = strtoll(token_get_value(token), NULL, 10); if (errno != ERANGE) { return QOBJECT(qint_from_int(value)); } /* fall through to JSON_FLOAT */ } case JSON_FLOAT: /* FIXME dependent on locale */ return QOBJECT(qfloat_from_double(strtod(token_get_value(token), NULL))); default: abort(); } }","No, it is non-vulnerable."702700,"uint64_t esp_reg_read(ESPState *s, uint32_t saddr) { uint32_t old_val; trace_esp_mem_readb(saddr, s->rregs[saddr]); switch (saddr) { case ESP_FIFO: if (s->ti_size > 0) { s->ti_size--; if ((s->rregs[ESP_RSTAT] & STAT_PIO_MASK) == 0) { /* Data out. */ qemu_log_mask(LOG_UNIMP, ""esp: PIO data read not implemented\n""); s->rregs[ESP_FIFO] = 0; } else { s->rregs[ESP_FIFO] = s->ti_buf[s->ti_rptr++]; } esp_raise_irq(s); } if (s->ti_size == 0) { s->ti_rptr = 0; s->ti_wptr = 0; } break; case ESP_RINTR: /* Clear sequence step, interrupt register and all status bits except TC */ old_val = s->rregs[ESP_RINTR]; s->rregs[ESP_RINTR] = 0; s->rregs[ESP_RSTAT] &= ~STAT_TC; s->rregs[ESP_RSEQ] = SEQ_CD; esp_lower_irq(s); return old_val; case ESP_TCHI: /* Return the unique id if the value has never been written */ if (!s->tchi_written) { return s->chip_id; } default: break; } return s->rregs[saddr]; }","No, it is non-vulnerable."703701,"static void co_test_cb(void *opaque) { WorkerTestData *data = opaque; active = 1; data->n = 0; data->ret = -EINPROGRESS; thread_pool_submit_co(worker_cb, data); /* The test continues in test_submit_co, after qemu_coroutine_enter... */ g_assert_cmpint(data->n, ==, 1); data->ret = 0; active--; /* The test continues in test_submit_co, after qemu_aio_wait_all... */ }","No, it is non-vulnerable."704702,"print_insn_microblaze (bfd_vma memaddr, struct disassemble_info * info) { fprintf_ftype fprintf = info->fprintf_func; void * stream = info->stream; unsigned long inst, prev_inst; struct op_code_struct * op, *pop; int immval = 0; bfd_boolean immfound = FALSE; static bfd_vma prev_insn_addr = -1; /*init the prev insn addr */ static int prev_insn_vma = -1; /*init the prev insn vma */ int curr_insn_vma = info->buffer_vma; info->bytes_per_chunk = 4; inst = read_insn_microblaze (memaddr, info, &op); if (inst == 0) { return -1; } if (prev_insn_vma == curr_insn_vma) { if (memaddr-(info->bytes_per_chunk) == prev_insn_addr) { prev_inst = read_insn_microblaze (prev_insn_addr, info, &pop); if (prev_inst == 0) return -1; if (pop->instr == imm) { immval = (get_int_field_imm(prev_inst) << 16) & 0xffff0000; immfound = TRUE; } else { immval = 0; immfound = FALSE; } } } /* make curr insn as prev insn */ prev_insn_addr = memaddr; prev_insn_vma = curr_insn_vma; if (op->name == 0) { fprintf (stream, "".short 0x%04lx"", inst); } else { fprintf (stream, ""%s"", op->name); switch (op->inst_type) { case INST_TYPE_RD_R1_R2: fprintf(stream, ""\t%s, %s, %s"", get_field_rd(inst), get_field_r1(inst), get_field_r2(inst)); break; case INST_TYPE_RD_R1_IMM: fprintf(stream, ""\t%s, %s, %s"", get_field_rd(inst), get_field_r1(inst), get_field_imm(inst)); if (info->print_address_func && get_int_field_r1(inst) == 0 && info->symbol_at_address_func) { if (immfound) immval |= (get_int_field_imm(inst) & 0x0000ffff); else { immval = get_int_field_imm(inst); if (immval & 0x8000) immval |= 0xFFFF0000; } if (immval > 0 && info->symbol_at_address_func(immval, info)) { fprintf (stream, ""\t// ""); info->print_address_func (immval, info); } } break; case INST_TYPE_RD_R1_IMM5: fprintf(stream, ""\t%s, %s, %s"", get_field_rd(inst), get_field_r1(inst), get_field_imm5(inst)); break; case INST_TYPE_RD_RFSL: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_rfsl(inst)); break; case INST_TYPE_R1_RFSL: fprintf(stream, ""\t%s, %s"", get_field_r1(inst), get_field_rfsl(inst)); break; case INST_TYPE_RD_SPECIAL: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_special(inst, op)); break; case INST_TYPE_SPECIAL_R1: fprintf(stream, ""\t%s, %s"", get_field_special(inst, op), get_field_r1(inst)); break; case INST_TYPE_RD_R1: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_r1(inst)); break; case INST_TYPE_R1_R2: fprintf(stream, ""\t%s, %s"", get_field_r1(inst), get_field_r2(inst)); break; case INST_TYPE_R1_IMM: fprintf(stream, ""\t%s, %s"", get_field_r1(inst), get_field_imm(inst)); /* The non-pc relative instructions are returns, which shouldn't have a label printed */ if (info->print_address_func && op->inst_offset_type == INST_PC_OFFSET && info->symbol_at_address_func) { if (immfound) immval |= (get_int_field_imm(inst) & 0x0000ffff); else { immval = get_int_field_imm(inst); if (immval & 0x8000) immval |= 0xFFFF0000; } immval += memaddr; if (immval > 0 && info->symbol_at_address_func(immval, info)) { fprintf (stream, ""\t// ""); info->print_address_func (immval, info); } else { fprintf (stream, ""\t\t// ""); fprintf (stream, ""%x"", immval); } } break; case INST_TYPE_RD_IMM: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_imm(inst)); if (info->print_address_func && info->symbol_at_address_func) { if (immfound) immval |= (get_int_field_imm(inst) & 0x0000ffff); else { immval = get_int_field_imm(inst); if (immval & 0x8000) immval |= 0xFFFF0000; } if (op->inst_offset_type == INST_PC_OFFSET) immval += (int) memaddr; if (info->symbol_at_address_func(immval, info)) { fprintf (stream, ""\t// ""); info->print_address_func (immval, info); } } break; case INST_TYPE_IMM: fprintf(stream, ""\t%s"", get_field_imm(inst)); if (info->print_address_func && info->symbol_at_address_func && op->instr != imm) { if (immfound) immval |= (get_int_field_imm(inst) & 0x0000ffff); else { immval = get_int_field_imm(inst); if (immval & 0x8000) immval |= 0xFFFF0000; } if (op->inst_offset_type == INST_PC_OFFSET) immval += (int) memaddr; if (immval > 0 && info->symbol_at_address_func(immval, info)) { fprintf (stream, ""\t// ""); info->print_address_func (immval, info); } else if (op->inst_offset_type == INST_PC_OFFSET) { fprintf (stream, ""\t\t// ""); fprintf (stream, ""%x"", immval); } } break; case INST_TYPE_RD_R2: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_r2(inst)); break; case INST_TYPE_R2: fprintf(stream, ""\t%s"", get_field_r2(inst)); break; case INST_TYPE_R1: fprintf(stream, ""\t%s"", get_field_r1(inst)); break; case INST_TYPE_RD_R1_SPECIAL: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_r2(inst)); break; case INST_TYPE_RD_IMM15: fprintf(stream, ""\t%s, %s"", get_field_rd(inst), get_field_imm15(inst)); break; /* For tuqula instruction */ case INST_TYPE_RD: fprintf(stream, ""\t%s"", get_field_rd(inst)); break; case INST_TYPE_RFSL: fprintf(stream, ""\t%s"", get_field_rfsl(inst)); break; default: /* if the disassembler lags the instruction set */ fprintf (stream, ""\tundecoded operands, inst is 0x%04lx"", inst); break; } } /* Say how many bytes we consumed? */ return 4; }","No, it is non-vulnerable."705703,"int nbd_client_session_co_flush(NbdClientSession *client) { struct nbd_request request = { .type = NBD_CMD_FLUSH }; struct nbd_reply reply; ssize_t ret; if (!(client->nbdflags & NBD_FLAG_SEND_FLUSH)) { return 0; } if (client->nbdflags & NBD_FLAG_SEND_FUA) { request.type |= NBD_CMD_FLAG_FUA; } request.from = 0; request.len = 0; nbd_coroutine_start(client, &request); ret = nbd_co_send_request(client, &request, NULL, 0); if (ret < 0) { reply.error = -ret; } else { nbd_co_receive_reply(client, &request, &reply, NULL, 0); } nbd_coroutine_end(client, &request); return -reply.error; }","No, it is non-vulnerable."706704,"static void i440fx_pcihost_initfn(Object *obj) { PCIHostState *s = PCI_HOST_BRIDGE(obj); I440FXState *d = I440FX_PCI_HOST_BRIDGE(obj); memory_region_init_io(&s->conf_mem, obj, &pci_host_conf_le_ops, s, ""pci-conf-idx"", 4); memory_region_init_io(&s->data_mem, obj, &pci_host_data_le_ops, s, ""pci-conf-data"", 4); object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_START, ""int"", i440fx_pcihost_get_pci_hole_start, NULL, NULL, NULL, NULL); object_property_add(obj, PCI_HOST_PROP_PCI_HOLE_END, ""int"", i440fx_pcihost_get_pci_hole_end, NULL, NULL, NULL, NULL); object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_START, ""int"", i440fx_pcihost_get_pci_hole64_start, NULL, NULL, NULL, NULL); object_property_add(obj, PCI_HOST_PROP_PCI_HOLE64_END, ""int"", i440fx_pcihost_get_pci_hole64_end, NULL, NULL, NULL, NULL); d->pci_info.w32.end = IO_APIC_DEFAULT_ADDRESS; }","No, it is non-vulnerable."707705,"int avio_open2(AVIOContext **s, const char *filename, int flags, const AVIOInterruptCB *int_cb, AVDictionary **options) { AVIOInternal *internal; const URLProtocol **protocols; URLContext *h; int err; protocols = ffurl_get_protocols(NULL, NULL); if (!protocols) return AVERROR(ENOMEM); err = ffurl_open(&h, filename, flags, int_cb, options, protocols); if (err < 0) { av_freep(&protocols); return err; } err = ffio_fdopen(s, h); if (err < 0) { ffurl_close(h); av_freep(&protocols); return err; } internal = (*s)->opaque; internal->protocols = protocols; return 0; }","Yes, it is vulnerable."708706,"static int decode_vop_header(Mpeg4DecContext *ctx, GetBitContext *gb) { MpegEncContext *s = &ctx->m; int time_incr, time_increment; int64_t pts; s->pict_type = get_bits(gb, 2) + AV_PICTURE_TYPE_I; /* pict type: I = 0 , P = 1 */ if (s->pict_type == AV_PICTURE_TYPE_B && s->low_delay && s->vol_control_parameters == 0 && !(s->flags & CODEC_FLAG_LOW_DELAY)) { av_log(s->avctx, AV_LOG_ERROR, ""low_delay flag incorrectly, clearing it\n""); s->low_delay = 0; } s->partitioned_frame = s->data_partitioning && s->pict_type != AV_PICTURE_TYPE_B; if (s->partitioned_frame) s->decode_mb = mpeg4_decode_partitioned_mb; else s->decode_mb = mpeg4_decode_mb; time_incr = 0; while (get_bits1(gb) != 0) time_incr++; check_marker(gb, ""before time_increment""); if (ctx->time_increment_bits == 0 || !(show_bits(gb, ctx->time_increment_bits + 1) & 1)) { av_log(s->avctx, AV_LOG_ERROR, ""hmm, seems the headers are not complete, trying to guess time_increment_bits\n""); for (ctx->time_increment_bits = 1; ctx->time_increment_bits < 16; ctx->time_increment_bits++) { if (s->pict_type == AV_PICTURE_TYPE_P || (s->pict_type == AV_PICTURE_TYPE_S && ctx->vol_sprite_usage == GMC_SPRITE)) { if ((show_bits(gb, ctx->time_increment_bits + 6) & 0x37) == 0x30) break; } else if ((show_bits(gb, ctx->time_increment_bits + 5) & 0x1F) == 0x18) break; } av_log(s->avctx, AV_LOG_ERROR, ""my guess is %d bits ;)\n"", ctx->time_increment_bits); if (s->avctx->time_base.den && 4*s->avctx->time_base.den < 1<<ctx->time_increment_bits) { s->avctx->time_base.den = 1<<ctx->time_increment_bits; } } if (IS_3IV1) time_increment = get_bits1(gb); // FIXME investigate further else time_increment = get_bits(gb, ctx->time_increment_bits); if (s->pict_type != AV_PICTURE_TYPE_B) { s->last_time_base = s->time_base; s->time_base += time_incr; s->time = s->time_base * s->avctx->time_base.den + time_increment; if (s->workaround_bugs & FF_BUG_UMP4) { if (s->time < s->last_non_b_time) { /* header is not mpeg-4-compatible, broken encoder, * trying to workaround */ s->time_base++; s->time += s->avctx->time_base.den; } } s->pp_time = s->time - s->last_non_b_time; s->last_non_b_time = s->time; } else { s->time = (s->last_time_base + time_incr) * s->avctx->time_base.den + time_increment; s->pb_time = s->pp_time - (s->last_non_b_time - s->time); if (s->pp_time <= s->pb_time || s->pp_time <= s->pp_time - s->pb_time || s->pp_time <= 0) { /* messed up order, maybe after seeking? skipping current b-frame */ return FRAME_SKIPPED; } ff_mpeg4_init_direct_mv(s); if (ctx->t_frame == 0) ctx->t_frame = s->pb_time; if (ctx->t_frame == 0) ctx->t_frame = 1; // 1/0 protection s->pp_field_time = (ROUNDED_DIV(s->last_non_b_time, ctx->t_frame) - ROUNDED_DIV(s->last_non_b_time - s->pp_time, ctx->t_frame)) * 2; s->pb_field_time = (ROUNDED_DIV(s->time, ctx->t_frame) - ROUNDED_DIV(s->last_non_b_time - s->pp_time, ctx->t_frame)) * 2; if (!s->progressive_sequence) { if (s->pp_field_time <= s->pb_field_time || s->pb_field_time <= 1) return FRAME_SKIPPED; } } if (s->avctx->time_base.num) pts = ROUNDED_DIV(s->time, s->avctx->time_base.num); else pts = AV_NOPTS_VALUE; if (s->avctx->debug&FF_DEBUG_PTS) av_log(s->avctx, AV_LOG_DEBUG, ""MPEG4 PTS: %""PRId64""\n"", pts); check_marker(gb, ""before vop_coded""); /* vop coded */ if (get_bits1(gb) != 1) { if (s->avctx->debug & FF_DEBUG_PICT_INFO) av_log(s->avctx, AV_LOG_ERROR, ""vop not coded\n""); return FRAME_SKIPPED; } if (ctx->new_pred) decode_new_pred(ctx, gb); if (ctx->shape != BIN_ONLY_SHAPE && (s->pict_type == AV_PICTURE_TYPE_P || (s->pict_type == AV_PICTURE_TYPE_S && ctx->vol_sprite_usage == GMC_SPRITE))) { /* rounding type for motion estimation */ s->no_rounding = get_bits1(gb); } else { s->no_rounding = 0; } // FIXME reduced res stuff if (ctx->shape != RECT_SHAPE) { if (ctx->vol_sprite_usage != 1 || s->pict_type != AV_PICTURE_TYPE_I) { skip_bits(gb, 13); /* width */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* height */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* hor_spat_ref */ skip_bits1(gb); /* marker */ skip_bits(gb, 13); /* ver_spat_ref */ } skip_bits1(gb); /* change_CR_disable */ if (get_bits1(gb) != 0) skip_bits(gb, 8); /* constant_alpha_value */ } // FIXME complexity estimation stuff if (ctx->shape != BIN_ONLY_SHAPE) { skip_bits_long(gb, ctx->cplx_estimation_trash_i); if (s->pict_type != AV_PICTURE_TYPE_I) skip_bits_long(gb, ctx->cplx_estimation_trash_p); if (s->pict_type == AV_PICTURE_TYPE_B) skip_bits_long(gb, ctx->cplx_estimation_trash_b); if (get_bits_left(gb) < 3) { av_log(s->avctx, AV_LOG_ERROR, ""Header truncated\n""); return -1; } ctx->intra_dc_threshold = ff_mpeg4_dc_threshold[get_bits(gb, 3)]; if (!s->progressive_sequence) { s->top_field_first = get_bits1(gb); s->alternate_scan = get_bits1(gb); } else s->alternate_scan = 0; } if (s->alternate_scan) { ff_init_scantable(s->dsp.idct_permutation, &s->inter_scantable, ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_scantable, ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_h_scantable, ff_alternate_vertical_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_v_scantable, ff_alternate_vertical_scan); } else { ff_init_scantable(s->dsp.idct_permutation, &s->inter_scantable, ff_zigzag_direct); ff_init_scantable(s->dsp.idct_permutation, &s->intra_scantable, ff_zigzag_direct); ff_init_scantable(s->dsp.idct_permutation, &s->intra_h_scantable, ff_alternate_horizontal_scan); ff_init_scantable(s->dsp.idct_permutation, &s->intra_v_scantable, ff_alternate_vertical_scan); } if (s->pict_type == AV_PICTURE_TYPE_S && (ctx->vol_sprite_usage == STATIC_SPRITE || ctx->vol_sprite_usage == GMC_SPRITE)) { if (mpeg4_decode_sprite_trajectory(ctx, gb) < 0) return AVERROR_INVALIDDATA; if (ctx->sprite_brightness_change) av_log(s->avctx, AV_LOG_ERROR, ""sprite_brightness_change not supported\n""); if (ctx->vol_sprite_usage == STATIC_SPRITE) av_log(s->avctx, AV_LOG_ERROR, ""static sprite not supported\n""); } if (ctx->shape != BIN_ONLY_SHAPE) { s->chroma_qscale = s->qscale = get_bits(gb, s->quant_precision); if (s->qscale == 0) { av_log(s->avctx, AV_LOG_ERROR, ""Error, header damaged or not MPEG4 header (qscale=0)\n""); return -1; // makes no sense to continue, as there is nothing left from the image then } if (s->pict_type != AV_PICTURE_TYPE_I) { s->f_code = get_bits(gb, 3); /* fcode_for */ if (s->f_code == 0) { av_log(s->avctx, AV_LOG_ERROR, ""Error, header damaged or not MPEG4 header (f_code=0)\n""); s->f_code = 1; return -1; // makes no sense to continue, as there is nothing left from the image then } } else s->f_code = 1; if (s->pict_type == AV_PICTURE_TYPE_B) { s->b_code = get_bits(gb, 3); if (s->b_code == 0) { av_log(s->avctx, AV_LOG_ERROR, ""Error, header damaged or not MPEG4 header (b_code=0)\n""); s->b_code=1; return -1; // makes no sense to continue, as the MV decoding will break very quickly } } else s->b_code = 1; if (s->avctx->debug & FF_DEBUG_PICT_INFO) { av_log(s->avctx, AV_LOG_DEBUG, ""qp:%d fc:%d,%d %s size:%d pro:%d alt:%d top:%d %spel part:%d resync:%d w:%d a:%d rnd:%d vot:%d%s dc:%d ce:%d/%d/%d time:%""PRId64"" tincr:%d\n"", s->qscale, s->f_code, s->b_code, s->pict_type == AV_PICTURE_TYPE_I ? ""I"" : (s->pict_type == AV_PICTURE_TYPE_P ? ""P"" : (s->pict_type == AV_PICTURE_TYPE_B ? ""B"" : ""S"")), gb->size_in_bits,s->progressive_sequence, s->alternate_scan, s->top_field_first, s->quarter_sample ? ""q"" : ""h"", s->data_partitioning, ctx->resync_marker, ctx->num_sprite_warping_points, s->sprite_warping_accuracy, 1 - s->no_rounding, s->vo_type, s->vol_control_parameters ? "" VOLC"" : "" "", ctx->intra_dc_threshold, ctx->cplx_estimation_trash_i, ctx->cplx_estimation_trash_p, ctx->cplx_estimation_trash_b, s->time, time_increment ); } if (!ctx->scalability) { if (ctx->shape != RECT_SHAPE && s->pict_type != AV_PICTURE_TYPE_I) skip_bits1(gb); // vop shape coding type } else { if (ctx->enhancement_type) { int load_backward_shape = get_bits1(gb); if (load_backward_shape) av_log(s->avctx, AV_LOG_ERROR, ""load backward shape isn't supported\n""); } skip_bits(gb, 2); // ref_select_code } } /* detect buggy encoders which don't set the low_delay flag * (divx4/xvid/opendivx). Note we cannot detect divx5 without b-frames * easily (although it's buggy too) */ if (s->vo_type == 0 && s->vol_control_parameters == 0 && ctx->divx_version == -1 && s->picture_number == 0) { av_log(s->avctx, AV_LOG_WARNING, ""looks like this file was encoded with (divx4/(old)xvid/opendivx) -> forcing low_delay flag\n""); s->low_delay = 1; } s->picture_number++; // better than pic number==0 always ;) // FIXME add short header support s->y_dc_scale_table = ff_mpeg4_y_dc_scale_table; s->c_dc_scale_table = ff_mpeg4_c_dc_scale_table; if (s->workaround_bugs & FF_BUG_EDGE) { s->h_edge_pos = s->width; s->v_edge_pos = s->height; } return 0; }","Yes, it is vulnerable."709707,void qemu_mutex_unlock_iothread(void) {},"Yes, it is vulnerable."710708,"static void parallel_isa_realizefn(DeviceState *dev, Error **errp) { static int index; ISADevice *isadev = ISA_DEVICE(dev); ISAParallelState *isa = ISA_PARALLEL(dev); ParallelState *s = &isa->state; int base; uint8_t dummy; if (!s->chr) { error_setg(errp, ""Can't create parallel device, empty char device""); return; } if (isa->index == -1) { isa->index = index; } if (isa->index >= MAX_PARALLEL_PORTS) { error_setg(errp, ""Max. supported number of parallel ports is %d."", MAX_PARALLEL_PORTS); return; } if (isa->iobase == -1) { isa->iobase = isa_parallel_io[isa->index]; } index++; base = isa->iobase; isa_init_irq(isadev, &s->irq, isa->isairq); qemu_register_reset(parallel_reset, s); if (qemu_chr_fe_ioctl(s->chr, CHR_IOCTL_PP_READ_STATUS, &dummy) == 0) { s->hw_driver = 1; s->status = dummy; } isa_register_portio_list(isadev, base, (s->hw_driver ? &isa_parallel_portio_hw_list[0] : &isa_parallel_portio_sw_list[0]), s, ""parallel""); }","Yes, it is vulnerable."711709,"static void test_bmdma_long_prdt(void) { QPCIDevice *dev; QPCIBar bmdma_bar, ide_bar; uint8_t status; PrdtEntry prdt[] = { { .addr = 0, .size = cpu_to_le32(0x1000 | PRDT_EOT), }, }; dev = get_pci_device(&bmdma_bar, &ide_bar); /* Normal request */ status = send_dma_request(CMD_READ_DMA, 0, 1, prdt, ARRAY_SIZE(prdt), NULL); g_assert_cmphex(status, ==, BM_STS_ACTIVE | BM_STS_INTR); assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR); /* Abort the request before it completes */ status = send_dma_request(CMD_READ_DMA | CMDF_ABORT, 0, 1, prdt, ARRAY_SIZE(prdt), NULL); g_assert_cmphex(status, ==, BM_STS_INTR); assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR); }","Yes, it is vulnerable."712710,"static void memory_region_update_coalesced_range(MemoryRegion *mr) { FlatRange *fr; CoalescedMemoryRange *cmr; AddrRange tmp; FOR_EACH_FLAT_RANGE(fr, &address_space_memory.current_map) { if (fr->mr == mr) { qemu_unregister_coalesced_mmio(int128_get64(fr->addr.start), int128_get64(fr->addr.size)); QTAILQ_FOREACH(cmr, &mr->coalesced, link) { tmp = addrrange_shift(cmr->addr, int128_sub(fr->addr.start, int128_make64(fr->offset_in_region))); if (!addrrange_intersects(tmp, fr->addr)) { continue; } tmp = addrrange_intersection(tmp, fr->addr); qemu_register_coalesced_mmio(int128_get64(tmp.start), int128_get64(tmp.size)); } } } }","Yes, it is vulnerable."713711,"static int qxl_init_secondary(PCIDevice *dev) { static int device_id = 1; PCIQXLDevice *qxl = DO_UPCAST(PCIQXLDevice, pci, dev); qxl->id = device_id++; qxl_init_ramsize(qxl, 16); memory_region_init_ram(&qxl->vga.vram, ""qxl.vgavram"", qxl->vga.vram_size); vmstate_register_ram(&qxl->vga.vram, &qxl->pci.qdev); qxl->vga.vram_ptr = memory_region_get_ram_ptr(&qxl->vga.vram); return qxl_init_common(qxl); }","Yes, it is vulnerable."714712,"static void tcg_out_qemu_st_slow_path(TCGContext *s, TCGLabelQemuLdst *l) { TCGMemOp opc = l->opc; TCGMemOp s_bits = opc & MO_SIZE; uint8_t **label_ptr = &l->label_ptr[0]; TCGReg retaddr; /* resolve label address */ *(uint32_t *)label_ptr[0] = (uint32_t)(s->code_ptr - label_ptr[0] - 4); if (TARGET_LONG_BITS > TCG_TARGET_REG_BITS) { *(uint32_t *)label_ptr[1] = (uint32_t)(s->code_ptr - label_ptr[1] - 4); } if (TCG_TARGET_REG_BITS == 32) { int ofs = 0; tcg_out_st(s, TCG_TYPE_PTR, TCG_AREG0, TCG_REG_ESP, ofs); ofs += 4; tcg_out_st(s, TCG_TYPE_I32, l->addrlo_reg, TCG_REG_ESP, ofs); ofs += 4; if (TARGET_LONG_BITS == 64) { tcg_out_st(s, TCG_TYPE_I32, l->addrhi_reg, TCG_REG_ESP, ofs); ofs += 4; } tcg_out_st(s, TCG_TYPE_I32, l->datalo_reg, TCG_REG_ESP, ofs); ofs += 4; if (s_bits == MO_64) { tcg_out_st(s, TCG_TYPE_I32, l->datahi_reg, TCG_REG_ESP, ofs); ofs += 4; } tcg_out_sti(s, TCG_TYPE_I32, TCG_REG_ESP, ofs, l->mem_index); ofs += 4; retaddr = TCG_REG_EAX; tcg_out_movi(s, TCG_TYPE_I32, retaddr, (uintptr_t)l->raddr); tcg_out_st(s, TCG_TYPE_I32, retaddr, TCG_REG_ESP, ofs); } else { tcg_out_mov(s, TCG_TYPE_PTR, tcg_target_call_iarg_regs[0], TCG_AREG0); /* The second argument is already loaded with addrlo. */ tcg_out_mov(s, (s_bits == MO_64 ? TCG_TYPE_I64 : TCG_TYPE_I32), tcg_target_call_iarg_regs[2], l->datalo_reg); tcg_out_movi(s, TCG_TYPE_I32, tcg_target_call_iarg_regs[3], l->mem_index); if (ARRAY_SIZE(tcg_target_call_iarg_regs) > 4) { retaddr = tcg_target_call_iarg_regs[4]; tcg_out_movi(s, TCG_TYPE_PTR, retaddr, (uintptr_t)l->raddr); } else { retaddr = TCG_REG_RAX; tcg_out_movi(s, TCG_TYPE_PTR, retaddr, (uintptr_t)l->raddr); tcg_out_st(s, TCG_TYPE_PTR, retaddr, TCG_REG_ESP, 0); } } /* ""Tail call"" to the helper, with the return address back inline. */ tcg_out_push(s, retaddr); tcg_out_jmp(s, (uintptr_t)qemu_st_helpers[opc]); }","Yes, it is vulnerable."715713,"static int vorbis_encode_frame(AVCodecContext *avctx, AVPacket *avpkt, const AVFrame *frame, int *got_packet_ptr) { vorbis_enc_context *venc = avctx->priv_data; int i, ret, need_more; int samples = 0, frame_size = 1 << (venc->log2_blocksize[1] - 1); vorbis_enc_mode *mode; vorbis_enc_mapping *mapping; PutBitContext pb; if (frame) { if ((ret = ff_af_queue_add(&venc->afq, frame)) < 0) return ret; ff_bufqueue_add(avctx, &venc->bufqueue, av_frame_clone(frame)); } else if (!venc->afq.remaining_samples) return 0; need_more = venc->bufqueue.available * avctx->frame_size < frame_size; need_more = frame && need_more; if (need_more) return 0; /* Pad the bufqueue with empty frames for encoding the last packet. */ if (!frame) { if (venc->bufqueue.available * avctx->frame_size < frame_size) { int frames_needed = (frame_size/avctx->frame_size) - venc->bufqueue.available; for (int i = 0; i < frames_needed; i++) { AVFrame *empty = spawn_empty_frame(avctx, venc->channels); if (!empty) return AVERROR(ENOMEM); ff_bufqueue_add(avctx, &venc->bufqueue, empty); } } } move_audio(venc, venc->scratch, &samples, avctx->frame_size); if (!apply_window_and_mdct(venc, venc->scratch, samples)) return 0; if ((ret = ff_alloc_packet2(avctx, avpkt, 8192, 0)) < 0) return ret; init_put_bits(&pb, avpkt->data, avpkt->size); if (pb.size_in_bits - put_bits_count(&pb) < 1 + ilog(venc->nmodes - 1)) { av_log(avctx, AV_LOG_ERROR, ""output buffer is too small\n""); return AVERROR(EINVAL); } put_bits(&pb, 1, 0); // magic bit put_bits(&pb, ilog(venc->nmodes - 1), 0); // 0 bits, the mode mode = &venc->modes[0]; mapping = &venc->mappings[mode->mapping]; if (mode->blockflag) { put_bits(&pb, 1, 0); put_bits(&pb, 1, 0); } for (i = 0; i < venc->channels; i++) { vorbis_enc_floor *fc = &venc->floors[mapping->floor[mapping->mux[i]]]; uint16_t posts[MAX_FLOOR_VALUES]; floor_fit(venc, fc, &venc->coeffs[i * samples], posts, samples); if (floor_encode(venc, fc, &pb, posts, &venc->floor[i * samples], samples)) { av_log(avctx, AV_LOG_ERROR, ""output buffer is too small\n""); return AVERROR(EINVAL); } } for (i = 0; i < venc->channels * samples; i++) venc->coeffs[i] /= venc->floor[i]; for (i = 0; i < mapping->coupling_steps; i++) { float *mag = venc->coeffs + mapping->magnitude[i] * samples; float *ang = venc->coeffs + mapping->angle[i] * samples; int j; for (j = 0; j < samples; j++) { float a = ang[j]; ang[j] -= mag[j]; if (mag[j] > 0) ang[j] = -ang[j]; if (ang[j] < 0) mag[j] = a; } } if (residue_encode(venc, &venc->residues[mapping->residue[mapping->mux[0]]], &pb, venc->coeffs, samples, venc->channels)) { av_log(avctx, AV_LOG_ERROR, ""output buffer is too small\n""); return AVERROR(EINVAL); } flush_put_bits(&pb); avpkt->size = put_bits_count(&pb) >> 3; ff_af_queue_remove(&venc->afq, frame_size, &avpkt->pts, &avpkt->duration); if (frame_size > avpkt->duration) { uint8_t *side = av_packet_new_side_data(avpkt, AV_PKT_DATA_SKIP_SAMPLES, 10); if (!side) return AVERROR(ENOMEM); AV_WL32(&side[4], frame_size - avpkt->duration); } *got_packet_ptr = 1; return 0; }","No, it is non-vulnerable."716714,"static void gd_set_keycode_type(GtkDisplayState *s) { #ifdef GDK_WINDOWING_X11 GdkDisplay *display = gtk_widget_get_display(s->window); if (GDK_IS_X11_DISPLAY(display)) { Display *x11_display = gdk_x11_display_get_xdisplay(display); XkbDescPtr desc = XkbGetKeyboard(x11_display, XkbGBN_AllComponentsMask, XkbUseCoreKbd); char *keycodes = NULL; if (desc && desc->names) { keycodes = XGetAtomName(x11_display, desc->names->keycodes); if (keycodes == NULL) { fprintf(stderr, ""could not lookup keycode name\n""); } else if (strstart(keycodes, ""evdev"", NULL)) { s->has_evdev = true; } else if (!strstart(keycodes, ""xfree86"", NULL)) { fprintf(stderr, ""unknown keycodes `%s', please report to "" ""qemu-devel@nongnu.org\n"", keycodes); #endif","Yes, it is vulnerable."717715,"static void kvm_client_set_memory(struct CPUPhysMemoryClient *client, target_phys_addr_t start_addr, ram_addr_t size, ram_addr_t phys_offset) { kvm_set_phys_mem(start_addr, size, phys_offset); }","No, it is non-vulnerable."718716,"int coroutine_fn bdrv_co_pdiscard(BlockDriverState *bs, int64_t offset, int count) { BdrvTrackedRequest req; int max_pdiscard, ret; int head, align; if (!bs->drv) { return -ENOMEDIUM; } ret = bdrv_check_byte_request(bs, offset, count); if (ret < 0) { return ret; } else if (bs->read_only) { return -EPERM; } assert(!(bs->open_flags & BDRV_O_INACTIVE)); /* Do nothing if disabled. */ if (!(bs->open_flags & BDRV_O_UNMAP)) { return 0; } if (!bs->drv->bdrv_co_pdiscard && !bs->drv->bdrv_aio_pdiscard) { return 0; } /* Discard is advisory, so ignore any unaligned head or tail */ align = MAX(bs->bl.pdiscard_alignment, bs->bl.request_alignment); assert(align % bs->bl.request_alignment == 0); head = offset % align; if (head) { head = MIN(count, align - head); count -= head; offset += head; } count = QEMU_ALIGN_DOWN(count, align); if (!count) { return 0; } bdrv_inc_in_flight(bs); tracked_request_begin(&req, bs, offset, count, BDRV_TRACKED_DISCARD); ret = notifier_with_return_list_notify(&bs->before_write_notifiers, &req); if (ret < 0) { goto out; } max_pdiscard = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_pdiscard, INT_MAX), align); assert(max_pdiscard); while (count > 0) { int ret; int num = MIN(count, max_pdiscard); if (bs->drv->bdrv_co_pdiscard) { ret = bs->drv->bdrv_co_pdiscard(bs, offset, num); } else { BlockAIOCB *acb; CoroutineIOCompletion co = { .coroutine = qemu_coroutine_self(), }; acb = bs->drv->bdrv_aio_pdiscard(bs, offset, num, bdrv_co_io_em_complete, &co); if (acb == NULL) { ret = -EIO; goto out; } else { qemu_coroutine_yield(); ret = co.ret; } } if (ret && ret != -ENOTSUP) { goto out; } offset += num; count -= num; } ret = 0; out: ++bs->write_gen; bdrv_set_dirty(bs, req.offset >> BDRV_SECTOR_BITS, req.bytes >> BDRV_SECTOR_BITS); tracked_request_end(&req); bdrv_dec_in_flight(bs); return ret; }","No, it is non-vulnerable."719717,"static inline int fp_reg_offset(int regno, TCGMemOp size) { int offs = offsetof(CPUARMState, vfp.regs[regno * 2]); #ifdef HOST_WORDS_BIGENDIAN offs += (8 - (1 << size)); #endif return offs; }","No, it is non-vulnerable."720718,"static inline void RENAME(rgb24tobgr16)(const uint8_t *src, uint8_t *dst, unsigned int src_size) { const uint8_t *s = src; const uint8_t *end; #ifdef HAVE_MMX const uint8_t *mm_end; #endif uint16_t *d = (uint16_t *)dst; end = s + src_size; #ifdef HAVE_MMX __asm __volatile(PREFETCH"" %0""::""m""(*src):""memory""); __asm __volatile( ""movq %0, %%mm7\n\t"" ""movq %1, %%mm6\n\t"" ::""m""(red_16mask),""m""(green_16mask)); mm_end = end - 15; while(s < mm_end) { __asm __volatile( PREFETCH"" 32%1\n\t"" ""movd %1, %%mm0\n\t"" ""movd 3%1, %%mm3\n\t"" ""punpckldq 6%1, %%mm0\n\t"" ""punpckldq 9%1, %%mm3\n\t"" ""movq %%mm0, %%mm1\n\t"" ""movq %%mm0, %%mm2\n\t"" ""movq %%mm3, %%mm4\n\t"" ""movq %%mm3, %%mm5\n\t"" ""psllq $8, %%mm0\n\t"" ""psllq $8, %%mm3\n\t"" ""pand %%mm7, %%mm0\n\t"" ""pand %%mm7, %%mm3\n\t"" ""psrlq $5, %%mm1\n\t"" ""psrlq $5, %%mm4\n\t"" ""pand %%mm6, %%mm1\n\t"" ""pand %%mm6, %%mm4\n\t"" ""psrlq $19, %%mm2\n\t"" ""psrlq $19, %%mm5\n\t"" ""pand %2, %%mm2\n\t"" ""pand %2, %%mm5\n\t"" ""por %%mm1, %%mm0\n\t"" ""por %%mm4, %%mm3\n\t"" ""por %%mm2, %%mm0\n\t"" ""por %%mm5, %%mm3\n\t"" ""psllq $16, %%mm3\n\t"" ""por %%mm3, %%mm0\n\t"" MOVNTQ"" %%mm0, %0\n\t"" :""=m""(*d):""m""(*s),""m""(blue_16mask):""memory""); d += 4; s += 12; } __asm __volatile(SFENCE:::""memory""); __asm __volatile(EMMS:::""memory""); #endif while(s < end) { const int r= *s++; const int g= *s++; const int b= *s++; *d++ = (b>>3) | ((g&0xFC)<<3) | ((r&0xF8)<<8); } }","Yes, it is vulnerable."721719,"static int probe_file(WriterContext *wctx, const char *filename) { AVFormatContext *fmt_ctx; int ret, i; int section_id; do_read_frames = do_show_frames || do_count_frames; do_read_packets = do_show_packets || do_count_packets; ret = open_input_file(&fmt_ctx, filename); if (ret < 0) return ret; nb_streams_frames = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_frames)); nb_streams_packets = av_calloc(fmt_ctx->nb_streams, sizeof(*nb_streams_packets)); selected_streams = av_calloc(fmt_ctx->nb_streams, sizeof(*selected_streams)); for (i = 0; i < fmt_ctx->nb_streams; i++) { if (stream_specifier) { ret = avformat_match_stream_specifier(fmt_ctx, fmt_ctx->streams[i], stream_specifier); if (ret < 0) goto end; else selected_streams[i] = ret; ret = 0; } else { selected_streams[i] = 1; } } if (do_read_frames || do_read_packets) { if (do_show_frames && do_show_packets && wctx->writer->flags & WRITER_FLAG_PUT_PACKETS_AND_FRAMES_IN_SAME_CHAPTER) section_id = SECTION_ID_PACKETS_AND_FRAMES; else if (do_show_packets && !do_show_frames) section_id = SECTION_ID_PACKETS; else // (!do_show_packets && do_show_frames) section_id = SECTION_ID_FRAMES; if (do_show_frames || do_show_packets) writer_print_section_header(wctx, section_id); read_packets(wctx, fmt_ctx); if (do_show_frames || do_show_packets) writer_print_section_footer(wctx); } if (do_show_programs) show_programs(wctx, fmt_ctx); if (do_show_streams) show_streams(wctx, fmt_ctx); if (do_show_chapters) show_chapters(wctx, fmt_ctx); if (do_show_format) show_format(wctx, fmt_ctx); end: close_input_file(&fmt_ctx); av_freep(&nb_streams_frames); av_freep(&nb_streams_packets); av_freep(&selected_streams); return ret; }","No, it is non-vulnerable."722720,"static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos) { BDRVQcowState *s = bs->opaque; int64_t total_sectors = bs->total_sectors; int growable = bs->growable; int ret; BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE); bs->growable = 1; ret = bdrv_pwritev(bs, qcow2_vm_state_offset(s) + pos, qiov); bs->growable = growable; /* bdrv_co_do_writev will have increased the total_sectors value to include * the VM state - the VM state is however not an actual part of the block * device, therefore, we need to restore the old value. */ bs->total_sectors = total_sectors; return ret; }","Yes, it is vulnerable."723721,"static int decode_frame_header(AVCodecContext *ctx, const uint8_t *data, int size, int *ref) { VP9Context *s = ctx->priv_data; int c, i, j, k, l, m, n, w, h, max, size2, res, sharp; int last_invisible; const uint8_t *data2; /* general header */ if ((res = init_get_bits8(&s->gb, data, size)) < 0) { av_log(ctx, AV_LOG_ERROR, ""Failed to initialize bitstream reader\n""); return res; } if (get_bits(&s->gb, 2) != 0x2) { // frame marker av_log(ctx, AV_LOG_ERROR, ""Invalid frame marker\n""); return AVERROR_INVALIDDATA; } s->profile = get_bits1(&s->gb); if (get_bits1(&s->gb)) { // reserved bit av_log(ctx, AV_LOG_ERROR, ""Reserved bit should be zero\n""); return AVERROR_INVALIDDATA; } if (get_bits1(&s->gb)) { *ref = get_bits(&s->gb, 3); return 0; } s->last_uses_2pass = s->uses_2pass; s->last_keyframe = s->keyframe; s->keyframe = !get_bits1(&s->gb); last_invisible = s->invisible; s->invisible = !get_bits1(&s->gb); s->errorres = get_bits1(&s->gb); s->use_last_frame_mvs = !s->errorres && !last_invisible; if (s->keyframe) { if (get_bits_long(&s->gb, 24) != VP9_SYNCCODE) { // synccode av_log(ctx, AV_LOG_ERROR, ""Invalid sync code\n""); return AVERROR_INVALIDDATA; } s->colorspace = get_bits(&s->gb, 3); if (s->colorspace == 7) { // RGB = profile 1 av_log(ctx, AV_LOG_ERROR, ""RGB not supported in profile 0\n""); return AVERROR_INVALIDDATA; } s->fullrange = get_bits1(&s->gb); // for profile 1, here follows the subsampling bits s->refreshrefmask = 0xff; w = get_bits(&s->gb, 16) + 1; h = get_bits(&s->gb, 16) + 1; if (get_bits1(&s->gb)) // display size skip_bits(&s->gb, 32); } else { s->intraonly = s->invisible ? get_bits1(&s->gb) : 0; s->resetctx = s->errorres ? 0 : get_bits(&s->gb, 2); if (s->intraonly) { if (get_bits_long(&s->gb, 24) != VP9_SYNCCODE) { // synccode av_log(ctx, AV_LOG_ERROR, ""Invalid sync code\n""); return AVERROR_INVALIDDATA; } s->refreshrefmask = get_bits(&s->gb, 8); w = get_bits(&s->gb, 16) + 1; h = get_bits(&s->gb, 16) + 1; if (get_bits1(&s->gb)) // display size skip_bits(&s->gb, 32); } else { s->refreshrefmask = get_bits(&s->gb, 8); s->refidx[0] = get_bits(&s->gb, 3); s->signbias[0] = get_bits1(&s->gb); s->refidx[1] = get_bits(&s->gb, 3); s->signbias[1] = get_bits1(&s->gb); s->refidx[2] = get_bits(&s->gb, 3); s->signbias[2] = get_bits1(&s->gb); if (!s->refs[s->refidx[0]].f->data[0] || !s->refs[s->refidx[1]].f->data[0] || !s->refs[s->refidx[2]].f->data[0]) { av_log(ctx, AV_LOG_ERROR, ""Not all references are available\n""); return AVERROR_INVALIDDATA; } if (get_bits1(&s->gb)) { w = s->refs[s->refidx[0]].f->width; h = s->refs[s->refidx[0]].f->height; } else if (get_bits1(&s->gb)) { w = s->refs[s->refidx[1]].f->width; h = s->refs[s->refidx[1]].f->height; } else if (get_bits1(&s->gb)) { w = s->refs[s->refidx[2]].f->width; h = s->refs[s->refidx[2]].f->height; } else { w = get_bits(&s->gb, 16) + 1; h = get_bits(&s->gb, 16) + 1; } // Note that in this code, ""CUR_FRAME"" is actually before we // have formally allocated a frame, and thus actually represents // the _last_ frame s->use_last_frame_mvs &= s->frames[CUR_FRAME].tf.f->width == w && s->frames[CUR_FRAME].tf.f->height == h; if (get_bits1(&s->gb)) // display size skip_bits(&s->gb, 32); s->highprecisionmvs = get_bits1(&s->gb); s->filtermode = get_bits1(&s->gb) ? FILTER_SWITCHABLE : get_bits(&s->gb, 2); s->allowcompinter = s->signbias[0] != s->signbias[1] || s->signbias[0] != s->signbias[2]; if (s->allowcompinter) { if (s->signbias[0] == s->signbias[1]) { s->fixcompref = 2; s->varcompref[0] = 0; s->varcompref[1] = 1; } else if (s->signbias[0] == s->signbias[2]) { s->fixcompref = 1; s->varcompref[0] = 0; s->varcompref[1] = 2; } else { s->fixcompref = 0; s->varcompref[0] = 1; s->varcompref[1] = 2; } } } } s->refreshctx = s->errorres ? 0 : get_bits1(&s->gb); s->parallelmode = s->errorres ? 1 : get_bits1(&s->gb); s->framectxid = c = get_bits(&s->gb, 2); /* loopfilter header data */ s->filter.level = get_bits(&s->gb, 6); sharp = get_bits(&s->gb, 3); // if sharpness changed, reinit lim/mblim LUTs. if it didn't change, keep // the old cache values since they are still valid if (s->filter.sharpness != sharp) memset(s->filter.lim_lut, 0, sizeof(s->filter.lim_lut)); s->filter.sharpness = sharp; if ((s->lf_delta.enabled = get_bits1(&s->gb))) { if (get_bits1(&s->gb)) { for (i = 0; i < 4; i++) if (get_bits1(&s->gb)) s->lf_delta.ref[i] = get_sbits_inv(&s->gb, 6); for (i = 0; i < 2; i++) if (get_bits1(&s->gb)) s->lf_delta.mode[i] = get_sbits_inv(&s->gb, 6); } } else { memset(&s->lf_delta, 0, sizeof(s->lf_delta)); } /* quantization header data */ s->yac_qi = get_bits(&s->gb, 8); s->ydc_qdelta = get_bits1(&s->gb) ? get_sbits_inv(&s->gb, 4) : 0; s->uvdc_qdelta = get_bits1(&s->gb) ? get_sbits_inv(&s->gb, 4) : 0; s->uvac_qdelta = get_bits1(&s->gb) ? get_sbits_inv(&s->gb, 4) : 0; s->lossless = s->yac_qi == 0 && s->ydc_qdelta == 0 && s->uvdc_qdelta == 0 && s->uvac_qdelta == 0; /* segmentation header info */ if ((s->segmentation.enabled = get_bits1(&s->gb))) { if ((s->segmentation.update_map = get_bits1(&s->gb))) { for (i = 0; i < 7; i++) s->prob.seg[i] = get_bits1(&s->gb) ? get_bits(&s->gb, 8) : 255; if ((s->segmentation.temporal = get_bits1(&s->gb))) for (i = 0; i < 3; i++) s->prob.segpred[i] = get_bits1(&s->gb) ? get_bits(&s->gb, 8) : 255; } else { s->use_last_frame_segmap = !s->keyframe && !s->intraonly && s->frames[CUR_FRAME].tf.f->width == w && s->frames[CUR_FRAME].tf.f->height == h; } if (get_bits1(&s->gb)) { s->segmentation.absolute_vals = get_bits1(&s->gb); for (i = 0; i < 8; i++) { if ((s->segmentation.feat[i].q_enabled = get_bits1(&s->gb))) s->segmentation.feat[i].q_val = get_sbits_inv(&s->gb, 8); if ((s->segmentation.feat[i].lf_enabled = get_bits1(&s->gb))) s->segmentation.feat[i].lf_val = get_sbits_inv(&s->gb, 6); if ((s->segmentation.feat[i].ref_enabled = get_bits1(&s->gb))) s->segmentation.feat[i].ref_val = get_bits(&s->gb, 2); s->segmentation.feat[i].skip_enabled = get_bits1(&s->gb); } } } else { s->segmentation.feat[0].q_enabled = 0; s->segmentation.feat[0].lf_enabled = 0; s->segmentation.feat[0].skip_enabled = 0; s->segmentation.feat[0].ref_enabled = 0; } // set qmul[] based on Y/UV, AC/DC and segmentation Q idx deltas for (i = 0; i < (s->segmentation.enabled ? 8 : 1); i++) { int qyac, qydc, quvac, quvdc, lflvl, sh; if (s->segmentation.feat[i].q_enabled) { if (s->segmentation.absolute_vals) qyac = s->segmentation.feat[i].q_val; else qyac = s->yac_qi + s->segmentation.feat[i].q_val; } else { qyac = s->yac_qi; } qydc = av_clip_uintp2(qyac + s->ydc_qdelta, 8); quvdc = av_clip_uintp2(qyac + s->uvdc_qdelta, 8); quvac = av_clip_uintp2(qyac + s->uvac_qdelta, 8); qyac = av_clip_uintp2(qyac, 8); s->segmentation.feat[i].qmul[0][0] = vp9_dc_qlookup[qydc]; s->segmentation.feat[i].qmul[0][1] = vp9_ac_qlookup[qyac]; s->segmentation.feat[i].qmul[1][0] = vp9_dc_qlookup[quvdc]; s->segmentation.feat[i].qmul[1][1] = vp9_ac_qlookup[quvac]; sh = s->filter.level >= 32; if (s->segmentation.feat[i].lf_enabled) { if (s->segmentation.absolute_vals) lflvl = s->segmentation.feat[i].lf_val; else lflvl = s->filter.level + s->segmentation.feat[i].lf_val; } else { lflvl = s->filter.level; } s->segmentation.feat[i].lflvl[0][0] = s->segmentation.feat[i].lflvl[0][1] = av_clip_uintp2(lflvl + (s->lf_delta.ref[0] << sh), 6); for (j = 1; j < 4; j++) { s->segmentation.feat[i].lflvl[j][0] = av_clip_uintp2(lflvl + ((s->lf_delta.ref[j] + s->lf_delta.mode[0]) << sh), 6); s->segmentation.feat[i].lflvl[j][1] = av_clip_uintp2(lflvl + ((s->lf_delta.ref[j] + s->lf_delta.mode[1]) << sh), 6); } } /* tiling info */ if ((res = update_size(ctx, w, h)) < 0) { av_log(ctx, AV_LOG_ERROR, ""Failed to initialize decoder for %dx%d\n"", w, h); return res; } for (s->tiling.log2_tile_cols = 0; (s->sb_cols >> s->tiling.log2_tile_cols) > 64; s->tiling.log2_tile_cols++) ; for (max = 0; (s->sb_cols >> max) >= 4; max++) ; max = FFMAX(0, max - 1); while (max > s->tiling.log2_tile_cols) { if (get_bits1(&s->gb)) s->tiling.log2_tile_cols++; else break; } s->tiling.log2_tile_rows = decode012(&s->gb); s->tiling.tile_rows = 1 << s->tiling.log2_tile_rows; if (s->tiling.tile_cols != (1 << s->tiling.log2_tile_cols)) { s->tiling.tile_cols = 1 << s->tiling.log2_tile_cols; s->c_b = av_fast_realloc(s->c_b, &s->c_b_size, sizeof(VP56RangeCoder) * s->tiling.tile_cols); if (!s->c_b) { av_log(ctx, AV_LOG_ERROR, ""Ran out of memory during range coder init\n""); return AVERROR(ENOMEM); } } if (s->keyframe || s->errorres || s->intraonly) { s->prob_ctx[0].p = s->prob_ctx[1].p = s->prob_ctx[2].p = s->prob_ctx[3].p = vp9_default_probs; memcpy(s->prob_ctx[0].coef, vp9_default_coef_probs, sizeof(vp9_default_coef_probs)); memcpy(s->prob_ctx[1].coef, vp9_default_coef_probs, sizeof(vp9_default_coef_probs)); memcpy(s->prob_ctx[2].coef, vp9_default_coef_probs, sizeof(vp9_default_coef_probs)); memcpy(s->prob_ctx[3].coef, vp9_default_coef_probs, sizeof(vp9_default_coef_probs)); } // next 16 bits is size of the rest of the header (arith-coded) size2 = get_bits(&s->gb, 16); data2 = align_get_bits(&s->gb); if (size2 > size - (data2 - data)) { av_log(ctx, AV_LOG_ERROR, ""Invalid compressed header size\n""); return AVERROR_INVALIDDATA; } ff_vp56_init_range_decoder(&s->c, data2, size2); if (vp56_rac_get_prob_branchy(&s->c, 128)) { // marker bit av_log(ctx, AV_LOG_ERROR, ""Marker bit was set\n""); return AVERROR_INVALIDDATA; } if (s->keyframe || s->intraonly) { memset(s->counts.coef, 0, sizeof(s->counts.coef) + sizeof(s->counts.eob)); } else { memset(&s->counts, 0, sizeof(s->counts)); } // FIXME is it faster to not copy here, but do it down in the fw updates // as explicit copies if the fw update is missing (and skip the copy upon // fw update)? s->prob.p = s->prob_ctx[c].p; // txfm updates if (s->lossless) { s->txfmmode = TX_4X4; } else { s->txfmmode = vp8_rac_get_uint(&s->c, 2); if (s->txfmmode == 3) s->txfmmode += vp8_rac_get(&s->c); if (s->txfmmode == TX_SWITCHABLE) { for (i = 0; i < 2; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.tx8p[i] = update_prob(&s->c, s->prob.p.tx8p[i]); for (i = 0; i < 2; i++) for (j = 0; j < 2; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.tx16p[i][j] = update_prob(&s->c, s->prob.p.tx16p[i][j]); for (i = 0; i < 2; i++) for (j = 0; j < 3; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.tx32p[i][j] = update_prob(&s->c, s->prob.p.tx32p[i][j]); } } // coef updates for (i = 0; i < 4; i++) { uint8_t (*ref)[2][6][6][3] = s->prob_ctx[c].coef[i]; if (vp8_rac_get(&s->c)) { for (j = 0; j < 2; j++) for (k = 0; k < 2; k++) for (l = 0; l < 6; l++) for (m = 0; m < 6; m++) { uint8_t *p = s->prob.coef[i][j][k][l][m]; uint8_t *r = ref[j][k][l][m]; if (m >= 3 && l == 0) // dc only has 3 pt break; for (n = 0; n < 3; n++) { if (vp56_rac_get_prob_branchy(&s->c, 252)) { p[n] = update_prob(&s->c, r[n]); } else { p[n] = r[n]; } } p[3] = 0; } } else { for (j = 0; j < 2; j++) for (k = 0; k < 2; k++) for (l = 0; l < 6; l++) for (m = 0; m < 6; m++) { uint8_t *p = s->prob.coef[i][j][k][l][m]; uint8_t *r = ref[j][k][l][m]; if (m > 3 && l == 0) // dc only has 3 pt break; memcpy(p, r, 3); p[3] = 0; } } if (s->txfmmode == i) break; } // mode updates for (i = 0; i < 3; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.skip[i] = update_prob(&s->c, s->prob.p.skip[i]); if (!s->keyframe && !s->intraonly) { for (i = 0; i < 7; i++) for (j = 0; j < 3; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_mode[i][j] = update_prob(&s->c, s->prob.p.mv_mode[i][j]); if (s->filtermode == FILTER_SWITCHABLE) for (i = 0; i < 4; i++) for (j = 0; j < 2; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.filter[i][j] = update_prob(&s->c, s->prob.p.filter[i][j]); for (i = 0; i < 4; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.intra[i] = update_prob(&s->c, s->prob.p.intra[i]); if (s->allowcompinter) { s->comppredmode = vp8_rac_get(&s->c); if (s->comppredmode) s->comppredmode += vp8_rac_get(&s->c); if (s->comppredmode == PRED_SWITCHABLE) for (i = 0; i < 5; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.comp[i] = update_prob(&s->c, s->prob.p.comp[i]); } else { s->comppredmode = PRED_SINGLEREF; } if (s->comppredmode != PRED_COMPREF) { for (i = 0; i < 5; i++) { if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.single_ref[i][0] = update_prob(&s->c, s->prob.p.single_ref[i][0]); if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.single_ref[i][1] = update_prob(&s->c, s->prob.p.single_ref[i][1]); } } if (s->comppredmode != PRED_SINGLEREF) { for (i = 0; i < 5; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.comp_ref[i] = update_prob(&s->c, s->prob.p.comp_ref[i]); } for (i = 0; i < 4; i++) for (j = 0; j < 9; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.y_mode[i][j] = update_prob(&s->c, s->prob.p.y_mode[i][j]); for (i = 0; i < 4; i++) for (j = 0; j < 4; j++) for (k = 0; k < 3; k++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.partition[3 - i][j][k] = update_prob(&s->c, s->prob.p.partition[3 - i][j][k]); // mv fields don't use the update_prob subexp model for some reason for (i = 0; i < 3; i++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_joint[i] = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; for (i = 0; i < 2; i++) { if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].sign = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; for (j = 0; j < 10; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].classes[j] = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].class0 = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; for (j = 0; j < 10; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].bits[j] = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; } for (i = 0; i < 2; i++) { for (j = 0; j < 2; j++) for (k = 0; k < 3; k++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].class0_fp[j][k] = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; for (j = 0; j < 3; j++) if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].fp[j] = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; } if (s->highprecisionmvs) { for (i = 0; i < 2; i++) { if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].class0_hp = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; if (vp56_rac_get_prob_branchy(&s->c, 252)) s->prob.p.mv_comp[i].hp = (vp8_rac_get_uint(&s->c, 7) << 1) | 1; } } } return (data2 - data) + size2; }","Yes, it is vulnerable."724722,"yuv2422_1_c_template(SwsContext *c, const int16_t *buf0, const int16_t *ubuf[2], const int16_t *vbuf[2], const int16_t *abuf0, uint8_t *dest, int dstW, int uvalpha, int y, enum PixelFormat target) { const int16_t *ubuf0 = ubuf[0], *ubuf1 = ubuf[1], *vbuf0 = vbuf[0], *vbuf1 = vbuf[1]; int i; if (uvalpha < 2048) { for (i = 0; i < (dstW >> 1); i++) { int Y1 = buf0[i * 2] >> 7; int Y2 = buf0[i * 2 + 1] >> 7; int U = ubuf1[i] >> 7; int V = vbuf1[i] >> 7; output_pixels(i * 4, Y1, U, Y2, V); } } else { for (i = 0; i < (dstW >> 1); i++) { int Y1 = buf0[i * 2] >> 7; int Y2 = buf0[i * 2 + 1] >> 7; int U = (ubuf0[i] + ubuf1[i]) >> 8; int V = (vbuf0[i] + vbuf1[i]) >> 8; output_pixels(i * 4, Y1, U, Y2, V); } } }","Yes, it is vulnerable."725723,"static void local_mapped_file_attr(int dirfd, const char *name, struct stat *stbuf) { FILE *fp; char buf[ATTR_MAX]; int map_dirfd; map_dirfd = openat(dirfd, VIRTFS_META_DIR, O_RDONLY | O_DIRECTORY | O_NOFOLLOW); if (map_dirfd == -1) { return; } fp = local_fopenat(map_dirfd, name, ""r""); close_preserve_errno(map_dirfd); if (!fp) { return; } memset(buf, 0, ATTR_MAX); while (fgets(buf, ATTR_MAX, fp)) { if (!strncmp(buf, ""virtfs.uid"", 10)) { stbuf->st_uid = atoi(buf+11); } else if (!strncmp(buf, ""virtfs.gid"", 10)) { stbuf->st_gid = atoi(buf+11); } else if (!strncmp(buf, ""virtfs.mode"", 11)) { stbuf->st_mode = atoi(buf+12); } else if (!strncmp(buf, ""virtfs.rdev"", 11)) { stbuf->st_rdev = atoi(buf+12); } memset(buf, 0, ATTR_MAX); } fclose(fp); }","Yes, it is vulnerable."726724,"pci_e1000_init(PCIBus *bus, NICInfo *nd, int devfn) { E1000State *d; uint8_t *pci_conf; uint16_t checksum = 0; static const char info_str[] = ""e1000""; int i; d = (E1000State *)pci_register_device(bus, ""e1000"", sizeof(E1000State), devfn, NULL, NULL); pci_conf = d->dev.config; memset(pci_conf, 0, 256); pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL); pci_config_set_device_id(pci_conf, E1000_DEVID); *(uint16_t *)(pci_conf+0x04) = cpu_to_le16(0x0407); *(uint16_t *)(pci_conf+0x06) = cpu_to_le16(0x0010); pci_conf[0x08] = 0x03; pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET); pci_conf[0x0c] = 0x10; pci_conf[0x3d] = 1; // interrupt pin 0 d->mmio_index = cpu_register_io_memory(0, e1000_mmio_read, e1000_mmio_write, d); pci_register_io_region((PCIDevice *)d, 0, PNPMMIO_SIZE, PCI_ADDRESS_SPACE_MEM, e1000_mmio_map); pci_register_io_region((PCIDevice *)d, 1, IOPORT_SIZE, PCI_ADDRESS_SPACE_IO, ioport_map); memmove(d->eeprom_data, e1000_eeprom_template, sizeof e1000_eeprom_template); for (i = 0; i < 3; i++) d->eeprom_data[i] = (nd->macaddr[2*i+1]<<8) | nd->macaddr[2*i]; for (i = 0; i < EEPROM_CHECKSUM_REG; i++) checksum += d->eeprom_data[i]; checksum = (uint16_t) EEPROM_SUM - checksum; d->eeprom_data[EEPROM_CHECKSUM_REG] = checksum; memset(d->phy_reg, 0, sizeof d->phy_reg); memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init); memset(d->mac_reg, 0, sizeof d->mac_reg); memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init); d->rxbuf_min_shift = 1; memset(&d->tx, 0, sizeof d->tx); d->vc = qemu_new_vlan_client(nd->vlan, nd->model, nd->name, e1000_receive, e1000_can_receive, d); d->vc->link_status_changed = e1000_set_link_status; qemu_format_nic_info_str(d->vc, nd->macaddr); register_savevm(info_str, -1, 2, nic_save, nic_load, d); d->dev.unregister = pci_e1000_uninit; return (PCIDevice *)d; }","Yes, it is vulnerable."727725,"static void legacy_kbd_event(DeviceState *dev, QemuConsole *src, InputEvent *evt) { QEMUPutKbdEntry *entry = (QEMUPutKbdEntry *)dev; int scancodes[3], i, count; if (!entry || !entry->put_kbd) { return; } count = qemu_input_key_value_to_scancode(evt->key->key, evt->key->down, scancodes); for (i = 0; i < count; i++) { entry->put_kbd(entry->opaque, scancodes[i]); } }","No, it is non-vulnerable."728726,"PITState *pit_init(int base, qemu_irq irq) { PITState *pit = &pit_state; PITChannelState *s; s = &pit->channels[0]; /* the timer 0 is connected to an IRQ */ s->irq_timer = qemu_new_timer(vm_clock, pit_irq_timer, s); s->irq = irq; vmstate_register(base, &vmstate_pit, pit); qemu_register_reset(pit_reset, pit); register_ioport_write(base, 4, 1, pit_ioport_write, pit); register_ioport_read(base, 3, 1, pit_ioport_read, pit); pit_reset(pit); return pit; }","No, it is non-vulnerable."729727,"static int qxl_init_common(PCIQXLDevice *qxl) { uint8_t* config = qxl->pci.config; uint32_t pci_device_id; uint32_t pci_device_rev; uint32_t io_size; qxl->mode = QXL_MODE_UNDEFINED; qxl->generation = 1; qxl->num_memslots = NUM_MEMSLOTS; qxl->num_surfaces = NUM_SURFACES; switch (qxl->revision) { case 1: /* spice 0.4 -- qxl-1 */ pci_device_id = QXL_DEVICE_ID_STABLE; pci_device_rev = QXL_REVISION_STABLE_V04; break; case 2: /* spice 0.6 -- qxl-2 */ pci_device_id = QXL_DEVICE_ID_STABLE; pci_device_rev = QXL_REVISION_STABLE_V06; break; default: /* experimental */ pci_device_id = QXL_DEVICE_ID_DEVEL; pci_device_rev = 1; break; } pci_config_set_vendor_id(config, REDHAT_PCI_VENDOR_ID); pci_config_set_device_id(config, pci_device_id); pci_set_byte(&config[PCI_REVISION_ID], pci_device_rev); pci_set_byte(&config[PCI_INTERRUPT_PIN], 1); qxl->rom_size = qxl_rom_size(); qxl->rom_offset = qemu_ram_alloc(&qxl->pci.qdev, ""qxl.vrom"", qxl->rom_size); init_qxl_rom(qxl); init_qxl_ram(qxl); if (qxl->vram_size < 16 * 1024 * 1024) { qxl->vram_size = 16 * 1024 * 1024; } if (qxl->revision == 1) { qxl->vram_size = 4096; } qxl->vram_size = msb_mask(qxl->vram_size * 2 - 1); qxl->vram_offset = qemu_ram_alloc(&qxl->pci.qdev, ""qxl.vram"", qxl->vram_size); io_size = msb_mask(QXL_IO_RANGE_SIZE * 2 - 1); if (qxl->revision == 1) { io_size = 8; } pci_register_bar(&qxl->pci, QXL_IO_RANGE_INDEX, io_size, PCI_BASE_ADDRESS_SPACE_IO, qxl_map); pci_register_bar(&qxl->pci, QXL_ROM_RANGE_INDEX, qxl->rom_size, PCI_BASE_ADDRESS_SPACE_MEMORY, qxl_map); pci_register_bar(&qxl->pci, QXL_RAM_RANGE_INDEX, qxl->vga.vram_size, PCI_BASE_ADDRESS_SPACE_MEMORY, qxl_map); pci_register_bar(&qxl->pci, QXL_VRAM_RANGE_INDEX, qxl->vram_size, PCI_BASE_ADDRESS_SPACE_MEMORY, qxl_map); qxl->ssd.qxl.base.sif = &qxl_interface.base; qxl->ssd.qxl.id = qxl->id; qemu_spice_add_interface(&qxl->ssd.qxl.base); qemu_add_vm_change_state_handler(qxl_vm_change_state_handler, qxl); init_pipe_signaling(qxl); qxl_reset_state(qxl); return 0; }","No, it is non-vulnerable."730728,"static TCGReg tcg_out_tlb_read(TCGContext* s, TCGReg addr_reg, TCGMemOp opc, int mem_index, bool is_ld) { int s_mask = (1 << (opc & MO_SIZE)) - 1; int ofs, a_off; uint64_t tlb_mask; /* For aligned accesses, we check the first byte and include the alignment bits within the address. For unaligned access, we check that we don't cross pages using the address of the last byte of the access. */ if ((opc & MO_AMASK) == MO_ALIGN || s_mask == 0) { a_off = 0; tlb_mask = TARGET_PAGE_MASK | s_mask; } else { a_off = s_mask; tlb_mask = TARGET_PAGE_MASK; } if (facilities & FACILITY_GEN_INST_EXT) { tcg_out_risbg(s, TCG_REG_R2, addr_reg, 64 - CPU_TLB_BITS - CPU_TLB_ENTRY_BITS, 63 - CPU_TLB_ENTRY_BITS, 64 + CPU_TLB_ENTRY_BITS - TARGET_PAGE_BITS, 1); if (a_off) { tcg_out_insn(s, RX, LA, TCG_REG_R3, addr_reg, TCG_REG_NONE, a_off); tgen_andi(s, TCG_TYPE_TL, TCG_REG_R3, tlb_mask); } else { tgen_andi_risbg(s, TCG_REG_R3, addr_reg, tlb_mask); } } else { tcg_out_sh64(s, RSY_SRLG, TCG_REG_R2, addr_reg, TCG_REG_NONE, TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS); tcg_out_insn(s, RX, LA, TCG_REG_R3, addr_reg, TCG_REG_NONE, a_off); tgen_andi(s, TCG_TYPE_I64, TCG_REG_R2, (CPU_TLB_SIZE - 1) << CPU_TLB_ENTRY_BITS); tgen_andi(s, TCG_TYPE_TL, TCG_REG_R3, tlb_mask); } if (is_ld) { ofs = offsetof(CPUArchState, tlb_table[mem_index][0].addr_read); } else { ofs = offsetof(CPUArchState, tlb_table[mem_index][0].addr_write); } if (TARGET_LONG_BITS == 32) { tcg_out_mem(s, RX_C, RXY_CY, TCG_REG_R3, TCG_REG_R2, TCG_AREG0, ofs); } else { tcg_out_mem(s, 0, RXY_CG, TCG_REG_R3, TCG_REG_R2, TCG_AREG0, ofs); } ofs = offsetof(CPUArchState, tlb_table[mem_index][0].addend); tcg_out_mem(s, 0, RXY_LG, TCG_REG_R2, TCG_REG_R2, TCG_AREG0, ofs); if (TARGET_LONG_BITS == 32) { tgen_ext32u(s, TCG_REG_R3, addr_reg); return TCG_REG_R3; } return addr_reg; }","No, it is non-vulnerable."731729,"static void unterminated_literal(void) { QObject *obj = qobject_from_json(""nul"", NULL); g_assert(obj == NULL); }","Yes, it is vulnerable."732730,"static void decode_sublayer_hrd(HEVCContext *s, int nb_cpb, int subpic_params_present) { GetBitContext *gb = &s->HEVClc.gb; int i; for (i = 0; i < nb_cpb; i++) { get_ue_golomb_long(gb); // bit_rate_value_minus1 get_ue_golomb_long(gb); // cpb_size_value_minus1 if (subpic_params_present) { get_ue_golomb_long(gb); // cpb_size_du_value_minus1 get_ue_golomb_long(gb); // bit_rate_du_value_minus1 } skip_bits1(gb); // cbr_flag } }","Yes, it is vulnerable."733731,"static inline int onenand_load_main(OneNANDState *s, int sec, int secn, void *dest) { if (s->blk_cur) { return blk_read(s->blk_cur, sec, dest, secn) < 0; } else if (sec + secn > s->secs_cur) { return 1; } memcpy(dest, s->current + (sec << 9), secn << 9); return 0; }","Yes, it is vulnerable."734732,"static void flush_trace_file(void) { /* If the trace file is not open yet, open it now */ if (!trace_fp) { trace_fp = fopen(trace_file_name, ""w""); if (!trace_fp) { /* Avoid repeatedly trying to open file on failure */ trace_file_enabled = false; return; } write_header(trace_fp); } if (trace_fp) { size_t unused; /* for when fwrite(3) is declared warn_unused_result */ unused = fwrite(trace_buf, trace_idx * sizeof(trace_buf[0]), 1, trace_fp); } }","Yes, it is vulnerable."735733,"void helper_fxtoq(CPUSPARCState *env, int64_t src) { /* No possible exceptions converting long long to long double. */ QT0 = int64_to_float128(src, &env->fp_status); }","No, it is non-vulnerable."736734,"static void v9fs_open(void *opaque) { int flags; int32_t fid; int32_t mode; V9fsQID qid; int iounit = 0; ssize_t err = 0; size_t offset = 7; struct stat stbuf; V9fsFidState *fidp; V9fsPDU *pdu = opaque; V9fsState *s = pdu->s; if (s->proto_version == V9FS_PROTO_2000L) { pdu_unmarshal(pdu, offset, ""dd"", &fid, &mode); } else { pdu_unmarshal(pdu, offset, ""db"", &fid, &mode); } trace_v9fs_open(pdu->tag, pdu->id, fid, mode); fidp = get_fid(pdu, fid); if (fidp == NULL) { err = -ENOENT; goto out_nofid; } BUG_ON(fidp->fid_type != P9_FID_NONE); err = v9fs_co_lstat(pdu, &fidp->path, &stbuf); if (err < 0) { goto out; } stat_to_qid(&stbuf, &qid); if (S_ISDIR(stbuf.st_mode)) { err = v9fs_co_opendir(pdu, fidp); if (err < 0) { goto out; } fidp->fid_type = P9_FID_DIR; offset += pdu_marshal(pdu, offset, ""Qd"", &qid, 0); err = offset; } else { if (s->proto_version == V9FS_PROTO_2000L) { flags = get_dotl_openflags(s, mode); } else { flags = omode_to_uflags(mode); } if (is_ro_export(&s->ctx)) { if (mode & O_WRONLY || mode & O_RDWR || mode & O_APPEND || mode & O_TRUNC) { err = -EROFS; goto out; } flags |= O_NOATIME; } err = v9fs_co_open(pdu, fidp, flags); if (err < 0) { goto out; } fidp->fid_type = P9_FID_FILE; fidp->open_flags = flags; if (flags & O_EXCL) { /* * We let the host file system do O_EXCL check * We should not reclaim such fd */ fidp->flags |= FID_NON_RECLAIMABLE; } iounit = get_iounit(pdu, &fidp->path); offset += pdu_marshal(pdu, offset, ""Qd"", &qid, iounit); err = offset; } trace_v9fs_open_return(pdu->tag, pdu->id, qid.type, qid.version, qid.path, iounit); out: put_fid(pdu, fidp); out_nofid: complete_pdu(s, pdu, err); }","No, it is non-vulnerable."737735,"static int pci_piix3_ide_initfn(PCIDevice *dev) { PCIIDEState *d = DO_UPCAST(PCIIDEState, dev, dev); pci_config_set_vendor_id(d->dev.config, PCI_VENDOR_ID_INTEL); pci_config_set_device_id(d->dev.config, PCI_DEVICE_ID_INTEL_82371SB_1); return pci_piix_ide_initfn(d); }","No, it is non-vulnerable."738736,"static abi_long do_getpeername(int fd, abi_ulong target_addr, abi_ulong target_addrlen_addr) { socklen_t addrlen; void *addr; abi_long ret; if (get_user_u32(addrlen, target_addrlen_addr)) return -TARGET_EFAULT; if (addrlen < 0 || addrlen > MAX_SOCK_ADDR) return -TARGET_EINVAL; addr = alloca(addrlen); ret = get_errno(getpeername(fd, addr, &addrlen)); if (!is_error(ret)) { host_to_target_sockaddr(target_addr, addr, addrlen); if (put_user_u32(addrlen, target_addrlen_addr)) ret = -TARGET_EFAULT; } return ret; }","No, it is non-vulnerable."739737,"void ppc_hash64_set_external_hpt(PowerPCCPU *cpu, void *hpt, int shift, Error **errp) { CPUPPCState *env = &cpu->env; Error *local_err = NULL; cpu_synchronize_state(CPU(cpu)); env->external_htab = hpt; ppc_hash64_set_sdr1(cpu, (target_ulong)(uintptr_t)hpt | (shift - 18), &local_err); if (local_err) { error_propagate(errp, local_err); return; } /* Not strictly necessary, but makes it clearer that an external * htab is in use when debugging */ env->htab_base = -1; if (kvm_enabled()) { if (kvmppc_put_books_sregs(cpu) < 0) { error_setg(errp, ""Unable to update SDR1 in KVM""); } } }","No, it is non-vulnerable."740738,"void numa_set_mem_node_id(ram_addr_t addr, uint64_t size, uint32_t node) { struct numa_addr_range *range = g_malloc0(sizeof(*range)); /* * Memory-less nodes can come here with 0 size in which case, * there is nothing to do. */ if (!size) { return; } range->mem_start = addr; range->mem_end = addr + size - 1; QLIST_INSERT_HEAD(&numa_info[node].addr, range, entry); }","Yes, it is vulnerable."741739,"static inline int cris_bound_d(int v, int b) { int r = v; asm (""bound.d\t%1, %0\n"" : ""+r"" (r) : ""ri"" (b)); return r; }","Yes, it is vulnerable."742740,"static void mpeg4_encode_visual_object_header(MpegEncContext * s){ int profile_and_level_indication; int vo_ver_id; if(s->max_b_frames || s->quarter_sample){ profile_and_level_indication= 0xF1; // adv simple level 1 vo_ver_id= 5; }else{ profile_and_level_indication= 0x01; // simple level 1 vo_ver_id= 1; } //FIXME levels put_bits(&s->pb, 16, 0); put_bits(&s->pb, 16, VOS_STARTCODE); put_bits(&s->pb, 8, profile_and_level_indication); put_bits(&s->pb, 16, 0); put_bits(&s->pb, 16, VISUAL_OBJ_STARTCODE); put_bits(&s->pb, 1, 1); put_bits(&s->pb, 4, vo_ver_id); put_bits(&s->pb, 3, 1); //priority put_bits(&s->pb, 4, 1); //visual obj type== video obj put_bits(&s->pb, 1, 0); //video signal type == no clue //FIXME ff_mpeg4_stuffing(&s->pb); }","No, it is non-vulnerable."743741,"static void add_entry1(TiffEncoderContext *s, enum TiffTags tag, enum TiffTypes type, int val) { uint16_t w = val; uint32_t dw = val; add_entry(s, tag, type, 1, type == TIFF_SHORT ? (void *)&w : (void *)&dw); }","No, it is non-vulnerable."744742,"static const char *pxb_host_root_bus_path(PCIHostState *host_bridge, PCIBus *rootbus) { PXBBus *bus = PXB_BUS(rootbus); snprintf(bus->bus_path, 8, ""0000:%02x"", pxb_bus_num(rootbus)); return bus->bus_path; }","No, it is non-vulnerable."745743,"int qemu_strtou64(const char *nptr, const char **endptr, int base, uint64_t *result) { char *p; int err = 0; if (!nptr) { if (endptr) { *endptr = nptr; } err = -EINVAL; } else { errno = 0; /* FIXME This assumes uint64_t is unsigned long long */ *result = strtoull(nptr, &p, base); /* Windows returns 1 for negative out-of-range values. */ if (errno == ERANGE) { *result = -1; } err = check_strtox_error(nptr, p, endptr, errno); } return err; }","No, it is non-vulnerable."746744,"int ff_hevc_decode_nal_sps(HEVCContext *s) { const AVPixFmtDescriptor *desc; GetBitContext *gb = &s->HEVClc->gb; int ret = 0; int sps_id = 0; int log2_diff_max_min_transform_block_size; int bit_depth_chroma, start, vui_present, sublayer_ordering_info; int i; HEVCSPS *sps; AVBufferRef *sps_buf = av_buffer_allocz(sizeof(*sps)); if (!sps_buf) return AVERROR(ENOMEM); sps = (HEVCSPS*)sps_buf->data; av_log(s->avctx, AV_LOG_DEBUG, ""Decoding SPS\n""); // Coded parameters sps->vps_id = get_bits(gb, 4); if (sps->vps_id >= MAX_VPS_COUNT) { av_log(s->avctx, AV_LOG_ERROR, ""VPS id out of range: %d\n"", sps->vps_id); ret = AVERROR_INVALIDDATA; goto err; } if (!s->vps_list[sps->vps_id]) { av_log(s->avctx, AV_LOG_ERROR, ""VPS does not exist \n""); ret = AVERROR_INVALIDDATA; goto err; } sps->max_sub_layers = get_bits(gb, 3) + 1; if (sps->max_sub_layers > MAX_SUB_LAYERS) { av_log(s->avctx, AV_LOG_ERROR, ""sps_max_sub_layers out of range: %d\n"", sps->max_sub_layers); ret = AVERROR_INVALIDDATA; goto err; } skip_bits1(gb); // temporal_id_nesting_flag parse_ptl(s, &sps->ptl, sps->max_sub_layers); sps_id = get_ue_golomb_long(gb); if (sps_id >= MAX_SPS_COUNT) { av_log(s->avctx, AV_LOG_ERROR, ""SPS id out of range: %d\n"", sps_id); ret = AVERROR_INVALIDDATA; goto err; } sps->chroma_format_idc = get_ue_golomb_long(gb); if (sps->chroma_format_idc != 1) { avpriv_report_missing_feature(s->avctx, ""chroma_format_idc != 1\n""); ret = AVERROR_PATCHWELCOME; goto err; } if (sps->chroma_format_idc == 3) sps->separate_colour_plane_flag = get_bits1(gb); sps->width = get_ue_golomb_long(gb); sps->height = get_ue_golomb_long(gb); if ((ret = av_image_check_size(sps->width, sps->height, 0, s->avctx)) < 0) goto err; if (get_bits1(gb)) { // pic_conformance_flag //TODO: * 2 is only valid for 420 sps->pic_conf_win.left_offset = get_ue_golomb_long(gb) * 2; sps->pic_conf_win.right_offset = get_ue_golomb_long(gb) * 2; sps->pic_conf_win.top_offset = get_ue_golomb_long(gb) * 2; sps->pic_conf_win.bottom_offset = get_ue_golomb_long(gb) * 2; if (s->avctx->flags2 & CODEC_FLAG2_IGNORE_CROP) { av_log(s->avctx, AV_LOG_DEBUG, ""discarding sps conformance window, "" ""original values are l:%u r:%u t:%u b:%u\n"", sps->pic_conf_win.left_offset, sps->pic_conf_win.right_offset, sps->pic_conf_win.top_offset, sps->pic_conf_win.bottom_offset); sps->pic_conf_win.left_offset = sps->pic_conf_win.right_offset = sps->pic_conf_win.top_offset = sps->pic_conf_win.bottom_offset = 0; } sps->output_window = sps->pic_conf_win; } sps->bit_depth = get_ue_golomb_long(gb) + 8; bit_depth_chroma = get_ue_golomb_long(gb) + 8; if (bit_depth_chroma != sps->bit_depth) { av_log(s->avctx, AV_LOG_ERROR, ""Luma bit depth (%d) is different from chroma bit depth (%d), "" ""this is unsupported.\n"", sps->bit_depth, bit_depth_chroma); ret = AVERROR_INVALIDDATA; goto err; } if (sps->chroma_format_idc == 1) { switch (sps->bit_depth) { case 8: sps->pix_fmt = AV_PIX_FMT_YUV420P; break; case 9: sps->pix_fmt = AV_PIX_FMT_YUV420P9; break; case 10: sps->pix_fmt = AV_PIX_FMT_YUV420P10; break; default: av_log(s->avctx, AV_LOG_ERROR, ""Unsupported bit depth: %d\n"", sps->bit_depth); ret = AVERROR_PATCHWELCOME; goto err; } } else { av_log(s->avctx, AV_LOG_ERROR, ""non-4:2:0 support is currently unspecified.\n""); return AVERROR_PATCHWELCOME; } desc = av_pix_fmt_desc_get(sps->pix_fmt); if (!desc) { ret = AVERROR(EINVAL); goto err; } sps->hshift[0] = sps->vshift[0] = 0; sps->hshift[2] = sps->hshift[1] = desc->log2_chroma_w; sps->vshift[2] = sps->vshift[1] = desc->log2_chroma_h; sps->pixel_shift = sps->bit_depth > 8; sps->log2_max_poc_lsb = get_ue_golomb_long(gb) + 4; if (sps->log2_max_poc_lsb > 16) { av_log(s->avctx, AV_LOG_ERROR, ""log2_max_pic_order_cnt_lsb_minus4 out range: %d\n"", sps->log2_max_poc_lsb - 4); ret = AVERROR_INVALIDDATA; goto err; } sublayer_ordering_info = get_bits1(gb); start = sublayer_ordering_info ? 0 : sps->max_sub_layers - 1; for (i = start; i < sps->max_sub_layers; i++) { sps->temporal_layer[i].max_dec_pic_buffering = get_ue_golomb_long(gb) + 1; sps->temporal_layer[i].num_reorder_pics = get_ue_golomb_long(gb); sps->temporal_layer[i].max_latency_increase = get_ue_golomb_long(gb) - 1; if (sps->temporal_layer[i].max_dec_pic_buffering > MAX_DPB_SIZE) { av_log(s->avctx, AV_LOG_ERROR, ""sps_max_dec_pic_buffering_minus1 out of range: %d\n"", sps->temporal_layer[i].max_dec_pic_buffering - 1); ret = AVERROR_INVALIDDATA; goto err; } if (sps->temporal_layer[i].num_reorder_pics > sps->temporal_layer[i].max_dec_pic_buffering - 1) { av_log(s->avctx, AV_LOG_ERROR, ""sps_max_num_reorder_pics out of range: %d\n"", sps->temporal_layer[i].num_reorder_pics); ret = AVERROR_INVALIDDATA; goto err; } } if (!sublayer_ordering_info) { for (i = 0; i < start; i++) { sps->temporal_layer[i].max_dec_pic_buffering = sps->temporal_layer[start].max_dec_pic_buffering; sps->temporal_layer[i].num_reorder_pics = sps->temporal_layer[start].num_reorder_pics; sps->temporal_layer[i].max_latency_increase = sps->temporal_layer[start].max_latency_increase; } } sps->log2_min_cb_size = get_ue_golomb_long(gb) + 3; sps->log2_diff_max_min_coding_block_size = get_ue_golomb_long(gb); sps->log2_min_tb_size = get_ue_golomb_long(gb) + 2; log2_diff_max_min_transform_block_size = get_ue_golomb_long(gb); sps->log2_max_trafo_size = log2_diff_max_min_transform_block_size + sps->log2_min_tb_size; if (sps->log2_min_tb_size >= sps->log2_min_cb_size) { av_log(s->avctx, AV_LOG_ERROR, ""Invalid value for log2_min_tb_size""); ret = AVERROR_INVALIDDATA; goto err; } sps->max_transform_hierarchy_depth_inter = get_ue_golomb_long(gb); sps->max_transform_hierarchy_depth_intra = get_ue_golomb_long(gb); sps->scaling_list_enable_flag = get_bits1(gb); if (sps->scaling_list_enable_flag) { set_default_scaling_list_data(&sps->scaling_list); if (get_bits1(gb)) { ret = scaling_list_data(s, &sps->scaling_list); if (ret < 0) goto err; } } sps->amp_enabled_flag = get_bits1(gb); sps->sao_enabled = get_bits1(gb); sps->pcm_enabled_flag = get_bits1(gb); if (sps->pcm_enabled_flag) { sps->pcm.bit_depth = get_bits(gb, 4) + 1; sps->pcm.bit_depth_chroma = get_bits(gb, 4) + 1; sps->pcm.log2_min_pcm_cb_size = get_ue_golomb_long(gb) + 3; sps->pcm.log2_max_pcm_cb_size = sps->pcm.log2_min_pcm_cb_size + get_ue_golomb_long(gb); if (sps->pcm.bit_depth > sps->bit_depth) { av_log(s->avctx, AV_LOG_ERROR, ""PCM bit depth (%d) is greater than normal bit depth (%d)\n"", sps->pcm.bit_depth, sps->bit_depth); ret = AVERROR_INVALIDDATA; goto err; } sps->pcm.loop_filter_disable_flag = get_bits1(gb); } sps->nb_st_rps = get_ue_golomb_long(gb); if (sps->nb_st_rps > MAX_SHORT_TERM_RPS_COUNT) { av_log(s->avctx, AV_LOG_ERROR, ""Too many short term RPS: %d.\n"", sps->nb_st_rps); ret = AVERROR_INVALIDDATA; goto err; } for (i = 0; i < sps->nb_st_rps; i++) { if ((ret = ff_hevc_decode_short_term_rps(s, &sps->st_rps[i], sps, 0)) < 0) goto err; } sps->long_term_ref_pics_present_flag = get_bits1(gb); if (sps->long_term_ref_pics_present_flag) { sps->num_long_term_ref_pics_sps = get_ue_golomb_long(gb); for (i = 0; i < sps->num_long_term_ref_pics_sps; i++) { sps->lt_ref_pic_poc_lsb_sps[i] = get_bits(gb, sps->log2_max_poc_lsb); sps->used_by_curr_pic_lt_sps_flag[i] = get_bits1(gb); } } sps->sps_temporal_mvp_enabled_flag = get_bits1(gb); sps->sps_strong_intra_smoothing_enable_flag = get_bits1(gb); sps->vui.sar = (AVRational){0, 1}; vui_present = get_bits1(gb); if (vui_present) decode_vui(s, sps); skip_bits1(gb); // sps_extension_flag if (s->apply_defdispwin) { sps->output_window.left_offset += sps->vui.def_disp_win.left_offset; sps->output_window.right_offset += sps->vui.def_disp_win.right_offset; sps->output_window.top_offset += sps->vui.def_disp_win.top_offset; sps->output_window.bottom_offset += sps->vui.def_disp_win.bottom_offset; } if (sps->output_window.left_offset & (0x1F >> (sps->pixel_shift)) && !(s->avctx->flags & CODEC_FLAG_UNALIGNED)) { sps->output_window.left_offset &= ~(0x1F >> (sps->pixel_shift)); av_log(s->avctx, AV_LOG_WARNING, ""Reducing left output window to %d "" ""chroma samples to preserve alignment.\n"", sps->output_window.left_offset); } sps->output_width = sps->width - (sps->output_window.left_offset + sps->output_window.right_offset); sps->output_height = sps->height - (sps->output_window.top_offset + sps->output_window.bottom_offset); if (sps->output_width <= 0 || sps->output_height <= 0) { av_log(s->avctx, AV_LOG_WARNING, ""Invalid visible frame dimensions: %dx%d.\n"", sps->output_width, sps->output_height); if (s->avctx->err_recognition & AV_EF_EXPLODE) { ret = AVERROR_INVALIDDATA; goto err; } av_log(s->avctx, AV_LOG_WARNING, ""Displaying the whole video surface.\n""); sps->pic_conf_win.left_offset = sps->pic_conf_win.right_offset = sps->pic_conf_win.top_offset = sps->pic_conf_win.bottom_offset = 0; sps->output_width = sps->width; sps->output_height = sps->height; } // Inferred parameters sps->log2_ctb_size = sps->log2_min_cb_size + sps->log2_diff_max_min_coding_block_size; sps->log2_min_pu_size = sps->log2_min_cb_size - 1; sps->ctb_width = (sps->width + (1 << sps->log2_ctb_size) - 1) >> sps->log2_ctb_size; sps->ctb_height = (sps->height + (1 << sps->log2_ctb_size) - 1) >> sps->log2_ctb_size; sps->ctb_size = sps->ctb_width * sps->ctb_height; sps->min_cb_width = sps->width >> sps->log2_min_cb_size; sps->min_cb_height = sps->height >> sps->log2_min_cb_size; sps->min_tb_width = sps->width >> sps->log2_min_tb_size; sps->min_tb_height = sps->height >> sps->log2_min_tb_size; sps->min_pu_width = sps->width >> sps->log2_min_pu_size; sps->min_pu_height = sps->height >> sps->log2_min_pu_size; sps->qp_bd_offset = 6 * (sps->bit_depth - 8); if (sps->width & ((1 << sps->log2_min_cb_size) - 1) || sps->height & ((1 << sps->log2_min_cb_size) - 1)) { av_log(s->avctx, AV_LOG_ERROR, ""Invalid coded frame dimensions.\n""); goto err; } if (sps->log2_ctb_size > MAX_LOG2_CTB_SIZE) { av_log(s->avctx, AV_LOG_ERROR, ""CTB size out of range: 2^%d\n"", sps->log2_ctb_size); goto err; } if (sps->max_transform_hierarchy_depth_inter > sps->log2_ctb_size - sps->log2_min_tb_size) { av_log(s->avctx, AV_LOG_ERROR, ""max_transform_hierarchy_depth_inter out of range: %d\n"", sps->max_transform_hierarchy_depth_inter); goto err; } if (sps->max_transform_hierarchy_depth_intra > sps->log2_ctb_size - sps->log2_min_tb_size) { av_log(s->avctx, AV_LOG_ERROR, ""max_transform_hierarchy_depth_intra out of range: %d\n"", sps->max_transform_hierarchy_depth_intra); goto err; } if (sps->log2_max_trafo_size > FFMIN(sps->log2_ctb_size, 5)) { av_log(s->avctx, AV_LOG_ERROR, ""max transform block size out of range: %d\n"", sps->log2_max_trafo_size); goto err; } if (s->avctx->debug & FF_DEBUG_BITSTREAM) { av_log(s->avctx, AV_LOG_DEBUG, ""Parsed SPS: id %d; coded wxh: %dx%d; "" ""cropped wxh: %dx%d; pix_fmt: %s.\n"", sps_id, sps->width, sps->height, sps->output_width, sps->output_height, av_get_pix_fmt_name(sps->pix_fmt)); } /* check if this is a repeat of an already parsed SPS, then keep the * original one. * otherwise drop all PPSes that depend on it */ if (s->sps_list[sps_id] && !memcmp(s->sps_list[sps_id]->data, sps_buf->data, sps_buf->size)) { av_buffer_unref(&sps_buf); } else { for (i = 0; i < FF_ARRAY_ELEMS(s->pps_list); i++) { if (s->pps_list[i] && ((HEVCPPS*)s->pps_list[i]->data)->sps_id == sps_id) av_buffer_unref(&s->pps_list[i]); } av_buffer_unref(&s->sps_list[sps_id]); s->sps_list[sps_id] = sps_buf; } return 0; err: av_buffer_unref(&sps_buf); return ret; }","No, it is non-vulnerable."747745,"static void do_audio_out(AVFormatContext *s, OutputStream *ost, InputStream *ist, AVFrame *decoded_frame) { uint8_t *buftmp; int size_out, frame_bytes, resample_changed; AVCodecContext *enc = ost->st->codec; AVCodecContext *dec = ist->st->codec; int osize = av_get_bytes_per_sample(enc->sample_fmt); int isize = av_get_bytes_per_sample(dec->sample_fmt); uint8_t *buf = decoded_frame->data[0]; int size = decoded_frame->nb_samples * dec->channels * isize; if (alloc_audio_output_buf(dec, enc, decoded_frame->nb_samples) < 0) { av_log(NULL, AV_LOG_FATAL, ""Error allocating audio buffer\n""); exit_program(1); } if (enc->channels != dec->channels || enc->sample_rate != dec->sample_rate) ost->audio_resample = 1; resample_changed = ost->resample_sample_fmt != dec->sample_fmt || ost->resample_channels != dec->channels || ost->resample_sample_rate != dec->sample_rate; if ((ost->audio_resample && !ost->resample) || resample_changed) { if (resample_changed) { av_log(NULL, AV_LOG_INFO, ""Input stream #%d:%d frame changed from rate:%d fmt:%s ch:%d to rate:%d fmt:%s ch:%d\n"", ist->file_index, ist->st->index, ost->resample_sample_rate, av_get_sample_fmt_name(ost->resample_sample_fmt), ost->resample_channels, dec->sample_rate, av_get_sample_fmt_name(dec->sample_fmt), dec->channels); ost->resample_sample_fmt = dec->sample_fmt; ost->resample_channels = dec->channels; ost->resample_sample_rate = dec->sample_rate; if (ost->resample) audio_resample_close(ost->resample); } /* if audio_sync_method is >1 the resampler is needed for audio drift compensation */ if (audio_sync_method <= 1 && ost->resample_sample_fmt == enc->sample_fmt && ost->resample_channels == enc->channels && ost->resample_sample_rate == enc->sample_rate) { ost->resample = NULL; ost->audio_resample = 0; } else if (ost->audio_resample) { if (dec->sample_fmt != AV_SAMPLE_FMT_S16) av_log(NULL, AV_LOG_WARNING, ""Using s16 intermediate sample format for resampling\n""); ost->resample = av_audio_resample_init(enc->channels, dec->channels, enc->sample_rate, dec->sample_rate, enc->sample_fmt, dec->sample_fmt, 16, 10, 0, 0.8); if (!ost->resample) { av_log(NULL, AV_LOG_FATAL, ""Can not resample %d channels @ %d Hz to %d channels @ %d Hz\n"", dec->channels, dec->sample_rate, enc->channels, enc->sample_rate); exit_program(1); } } } #define MAKE_SFMT_PAIR(a,b) ((a)+AV_SAMPLE_FMT_NB*(b)) if (!ost->audio_resample && dec->sample_fmt != enc->sample_fmt && MAKE_SFMT_PAIR(enc->sample_fmt,dec->sample_fmt) != ost->reformat_pair) { if (ost->reformat_ctx) av_audio_convert_free(ost->reformat_ctx); ost->reformat_ctx = av_audio_convert_alloc(enc->sample_fmt, 1, dec->sample_fmt, 1, NULL, 0); if (!ost->reformat_ctx) { av_log(NULL, AV_LOG_FATAL, ""Cannot convert %s sample format to %s sample format\n"", av_get_sample_fmt_name(dec->sample_fmt), av_get_sample_fmt_name(enc->sample_fmt)); exit_program(1); } ost->reformat_pair = MAKE_SFMT_PAIR(enc->sample_fmt,dec->sample_fmt); } if (audio_sync_method) { double delta = get_sync_ipts(ost, ist->last_dts) * enc->sample_rate - ost->sync_opts - av_fifo_size(ost->fifo) / (enc->channels * osize); int idelta = delta * dec->sample_rate / enc->sample_rate; int byte_delta = idelta * isize * dec->channels; // FIXME resample delay if (fabs(delta) > 50) { if (ist->is_start || fabs(delta) > audio_drift_threshold*enc->sample_rate) { if (byte_delta < 0) { byte_delta = FFMAX(byte_delta, -size); size += byte_delta; buf -= byte_delta; av_log(NULL, AV_LOG_VERBOSE, ""discarding %d audio samples\n"", -byte_delta / (isize * dec->channels)); if (!size) return; ist->is_start = 0; } else { av_fast_malloc(&async_buf, &allocated_async_buf_size, byte_delta + size); if (!async_buf) { av_log(NULL, AV_LOG_FATAL, ""Out of memory in do_audio_out\n""); exit_program(1); } if (alloc_audio_output_buf(dec, enc, decoded_frame->nb_samples + idelta) < 0) { av_log(NULL, AV_LOG_FATAL, ""Error allocating audio buffer\n""); exit_program(1); } ist->is_start = 0; generate_silence(async_buf, dec->sample_fmt, byte_delta); memcpy(async_buf + byte_delta, buf, size); buf = async_buf; size += byte_delta; av_log(NULL, AV_LOG_VERBOSE, ""adding %d audio samples of silence\n"", idelta); } } else if (audio_sync_method > 1) { int comp = av_clip(delta, -audio_sync_method, audio_sync_method); av_assert0(ost->audio_resample); av_log(NULL, AV_LOG_VERBOSE, ""compensating audio timestamp drift:%f compensation:%d in:%d\n"", delta, comp, enc->sample_rate); // fprintf(stderr, ""drift:%f len:%d opts:%""PRId64"" ipts:%""PRId64"" fifo:%d\n"", delta, -1, ost->sync_opts, (int64_t)(get_sync_ipts(ost) * enc->sample_rate), av_fifo_size(ost->fifo)/(ost->st->codec->channels * 2)); av_resample_compensate(*(struct AVResampleContext**)ost->resample, comp, enc->sample_rate); } } } else ost->sync_opts = lrintf(get_sync_ipts(ost, ist->last_dts) * enc->sample_rate) - av_fifo_size(ost->fifo) / (enc->channels * osize); // FIXME wrong if (ost->audio_resample) { buftmp = audio_buf; size_out = audio_resample(ost->resample, (short *)buftmp, (short *)buf, size / (dec->channels * isize)); size_out = size_out * enc->channels * osize; } else { buftmp = buf; size_out = size; } if (!ost->audio_resample && dec->sample_fmt != enc->sample_fmt) { const void *ibuf[6] = { buftmp }; void *obuf[6] = { audio_buf }; int istride[6] = { isize }; int ostride[6] = { osize }; int len = size_out / istride[0]; if (av_audio_convert(ost->reformat_ctx, obuf, ostride, ibuf, istride, len) < 0) { printf(""av_audio_convert() failed\n""); if (exit_on_error) exit_program(1); return; } buftmp = audio_buf; size_out = len * osize; } /* now encode as many frames as possible */ if (!(enc->codec->capabilities & CODEC_CAP_VARIABLE_FRAME_SIZE)) { /* output resampled raw samples */ if (av_fifo_realloc2(ost->fifo, av_fifo_size(ost->fifo) + size_out) < 0) { av_log(NULL, AV_LOG_FATAL, ""av_fifo_realloc2() failed\n""); exit_program(1); } av_fifo_generic_write(ost->fifo, buftmp, size_out, NULL); frame_bytes = enc->frame_size * osize * enc->channels; while (av_fifo_size(ost->fifo) >= frame_bytes) { av_fifo_generic_read(ost->fifo, audio_buf, frame_bytes, NULL); encode_audio_frame(s, ost, audio_buf, frame_bytes); } } else { encode_audio_frame(s, ost, buftmp, size_out); } }","No, it is non-vulnerable."748746,void v9fs_string_init(V9fsString *str) { str->data = NULL; str->size = 0; },"No, it is non-vulnerable."749747,"static void do_spawn_thread(ThreadPool *pool) { QemuThread t; /* Runs with lock taken. */ if (!pool->new_threads) { return; } pool->new_threads--; pool->pending_threads++; qemu_thread_create(&t, ""worker"", worker_thread, pool, QEMU_THREAD_DETACHED); }","No, it is non-vulnerable."750748,"icmp_input(struct mbuf *m, int hlen) { register struct icmp *icp; register struct ip *ip=mtod(m, struct ip *); int icmplen=ip->ip_len; Slirp *slirp = m->slirp; DEBUG_CALL(""icmp_input""); DEBUG_ARG(""m = %p"", m); DEBUG_ARG(""m_len = %d"", m->m_len); /* * Locate icmp structure in mbuf, and check * that its not corrupted and of at least minimum length. */ if (icmplen < ICMP_MINLEN) { /* min 8 bytes payload */ freeit: m_free(m); goto end_error; } m->m_len -= hlen; m->m_data += hlen; icp = mtod(m, struct icmp *); if (cksum(m, icmplen)) { goto freeit; } m->m_len += hlen; m->m_data -= hlen; DEBUG_ARG(""icmp_type = %d"", icp->icmp_type); switch (icp->icmp_type) { case ICMP_ECHO: ip->ip_len += hlen; /* since ip_input subtracts this */ if (ip->ip_dst.s_addr == slirp->vhost_addr.s_addr) { icmp_reflect(m); } else if (slirp->restricted) { goto freeit; } else { struct socket *so; struct sockaddr_in addr; if ((so = socreate(slirp)) == NULL) goto freeit; if (icmp_send(so, m, hlen) == 0) { return; } if(udp_attach(so) == -1) { DEBUG_MISC((dfd,""icmp_input udp_attach errno = %d-%s\n"", errno,strerror(errno))); sofree(so); m_free(m); goto end_error; } so->so_m = m; so->so_ffamily = AF_INET; so->so_faddr = ip->ip_dst; so->so_fport = htons(7); so->so_lfamily = AF_INET; so->so_laddr = ip->ip_src; so->so_lport = htons(9); so->so_iptos = ip->ip_tos; so->so_type = IPPROTO_ICMP; so->so_state = SS_ISFCONNECTED; /* Send the packet */ addr.sin_family = AF_INET; if ((so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) == slirp->vnetwork_addr.s_addr) { /* It's an alias */ if (so->so_faddr.s_addr == slirp->vnameserver_addr.s_addr) { if (get_dns_addr(&addr.sin_addr) < 0) addr.sin_addr = loopback_addr; } else { addr.sin_addr = loopback_addr; } } else { addr.sin_addr = so->so_faddr; } addr.sin_port = so->so_fport; if(sendto(so->s, icmp_ping_msg, strlen(icmp_ping_msg), 0, (struct sockaddr *)&addr, sizeof(addr)) == -1) { DEBUG_MISC((dfd,""icmp_input udp sendto tx errno = %d-%s\n"", errno,strerror(errno))); icmp_error(m, ICMP_UNREACH,ICMP_UNREACH_NET, 0,strerror(errno)); udp_detach(so); } } /* if ip->ip_dst.s_addr == alias_addr.s_addr */ break; case ICMP_UNREACH: /* XXX? report error? close socket? */ case ICMP_TIMXCEED: case ICMP_PARAMPROB: case ICMP_SOURCEQUENCH: case ICMP_TSTAMP: case ICMP_MASKREQ: case ICMP_REDIRECT: m_free(m); break; default: m_free(m); } /* swith */ end_error: /* m is m_free()'d xor put in a socket xor or given to ip_send */ return; }","No, it is non-vulnerable."751749,"static void virtio_net_tx_complete(NetClientState *nc, ssize_t len) { VirtIONet *n = qemu_get_nic_opaque(nc); VirtIONetQueue *q = virtio_net_get_subqueue(nc); VirtIODevice *vdev = VIRTIO_DEVICE(n); virtqueue_push(q->tx_vq, &q->async_tx.elem, 0); virtio_notify(vdev, q->tx_vq); q->async_tx.elem.out_num = 0; virtio_queue_set_notification(q->tx_vq, 1); virtio_net_flush_tx(q); }","No, it is non-vulnerable."752750,"static int decode_cell(Indeo3DecodeContext *ctx, AVCodecContext *avctx, Plane *plane, Cell *cell, const uint8_t *data_ptr, const uint8_t *last_ptr) { int x, mv_x, mv_y, mode, vq_index, prim_indx, second_indx; int zoom_fac; int offset, error = 0, swap_quads[2]; uint8_t code, *block, *ref_block = 0; const vqEntry *delta[2]; const uint8_t *data_start = data_ptr; /* get coding mode and VQ table index from the VQ descriptor byte */ code = *data_ptr++; mode = code >> 4; vq_index = code & 0xF; /* setup output and reference pointers */ offset = (cell->ypos << 2) * plane->pitch + (cell->xpos << 2); block = plane->pixels[ctx->buf_sel] + offset; if (!cell->mv_ptr) { /* use previous line as reference for INTRA cells */ ref_block = block - plane->pitch; } else if (mode >= 10) { /* for mode 10 and 11 INTER first copy the predicted cell into the current one */ /* so we don't need to do data copying for each RLE code later */ copy_cell(ctx, plane, cell); } else { /* set the pointer to the reference pixels for modes 0-4 INTER */ mv_y = cell->mv_ptr[0]; mv_x = cell->mv_ptr[1]; if ( mv_x + 4*cell->xpos < 0 || mv_y + 4*cell->ypos < 0 || mv_x + 4*cell->xpos + 4*cell->width > plane->width || mv_y + 4*cell->ypos + 4*cell->height > plane->height) { av_log(avctx, AV_LOG_ERROR, ""motion vector %d %d outside reference\n"", mv_x + 4*cell->xpos, mv_y + 4*cell->ypos); return AVERROR_INVALIDDATA; } offset += mv_y * plane->pitch + mv_x; ref_block = plane->pixels[ctx->buf_sel ^ 1] + offset; } /* select VQ tables as follows: */ /* modes 0 and 3 use only the primary table for all lines in a block */ /* while modes 1 and 4 switch between primary and secondary tables on alternate lines */ if (mode == 1 || mode == 4) { code = ctx->alt_quant[vq_index]; prim_indx = (code >> 4) + ctx->cb_offset; second_indx = (code & 0xF) + ctx->cb_offset; } else { vq_index += ctx->cb_offset; prim_indx = second_indx = vq_index; } if (prim_indx >= 24 || second_indx >= 24) { av_log(avctx, AV_LOG_ERROR, ""Invalid VQ table indexes! Primary: %d, secondary: %d!\n"", prim_indx, second_indx); return AVERROR_INVALIDDATA; } delta[0] = &vq_tab[second_indx]; delta[1] = &vq_tab[prim_indx]; swap_quads[0] = second_indx >= 16; swap_quads[1] = prim_indx >= 16; /* requantize the prediction if VQ index of this cell differs from VQ index */ /* of the predicted cell in order to avoid overflows. */ if (vq_index >= 8 && ref_block) { for (x = 0; x < cell->width << 2; x++) ref_block[x] = requant_tab[vq_index & 7][ref_block[x] & 127]; } error = IV3_NOERR; switch (mode) { case 0: /*------------------ MODES 0 & 1 (4x4 block processing) --------------------*/ case 1: case 3: /*------------------ MODES 3 & 4 (4x8 block processing) --------------------*/ case 4: if (mode >= 3 && cell->mv_ptr) { av_log(avctx, AV_LOG_ERROR, ""Attempt to apply Mode 3/4 to an INTER cell!\n""); return AVERROR_INVALIDDATA; } zoom_fac = mode >= 3; error = decode_cell_data(cell, block, ref_block, plane->pitch, 0, zoom_fac, mode, delta, swap_quads, &data_ptr, last_ptr); break; case 10: /*-------------------- MODE 10 (8x8 block processing) ---------------------*/ case 11: /*----------------- MODE 11 (4x8 INTER block processing) ------------------*/ if (mode == 10 && !cell->mv_ptr) { /* MODE 10 INTRA processing */ error = decode_cell_data(cell, block, ref_block, plane->pitch, 1, 1, mode, delta, swap_quads, &data_ptr, last_ptr); } else { /* mode 10 and 11 INTER processing */ if (mode == 11 && !cell->mv_ptr) { av_log(avctx, AV_LOG_ERROR, ""Attempt to use Mode 11 for an INTRA cell!\n""); return AVERROR_INVALIDDATA; } zoom_fac = mode == 10; error = decode_cell_data(cell, block, ref_block, plane->pitch, zoom_fac, 1, mode, delta, swap_quads, &data_ptr, last_ptr); } break; default: av_log(avctx, AV_LOG_ERROR, ""Unsupported coding mode: %d\n"", mode); return AVERROR_INVALIDDATA; }//switch mode switch (error) { case IV3_BAD_RLE: av_log(avctx, AV_LOG_ERROR, ""Mode %d: RLE code %X is not allowed at the current line\n"", mode, data_ptr[-1]); return AVERROR_INVALIDDATA; case IV3_BAD_DATA: av_log(avctx, AV_LOG_ERROR, ""Mode %d: invalid VQ data\n"", mode); return AVERROR_INVALIDDATA; case IV3_BAD_COUNTER: av_log(avctx, AV_LOG_ERROR, ""Mode %d: RLE-FB invalid counter: %d\n"", mode, code); return AVERROR_INVALIDDATA; case IV3_UNSUPPORTED: av_log(avctx, AV_LOG_ERROR, ""Mode %d: unsupported RLE code: %X\n"", mode, data_ptr[-1]); return AVERROR_INVALIDDATA; case IV3_OUT_OF_DATA: av_log(avctx, AV_LOG_ERROR, ""Mode %d: attempt to read past end of buffer\n"", mode); return AVERROR_INVALIDDATA; } return data_ptr - data_start; /* report number of bytes consumed from the input buffer */ }","No, it is non-vulnerable."753751,"static int net_socket_mcast_init(NetClientState *peer, const char *model, const char *name, const char *host_str, const char *localaddr_str) { NetSocketState *s; int fd; struct sockaddr_in saddr; struct in_addr localaddr, *param_localaddr; if (parse_host_port(&saddr, host_str) < 0) return -1; if (localaddr_str != NULL) { if (inet_aton(localaddr_str, &localaddr) == 0) return -1; param_localaddr = &localaddr; } else { param_localaddr = NULL; } fd = net_socket_mcast_create(&saddr, param_localaddr); if (fd < 0) return -1; s = net_socket_fd_init(peer, model, name, fd, 0); if (!s) return -1; s->dgram_dst = saddr; snprintf(s->nc.info_str, sizeof(s->nc.info_str), ""socket: mcast=%s:%d"", inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port)); return 0; }","Yes, it is vulnerable."754752,"static void pl041_device_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass); k->init = pl041_init; set_bit(DEVICE_CATEGORY_SOUND, dc->categories); dc->no_user = 1; dc->reset = pl041_device_reset; dc->vmsd = &vmstate_pl041; dc->props = pl041_device_properties; }","Yes, it is vulnerable."755753,"static void reduce_matrix(AudioMix *am, const double *matrix, int stride) { int i, o; memset(am->output_zero, 0, sizeof(am->output_zero)); memset(am->input_skip, 0, sizeof(am->input_skip)); memset(am->output_skip, 0, sizeof(am->output_skip)); /* exclude output channels if they can be zeroed instead of mixed */ for (o = 0; o < am->out_channels; o++) { int zero = 1; /* check if the output is always silent */ for (i = 0; i < am->in_channels; i++) { if (matrix[o * stride + i] != 0.0) { zero = 0; break; } } /* check if the corresponding input channel makes a contribution to any output channel */ if (o < am->in_channels) { for (i = 0; i < am->out_channels; i++) { if (matrix[i * stride + o] != 0.0) { zero = 0; break; } } } if (zero) { am->output_zero[o] = 1; am->out_matrix_channels--; } } if (am->out_matrix_channels == 0) { am->in_matrix_channels = 0; return; } /* skip input channels that contribute fully only to the corresponding output channel */ for (i = 0; i < FFMIN(am->in_channels, am->out_channels); i++) { int skip = 1; for (o = 0; o < am->out_channels; o++) { int i0; if ((o != i && matrix[o * stride + i] != 0.0) || (o == i && matrix[o * stride + i] != 1.0)) { skip = 0; break; } /* if the input contributes fully to the output, also check that no other inputs contribute to this output */ if (o == i) { for (i0 = 0; i0 < am->in_channels; i0++) { if (i0 != i && matrix[o * stride + i0] != 0.0) { skip = 0; break; } } } } if (skip) { am->input_skip[i] = 1; am->in_matrix_channels--; } } /* skip input channels that do not contribute to any output channel */ for (; i < am->in_channels; i++) { int contrib = 0; for (o = 0; o < am->out_channels; o++) { if (matrix[o * stride + i] != 0.0) { contrib = 1; break; } } if (!contrib) { am->input_skip[i] = 1; am->in_matrix_channels--; } } if (am->in_matrix_channels == 0) { am->out_matrix_channels = 0; return; } /* skip output channels that only get full contribution from the corresponding input channel */ for (o = 0; o < FFMIN(am->in_channels, am->out_channels); o++) { int skip = 1; int o0; for (i = 0; i < am->in_channels; i++) { if ((o != i && matrix[o * stride + i] != 0.0) || (o == i && matrix[o * stride + i] != 1.0)) { skip = 0; break; } } /* check if the corresponding input channel makes a contribution to any other output channel */ i = o; for (o0 = 0; o0 < am->out_channels; o0++) { if (o0 != i && matrix[o0 * stride + i] != 0.0) { skip = 0; break; } } if (skip) { am->output_skip[o] = 1; am->out_matrix_channels--; } } if (am->out_matrix_channels == 0) { am->in_matrix_channels = 0; return; } }","Yes, it is vulnerable."756754,"static SpiceChannelList *qmp_query_spice_channels(void) { SpiceChannelList *cur_item = NULL, *head = NULL; ChannelList *item; QTAILQ_FOREACH(item, &channel_list, link) { SpiceChannelList *chan; char host[NI_MAXHOST], port[NI_MAXSERV]; struct sockaddr *paddr; socklen_t plen; if (!(item->info->flags & SPICE_CHANNEL_EVENT_FLAG_ADDR_EXT)) { error_report(""invalid channel event""); return NULL; } chan = g_malloc0(sizeof(*chan)); chan->value = g_malloc0(sizeof(*chan->value)); chan->value->base = g_malloc0(sizeof(*chan->value->base)); paddr = (struct sockaddr *)&item->info->paddr_ext; plen = item->info->plen_ext; getnameinfo(paddr, plen, host, sizeof(host), port, sizeof(port), NI_NUMERICHOST | NI_NUMERICSERV); chan->value->base->host = g_strdup(host); chan->value->base->port = g_strdup(port); chan->value->base->family = inet_netfamily(paddr->sa_family); chan->value->connection_id = item->info->connection_id; chan->value->channel_type = item->info->type; chan->value->channel_id = item->info->id; chan->value->tls = item->info->flags & SPICE_CHANNEL_EVENT_FLAG_TLS; /* XXX: waiting for the qapi to support GSList */ if (!cur_item) { head = cur_item = chan; } else { cur_item->next = chan; cur_item = chan; } } return head; }","Yes, it is vulnerable."757755,"static int cd_read_sector(IDEState *s, int lba, uint8_t *buf, int sector_size) { int ret; switch(sector_size) { case 2048: block_acct_start(blk_get_stats(s->blk), &s->acct, 4 * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ); ret = blk_read(s->blk, (int64_t)lba << 2, buf, 4); block_acct_done(blk_get_stats(s->blk), &s->acct); break; case 2352: block_acct_start(blk_get_stats(s->blk), &s->acct, 4 * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ); ret = blk_read(s->blk, (int64_t)lba << 2, buf + 16, 4); block_acct_done(blk_get_stats(s->blk), &s->acct); if (ret < 0) return ret; cd_data_to_raw(buf, lba); break; default: ret = -EIO; break; } return ret; }","Yes, it is vulnerable."758756,"static int cow_read(BlockDriverState *bs, int64_t sector_num, uint8_t *buf, int nb_sectors) { BDRVCowState *s = bs->opaque; int ret, n; while (nb_sectors > 0) { if (cow_is_allocated(bs, sector_num, nb_sectors, &n)) { ret = bdrv_pread(bs->file, s->cow_sectors_offset + sector_num * 512, buf, n * 512); if (ret != n * 512) return -1; } else { if (bs->backing_hd) { /* read from the base image */ ret = bdrv_read(bs->backing_hd, sector_num, buf, n); if (ret < 0) return -1; } else { memset(buf, 0, n * 512); } } nb_sectors -= n; sector_num += n; buf += n * 512; } return 0; }","Yes, it is vulnerable."759757,"static int decode_slice_header(H264Context *h, H264Context *h0){ MpegEncContext * const s = &h->s; MpegEncContext * const s0 = &h0->s; unsigned int first_mb_in_slice; unsigned int pps_id; int num_ref_idx_active_override_flag; unsigned int slice_type, tmp, i, j; int default_ref_list_done = 0; int last_pic_structure; s->dropable= h->nal_ref_idc == 0; if((s->avctx->flags2 & CODEC_FLAG2_FAST) && !h->nal_ref_idc){ s->me.qpel_put= s->dsp.put_2tap_qpel_pixels_tab; s->me.qpel_avg= s->dsp.avg_2tap_qpel_pixels_tab; }else{ s->me.qpel_put= s->dsp.put_h264_qpel_pixels_tab; s->me.qpel_avg= s->dsp.avg_h264_qpel_pixels_tab; } first_mb_in_slice= get_ue_golomb(&s->gb); if((s->flags2 & CODEC_FLAG2_CHUNKS) && first_mb_in_slice == 0){ h0->current_slice = 0; if (!s0->first_field) s->current_picture_ptr= NULL; } slice_type= get_ue_golomb_31(&s->gb); if(slice_type > 9){ av_log(h->s.avctx, AV_LOG_ERROR, ""slice type too large (%d) at %d %d\n"", h->slice_type, s->mb_x, s->mb_y); return -1; } if(slice_type > 4){ slice_type -= 5; h->slice_type_fixed=1; }else h->slice_type_fixed=0; slice_type= golomb_to_pict_type[ slice_type ]; if (slice_type == FF_I_TYPE || (h0->current_slice != 0 && slice_type == h0->last_slice_type) ) { default_ref_list_done = 1; } h->slice_type= slice_type; h->slice_type_nos= slice_type & 3; s->pict_type= h->slice_type; // to make a few old functions happy, it's wrong though if (s->pict_type == FF_B_TYPE && s0->last_picture_ptr == NULL) { av_log(h->s.avctx, AV_LOG_ERROR, ""B picture before any references, skipping\n""); return -1; } pps_id= get_ue_golomb(&s->gb); if(pps_id>=MAX_PPS_COUNT){ av_log(h->s.avctx, AV_LOG_ERROR, ""pps_id out of range\n""); return -1; } if(!h0->pps_buffers[pps_id]) { av_log(h->s.avctx, AV_LOG_ERROR, ""non-existing PPS referenced\n""); return -1; } h->pps= *h0->pps_buffers[pps_id]; if(!h0->sps_buffers[h->pps.sps_id]) { av_log(h->s.avctx, AV_LOG_ERROR, ""non-existing SPS referenced\n""); return -1; } h->sps = *h0->sps_buffers[h->pps.sps_id]; if(h == h0 && h->dequant_coeff_pps != pps_id){ h->dequant_coeff_pps = pps_id; init_dequant_tables(h); } s->mb_width= h->sps.mb_width; s->mb_height= h->sps.mb_height * (2 - h->sps.frame_mbs_only_flag); h->b_stride= s->mb_width*4; h->b8_stride= s->mb_width*2; s->width = 16*s->mb_width - 2*FFMIN(h->sps.crop_right, 7); if(h->sps.frame_mbs_only_flag) s->height= 16*s->mb_height - 2*FFMIN(h->sps.crop_bottom, 7); else s->height= 16*s->mb_height - 4*FFMIN(h->sps.crop_bottom, 3); if (s->context_initialized && ( s->width != s->avctx->width || s->height != s->avctx->height)) { if(h != h0) return -1; // width / height changed during parallelized decoding free_tables(h); flush_dpb(s->avctx); MPV_common_end(s); } if (!s->context_initialized) { if(h != h0) return -1; // we cant (re-)initialize context during parallel decoding if (MPV_common_init(s) < 0) return -1; s->first_field = 0; init_scan_tables(h); alloc_tables(h); for(i = 1; i < s->avctx->thread_count; i++) { H264Context *c; c = h->thread_context[i] = av_malloc(sizeof(H264Context)); memcpy(c, h->s.thread_context[i], sizeof(MpegEncContext)); memset(&c->s + 1, 0, sizeof(H264Context) - sizeof(MpegEncContext)); c->sps = h->sps; c->pps = h->pps; init_scan_tables(c); clone_tables(c, h); } for(i = 0; i < s->avctx->thread_count; i++) if(context_init(h->thread_context[i]) < 0) return -1; s->avctx->width = s->width; s->avctx->height = s->height; s->avctx->sample_aspect_ratio= h->sps.sar; if(!s->avctx->sample_aspect_ratio.den) s->avctx->sample_aspect_ratio.den = 1; if(h->sps.timing_info_present_flag){ s->avctx->time_base= (AVRational){h->sps.num_units_in_tick * 2, h->sps.time_scale}; if(h->x264_build > 0 && h->x264_build < 44) s->avctx->time_base.den *= 2; av_reduce(&s->avctx->time_base.num, &s->avctx->time_base.den, s->avctx->time_base.num, s->avctx->time_base.den, 1<<30); } } h->frame_num= get_bits(&s->gb, h->sps.log2_max_frame_num); h->mb_mbaff = 0; h->mb_aff_frame = 0; last_pic_structure = s0->picture_structure; if(h->sps.frame_mbs_only_flag){ s->picture_structure= PICT_FRAME; }else{ if(get_bits1(&s->gb)) { //field_pic_flag s->picture_structure= PICT_TOP_FIELD + get_bits1(&s->gb); //bottom_field_flag } else { s->picture_structure= PICT_FRAME; h->mb_aff_frame = h->sps.mb_aff; } } h->mb_field_decoding_flag= s->picture_structure != PICT_FRAME; if(h0->current_slice == 0){ while(h->frame_num != h->prev_frame_num && h->frame_num != (h->prev_frame_num+1)%(1<<h->sps.log2_max_frame_num)){ av_log(NULL, AV_LOG_DEBUG, ""Frame num gap %d %d\n"", h->frame_num, h->prev_frame_num); frame_start(h); h->prev_frame_num++; h->prev_frame_num %= 1<<h->sps.log2_max_frame_num; s->current_picture_ptr->frame_num= h->prev_frame_num; execute_ref_pic_marking(h, NULL, 0); } /* See if we have a decoded first field looking for a pair... */ if (s0->first_field) { assert(s0->current_picture_ptr); assert(s0->current_picture_ptr->data[0]); assert(s0->current_picture_ptr->reference != DELAYED_PIC_REF); /* figure out if we have a complementary field pair */ if (!FIELD_PICTURE || s->picture_structure == last_pic_structure) { /* * Previous field is unmatched. Don't display it, but let it * remain for reference if marked as such. */ s0->current_picture_ptr = NULL; s0->first_field = FIELD_PICTURE; } else { if (h->nal_ref_idc && s0->current_picture_ptr->reference && s0->current_picture_ptr->frame_num != h->frame_num) { /* * This and previous field were reference, but had * different frame_nums. Consider this field first in * pair. Throw away previous field except for reference * purposes. */ s0->first_field = 1; s0->current_picture_ptr = NULL; } else { /* Second field in complementary pair */ s0->first_field = 0; } } } else { /* Frame or first field in a potentially complementary pair */ assert(!s0->current_picture_ptr); s0->first_field = FIELD_PICTURE; } if((!FIELD_PICTURE || s0->first_field) && frame_start(h) < 0) { s0->first_field = 0; return -1; } } if(h != h0) clone_slice(h, h0); s->current_picture_ptr->frame_num= h->frame_num; //FIXME frame_num cleanup assert(s->mb_num == s->mb_width * s->mb_height); if(first_mb_in_slice << FIELD_OR_MBAFF_PICTURE >= s->mb_num || first_mb_in_slice >= s->mb_num){ av_log(h->s.avctx, AV_LOG_ERROR, ""first_mb_in_slice overflow\n""); return -1; } s->resync_mb_x = s->mb_x = first_mb_in_slice % s->mb_width; s->resync_mb_y = s->mb_y = (first_mb_in_slice / s->mb_width) << FIELD_OR_MBAFF_PICTURE; if (s->picture_structure == PICT_BOTTOM_FIELD) s->resync_mb_y = s->mb_y = s->mb_y + 1; assert(s->mb_y < s->mb_height); if(s->picture_structure==PICT_FRAME){ h->curr_pic_num= h->frame_num; h->max_pic_num= 1<< h->sps.log2_max_frame_num; }else{ h->curr_pic_num= 2*h->frame_num + 1; h->max_pic_num= 1<<(h->sps.log2_max_frame_num + 1); } if(h->nal_unit_type == NAL_IDR_SLICE){ get_ue_golomb(&s->gb); /* idr_pic_id */ } if(h->sps.poc_type==0){ h->poc_lsb= get_bits(&s->gb, h->sps.log2_max_poc_lsb); if(h->pps.pic_order_present==1 && s->picture_structure==PICT_FRAME){ h->delta_poc_bottom= get_se_golomb(&s->gb); } } if(h->sps.poc_type==1 && !h->sps.delta_pic_order_always_zero_flag){ h->delta_poc[0]= get_se_golomb(&s->gb); if(h->pps.pic_order_present==1 && s->picture_structure==PICT_FRAME) h->delta_poc[1]= get_se_golomb(&s->gb); } init_poc(h); if(h->pps.redundant_pic_cnt_present){ h->redundant_pic_count= get_ue_golomb(&s->gb); } //set defaults, might be overridden a few lines later h->ref_count[0]= h->pps.ref_count[0]; h->ref_count[1]= h->pps.ref_count[1]; if(h->slice_type_nos != FF_I_TYPE){ if(h->slice_type_nos == FF_B_TYPE){ h->direct_spatial_mv_pred= get_bits1(&s->gb); } num_ref_idx_active_override_flag= get_bits1(&s->gb); if(num_ref_idx_active_override_flag){ h->ref_count[0]= get_ue_golomb(&s->gb) + 1; if(h->slice_type_nos==FF_B_TYPE) h->ref_count[1]= get_ue_golomb(&s->gb) + 1; if(h->ref_count[0]-1 > 32-1 || h->ref_count[1]-1 > 32-1){ av_log(h->s.avctx, AV_LOG_ERROR, ""reference overflow\n""); h->ref_count[0]= h->ref_count[1]= 1; return -1; } } if(h->slice_type_nos == FF_B_TYPE) h->list_count= 2; else h->list_count= 1; }else h->list_count= 0; if(!default_ref_list_done){ fill_default_ref_list(h); } if(h->slice_type_nos!=FF_I_TYPE && decode_ref_pic_list_reordering(h) < 0) return -1; if(h->slice_type_nos!=FF_I_TYPE){ s->last_picture_ptr= &h->ref_list[0][0]; ff_copy_picture(&s->last_picture, s->last_picture_ptr); } if(h->slice_type_nos==FF_B_TYPE){ s->next_picture_ptr= &h->ref_list[1][0]; ff_copy_picture(&s->next_picture, s->next_picture_ptr); } if( (h->pps.weighted_pred && h->slice_type_nos == FF_P_TYPE ) || (h->pps.weighted_bipred_idc==1 && h->slice_type_nos== FF_B_TYPE ) ) pred_weight_table(h); else if(h->pps.weighted_bipred_idc==2 && h->slice_type_nos== FF_B_TYPE) implicit_weight_table(h); else { h->use_weight = 0; for (i = 0; i < 2; i++) { h->luma_weight_flag[i] = 0; h->chroma_weight_flag[i] = 0; } } if(h->nal_ref_idc) decode_ref_pic_marking(h0, &s->gb); if(FRAME_MBAFF) fill_mbaff_ref_list(h); if(h->slice_type_nos==FF_B_TYPE && !h->direct_spatial_mv_pred) direct_dist_scale_factor(h); direct_ref_list_init(h); if( h->slice_type_nos != FF_I_TYPE && h->pps.cabac ){ tmp = get_ue_golomb_31(&s->gb); if(tmp > 2){ av_log(s->avctx, AV_LOG_ERROR, ""cabac_init_idc overflow\n""); return -1; } h->cabac_init_idc= tmp; } h->last_qscale_diff = 0; tmp = h->pps.init_qp + get_se_golomb(&s->gb); if(tmp>51){ av_log(s->avctx, AV_LOG_ERROR, ""QP %u out of range\n"", tmp); return -1; } s->qscale= tmp; h->chroma_qp[0] = get_chroma_qp(h, 0, s->qscale); h->chroma_qp[1] = get_chroma_qp(h, 1, s->qscale); //FIXME qscale / qp ... stuff if(h->slice_type == FF_SP_TYPE){ get_bits1(&s->gb); /* sp_for_switch_flag */ } if(h->slice_type==FF_SP_TYPE || h->slice_type == FF_SI_TYPE){ get_se_golomb(&s->gb); /* slice_qs_delta */ } h->deblocking_filter = 1; h->slice_alpha_c0_offset = 0; h->slice_beta_offset = 0; if( h->pps.deblocking_filter_parameters_present ) { tmp= get_ue_golomb_31(&s->gb); if(tmp > 2){ av_log(s->avctx, AV_LOG_ERROR, ""deblocking_filter_idc %u out of range\n"", tmp); return -1; } h->deblocking_filter= tmp; if(h->deblocking_filter < 2) h->deblocking_filter^= 1; // 1<->0 if( h->deblocking_filter ) { h->slice_alpha_c0_offset = get_se_golomb(&s->gb) << 1; h->slice_beta_offset = get_se_golomb(&s->gb) << 1; } } if( s->avctx->skip_loop_filter >= AVDISCARD_ALL ||(s->avctx->skip_loop_filter >= AVDISCARD_NONKEY && h->slice_type_nos != FF_I_TYPE) ||(s->avctx->skip_loop_filter >= AVDISCARD_BIDIR && h->slice_type_nos == FF_B_TYPE) ||(s->avctx->skip_loop_filter >= AVDISCARD_NONREF && h->nal_ref_idc == 0)) h->deblocking_filter= 0; if(h->deblocking_filter == 1 && h0->max_contexts > 1) { if(s->avctx->flags2 & CODEC_FLAG2_FAST) { /* Cheat slightly for speed: Do not bother to deblock across slices. */ h->deblocking_filter = 2; } else { h0->max_contexts = 1; if(!h0->single_decode_warning) { av_log(s->avctx, AV_LOG_INFO, ""Cannot parallelize deblocking type 1, decoding such frames in sequential order\n""); h0->single_decode_warning = 1; } if(h != h0) return 1; // deblocking switched inside frame } } #if 0 //FMO if( h->pps.num_slice_groups > 1 && h->pps.mb_slice_group_map_type >= 3 && h->pps.mb_slice_group_map_type <= 5) slice_group_change_cycle= get_bits(&s->gb, ?); #endif h0->last_slice_type = slice_type; h->slice_num = ++h0->current_slice; if(h->slice_num >= MAX_SLICES){ av_log(s->avctx, AV_LOG_ERROR, ""Too many slices, increase MAX_SLICES and recompile\n""); } for(j=0; j<2; j++){ int *ref2frm= h->ref2frm[h->slice_num&(MAX_SLICES-1)][j]; ref2frm[0]= ref2frm[1]= -1; for(i=0; i<16; i++) ref2frm[i+2]= 4*h->ref_list[j][i].frame_num +(h->ref_list[j][i].reference&3); ref2frm[18+0]= ref2frm[18+1]= -1; for(i=16; i<48; i++) ref2frm[i+4]= 4*h->ref_list[j][i].frame_num +(h->ref_list[j][i].reference&3); } h->emu_edge_width= (s->flags&CODEC_FLAG_EMU_EDGE) ? 0 : 16; h->emu_edge_height= (FRAME_MBAFF || FIELD_PICTURE) ? 0 : h->emu_edge_width; s->avctx->refs= h->sps.ref_frame_count; if(s->avctx->debug&FF_DEBUG_PICT_INFO){ av_log(h->s.avctx, AV_LOG_DEBUG, ""slice:%d %s mb:%d %c%s%s pps:%u frame:%d poc:%d/%d ref:%d/%d qp:%d loop:%d:%d:%d weight:%d%s %s\n"", h->slice_num, (s->picture_structure==PICT_FRAME ? ""F"" : s->picture_structure==PICT_TOP_FIELD ? ""T"" : ""B""), first_mb_in_slice, av_get_pict_type_char(h->slice_type), h->slice_type_fixed ? "" fix"" : """", h->nal_unit_type == NAL_IDR_SLICE ? "" IDR"" : """", pps_id, h->frame_num, s->current_picture_ptr->field_poc[0], s->current_picture_ptr->field_poc[1], h->ref_count[0], h->ref_count[1], s->qscale, h->deblocking_filter, h->slice_alpha_c0_offset/2, h->slice_beta_offset/2, h->use_weight, h->use_weight==1 && h->use_weight_chroma ? ""c"" : """", h->slice_type == FF_B_TYPE ? (h->direct_spatial_mv_pred ? ""SPAT"" : ""TEMP"") : """" ); } return 0; }","Yes, it is vulnerable."760758,"static HotplugHandler *spapr_get_hotpug_handler(MachineState *machine, DeviceState *dev) { if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) || object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) { return HOTPLUG_HANDLER(machine); } return NULL; }","No, it is non-vulnerable."761759,"static void yuvj444p_to_rgb24(AVPicture *dst, AVPicture *src, int width, int height) { uint8_t *y1_ptr, *cb_ptr, *cr_ptr, *d, *d1; int w, y, cb, cr, r_add, g_add, b_add; uint8_t *cm = cropTbl + MAX_NEG_CROP; unsigned int r, g, b; d = dst->data[0]; y1_ptr = src->data[0]; cb_ptr = src->data[1]; cr_ptr = src->data[2]; for(;height > 0; height --) { d1 = d; for(w = width; w > 0; w--) { YUV_TO_RGB1(cb_ptr[0], cr_ptr[0]); YUV_TO_RGB2(r, g, b, y1_ptr[0]); RGB_OUT(d1, r, g, b); d1 += BPP; y1_ptr++; cb_ptr++; cr_ptr++; } d += dst->linesize[0]; y1_ptr += src->linesize[0] - width; cb_ptr += src->linesize[1] - width; cr_ptr += src->linesize[2] - width; } }","No, it is non-vulnerable."762760,"void kvm_init_cpu_signals(CPUState *cpu) { int r; sigset_t set; struct sigaction sigact; memset(&sigact, 0, sizeof(sigact)); sigact.sa_handler = dummy_signal; sigaction(SIG_IPI, &sigact, NULL); pthread_sigmask(SIG_BLOCK, NULL, &set); #if defined KVM_HAVE_MCE_INJECTION sigdelset(&set, SIGBUS); pthread_sigmask(SIG_SETMASK, &set, NULL); #endif sigdelset(&set, SIG_IPI); r = kvm_set_signal_mask(cpu, &set); if (r) { fprintf(stderr, ""kvm_set_signal_mask: %s\n"", strerror(-r)); exit(1); } }","Yes, it is vulnerable."763761,"static void vfio_disable_msix(VFIODevice *vdev) { msix_unset_vector_notifiers(&vdev->pdev); if (vdev->nr_vectors) { vfio_disable_irqindex(vdev, VFIO_PCI_MSIX_IRQ_INDEX); vfio_disable_msi_common(vdev); DPRINTF(""%s(%04x:%02x:%02x.%x)\n"", __func__, vdev->host.domain, vdev->host.bus, vdev->host.slot, vdev->host.function);","Yes, it is vulnerable."764762,"static int rtcp_parse_packet(RTPDemuxContext *s, const unsigned char *buf, int len) { int payload_len; while (len >= 2) { switch (buf[1]) { case RTCP_SR: if (len < 16) { av_log(NULL, AV_LOG_ERROR, ""Invalid length for RTCP SR packet\n""); return AVERROR_INVALIDDATA; } payload_len = (AV_RB16(buf + 2) + 1) * 4; s->last_rtcp_ntp_time = AV_RB64(buf + 8); s->last_rtcp_timestamp = AV_RB32(buf + 16); if (s->first_rtcp_ntp_time == AV_NOPTS_VALUE) { s->first_rtcp_ntp_time = s->last_rtcp_ntp_time; if (!s->base_timestamp) s->base_timestamp = s->last_rtcp_timestamp; s->rtcp_ts_offset = s->last_rtcp_timestamp - s->base_timestamp; } buf += payload_len; len -= payload_len; break; case RTCP_BYE: return -RTCP_BYE; default: return -1; } } return -1; }","Yes, it is vulnerable."765763,"void virtqueue_map_sg(struct iovec *sg, hwaddr *addr, size_t num_sg, int is_write) { unsigned int i; hwaddr len; for (i = 0; i < num_sg; i++) { len = sg[i].iov_len; sg[i].iov_base = cpu_physical_memory_map(addr[i], &len, is_write); if (sg[i].iov_base == NULL || len != sg[i].iov_len) { error_report(""virtio: trying to map MMIO memory"");","Yes, it is vulnerable."766764,"static void ehci_async_complete_packet(USBPort *port, USBPacket *packet) { EHCIQueue *q; EHCIState *s = port->opaque; uint32_t portsc = s->portsc[port->index]; if (portsc & PORTSC_POWNER) { USBPort *companion = s->companion_ports[port->index]; companion->ops->complete(companion, packet); return; } q = container_of(packet, EHCIQueue, packet); trace_usb_ehci_queue_action(q, ""wakeup""); assert(q->async == EHCI_ASYNC_INFLIGHT); q->async = EHCI_ASYNC_FINISHED; q->usb_status = packet->len; }","Yes, it is vulnerable."767765,"static int mov_read_header(AVFormatContext *s) { MOVContext *mov = s->priv_data; AVIOContext *pb = s->pb; int j, err; MOVAtom atom = { AV_RL32(""root"") }; int i; if (mov->decryption_key_len != 0 && mov->decryption_key_len != AES_CTR_KEY_SIZE) { av_log(s, AV_LOG_ERROR, ""Invalid decryption key len %d expected %d\n"", mov->decryption_key_len, AES_CTR_KEY_SIZE); return AVERROR(EINVAL); } mov->fc = s; mov->trak_index = -1; /* .mov and .mp4 aren't streamable anyway (only progressive download if moov is before mdat) */ if (pb->seekable) atom.size = avio_size(pb); else atom.size = INT64_MAX; /* check MOV header */ do { if (mov->moov_retry) avio_seek(pb, 0, SEEK_SET); if ((err = mov_read_default(mov, pb, atom)) < 0) { av_log(s, AV_LOG_ERROR, ""error reading header\n""); mov_read_close(s); return err; } } while (pb->seekable && !mov->found_moov && !mov->moov_retry++); if (!mov->found_moov) { av_log(s, AV_LOG_ERROR, ""moov atom not found\n""); mov_read_close(s); return AVERROR_INVALIDDATA; } av_log(mov->fc, AV_LOG_TRACE, ""on_parse_exit_offset=%""PRId64""\n"", avio_tell(pb)); if (pb->seekable) { if (mov->nb_chapter_tracks > 0 && !mov->ignore_chapters) mov_read_chapters(s); for (i = 0; i < s->nb_streams; i++) if (s->streams[i]->codecpar->codec_tag == AV_RL32(""tmcd"")) { mov_read_timecode_track(s, s->streams[i]); } else if (s->streams[i]->codecpar->codec_tag == AV_RL32(""rtmd"")) { mov_read_rtmd_track(s, s->streams[i]); } } /* copy timecode metadata from tmcd tracks to the related video streams */ for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; if (sc->timecode_track > 0) { AVDictionaryEntry *tcr; int tmcd_st_id = -1; for (j = 0; j < s->nb_streams; j++) if (s->streams[j]->id == sc->timecode_track) tmcd_st_id = j; if (tmcd_st_id < 0 || tmcd_st_id == i) continue; tcr = av_dict_get(s->streams[tmcd_st_id]->metadata, ""timecode"", NULL, 0); if (tcr) av_dict_set(&st->metadata, ""timecode"", tcr->value, 0); } } export_orphan_timecode(s); for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; fix_timescale(mov, sc); if(st->codecpar->codec_type == AVMEDIA_TYPE_AUDIO && st->codecpar->codec_id == AV_CODEC_ID_AAC) { st->skip_samples = sc->start_pad; } if (st->codecpar->codec_type == AVMEDIA_TYPE_VIDEO && sc->nb_frames_for_fps > 0 && sc->duration_for_fps > 0) av_reduce(&st->avg_frame_rate.num, &st->avg_frame_rate.den, sc->time_scale*(int64_t)sc->nb_frames_for_fps, sc->duration_for_fps, INT_MAX); if (st->codecpar->codec_type == AVMEDIA_TYPE_SUBTITLE) { if (st->codecpar->width <= 0 || st->codecpar->height <= 0) { st->codecpar->width = sc->width; st->codecpar->height = sc->height; } if (st->codecpar->codec_id == AV_CODEC_ID_DVD_SUBTITLE) { if ((err = mov_rewrite_dvd_sub_extradata(st)) < 0) return err; } } if (mov->handbrake_version && mov->handbrake_version <= 1000000*0 + 1000*10 + 2 && // 0.10.2 st->codecpar->codec_id == AV_CODEC_ID_MP3 ) { av_log(s, AV_LOG_VERBOSE, ""Forcing full parsing for mp3 stream\n""); st->need_parsing = AVSTREAM_PARSE_FULL; } } if (mov->trex_data) { for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; if (st->duration > 0) st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / st->duration; } } if (mov->use_mfra_for > 0) { for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; if (sc->duration_for_fps > 0) { st->codecpar->bit_rate = sc->data_size * 8 * sc->time_scale / sc->duration_for_fps; } } } for (i = 0; i < mov->bitrates_count && i < s->nb_streams; i++) { if (mov->bitrates[i]) { s->streams[i]->codecpar->bit_rate = mov->bitrates[i]; } } ff_rfps_calculate(s); for (i = 0; i < s->nb_streams; i++) { AVStream *st = s->streams[i]; MOVStreamContext *sc = st->priv_data; switch (st->codecpar->codec_type) { case AVMEDIA_TYPE_AUDIO: err = ff_replaygain_export(st, s->metadata); if (err < 0) { mov_read_close(s); return err; } break; case AVMEDIA_TYPE_VIDEO: if (sc->display_matrix) { err = av_stream_add_side_data(st, AV_PKT_DATA_DISPLAYMATRIX, (uint8_t*)sc->display_matrix, sizeof(int32_t) * 9); if (err < 0) return err; sc->display_matrix = NULL; } if (sc->stereo3d) { err = av_stream_add_side_data(st, AV_PKT_DATA_STEREO3D, (uint8_t *)sc->stereo3d, sizeof(*sc->stereo3d)); if (err < 0) return err; sc->stereo3d = NULL; } if (sc->spherical) { err = av_stream_add_side_data(st, AV_PKT_DATA_SPHERICAL, (uint8_t *)sc->spherical, sc->spherical_size); if (err < 0) return err; sc->spherical = NULL; } break; } } ff_configure_buffers_for_index(s, AV_TIME_BASE); return 0; }","Yes, it is vulnerable."768766,"static int thread_execute(AVCodecContext *avctx, action_func* func, void *arg, int *ret, int job_count, int job_size) { SliceThreadContext *c = avctx->internal->thread_ctx; if (!(avctx->active_thread_type&FF_THREAD_SLICE) || avctx->thread_count <= 1) return avcodec_default_execute(avctx, func, arg, ret, job_count, job_size); if (job_count <= 0) return 0; pthread_mutex_lock(&c->current_job_lock); c->current_job = avctx->thread_count; c->job_count = job_count; c->job_size = job_size; c->args = arg; c->func = func; c->rets = ret; c->current_execute++; pthread_cond_broadcast(&c->current_job_cond); thread_park_workers(c, avctx->thread_count); return 0; }","Yes, it is vulnerable."769767,"static void gain_compensate(COOKContext *q, cook_gains *gains_ptr, float* previous_buffer) { const float fc = q->pow2tab[gains_ptr->previous[0] + 63]; float *buffer = q->mono_mdct_output; int i; /* Overlap with the previous block. */ for(i=0 ; i<q->samples_per_channel ; i++) { buffer[i] *= fc; buffer[i] += previous_buffer[i]; } /* Apply gain profile */ for (i = 0; i < 8; i++) { if (gains_ptr->now[i] || gains_ptr->now[i + 1]) interpolate(q, &buffer[q->gain_size_factor * i], gains_ptr->now[i], gains_ptr->now[i + 1]); } /* Save away the current to be previous block. */ memcpy(previous_buffer, buffer+q->samples_per_channel, sizeof(float)*q->samples_per_channel); }","No, it is non-vulnerable."770768,"int ff_mov_init_hinting(AVFormatContext *s, int index, int src_index) { MOVMuxContext *mov = s->priv_data; MOVTrack *track = &mov->tracks[index]; MOVTrack *src_track = &mov->tracks[src_index]; AVStream *src_st = s->streams[src_index]; int ret = AVERROR(ENOMEM); AVOutputFormat *rtp_format = av_guess_format(""rtp"", NULL, NULL); track->tag = MKTAG('r','t','p',' '); track->src_track = src_index; if (!rtp_format) { ret = AVERROR(ENOENT); goto fail; } track->enc = avcodec_alloc_context(); if (!track->enc) goto fail; track->enc->codec_type = AVMEDIA_TYPE_DATA; track->enc->codec_tag = track->tag; track->rtp_ctx = avformat_alloc_context(); if (!track->rtp_ctx) goto fail; track->rtp_ctx->oformat = rtp_format; if (!av_new_stream(track->rtp_ctx, 0)) goto fail; /* Copy stream parameters */ track->rtp_ctx->streams[0]->sample_aspect_ratio = src_st->sample_aspect_ratio; /* Remove the allocated codec context, link to the original one * instead, to give the rtp muxer access to codec parameters. */ av_free(track->rtp_ctx->streams[0]->codec); track->rtp_ctx->streams[0]->codec = src_st->codec; if ((ret = url_open_dyn_packet_buf(&track->rtp_ctx->pb, RTP_MAX_PACKET_SIZE)) < 0) goto fail; ret = av_write_header(track->rtp_ctx); if (ret) goto fail; /* Copy the RTP AVStream timebase back to the hint AVStream */ track->timescale = track->rtp_ctx->streams[0]->time_base.den; /* Mark the hinted track that packets written to it should be * sent to this track for hinting. */ src_track->hint_track = index; return 0; fail: av_log(s, AV_LOG_WARNING, ""Unable to initialize hinting of stream %d\n"", src_index); if (track->rtp_ctx && track->rtp_ctx->pb) { uint8_t *buf; url_close_dyn_buf(track->rtp_ctx->pb, &buf); av_free(buf); } if (track->rtp_ctx && track->rtp_ctx->streams[0]) { av_metadata_free(&track->rtp_ctx->streams[0]->metadata); av_free(track->rtp_ctx->streams[0]); } if (track->rtp_ctx) { av_metadata_free(&track->rtp_ctx->metadata); av_free(track->rtp_ctx->priv_data); av_freep(&track->rtp_ctx); } av_freep(&track->enc); /* Set a default timescale, to avoid crashes in dump_format */ track->timescale = 90000; return ret; }","Yes, it is vulnerable."771769,"static inline int l3_unscale(int value, int exponent) { unsigned int m; int e; e = table_4_3_exp [4 * value + (exponent & 3)]; m = table_4_3_value[4 * value + (exponent & 3)]; e -= exponent >> 2; #ifdef DEBUG if(e < 1) av_log(NULL, AV_LOG_WARNING, ""l3_unscale: e is %d\n"", e); #endif if (e > (SUINT)31) return 0; m = (m + (1 << (e - 1))) >> e; return m; }","Yes, it is vulnerable."772770,"static int l2_allocate(BlockDriverState *bs, int l1_index, uint64_t **table) { BDRVQcow2State *s = bs->opaque; uint64_t old_l2_offset; uint64_t *l2_table = NULL; int64_t l2_offset; int ret; old_l2_offset = s->l1_table[l1_index]; trace_qcow2_l2_allocate(bs, l1_index); /* allocate a new l2 entry */ l2_offset = qcow2_alloc_clusters(bs, s->l2_size * sizeof(uint64_t)); if (l2_offset < 0) { ret = l2_offset; ret = qcow2_cache_flush(bs, s->refcount_block_cache); if (ret < 0) { /* allocate a new entry in the l2 cache */ trace_qcow2_l2_allocate_get_empty(bs, l1_index); ret = qcow2_cache_get_empty(bs, s->l2_table_cache, l2_offset, (void**) table); if (ret < 0) { l2_table = *table; if ((old_l2_offset & L1E_OFFSET_MASK) == 0) { /* if there was no old l2 table, clear the new table */ memset(l2_table, 0, s->l2_size * sizeof(uint64_t)); } else { uint64_t* old_table; /* if there was an old l2 table, read it from the disk */ BLKDBG_EVENT(bs->file, BLKDBG_L2_ALLOC_COW_READ); ret = qcow2_cache_get(bs, s->l2_table_cache, old_l2_offset & L1E_OFFSET_MASK, (void**) &old_table); if (ret < 0) { memcpy(l2_table, old_table, s->cluster_size); qcow2_cache_put(bs, s->l2_table_cache, (void **) &old_table); /* write the l2 table to the file */ BLKDBG_EVENT(bs->file, BLKDBG_L2_ALLOC_WRITE); trace_qcow2_l2_allocate_write_l2(bs, l1_index); qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table); ret = qcow2_cache_flush(bs, s->l2_table_cache); if (ret < 0) { /* update the L1 entry */ trace_qcow2_l2_allocate_write_l1(bs, l1_index); s->l1_table[l1_index] = l2_offset | QCOW_OFLAG_COPIED; ret = qcow2_write_l1_entry(bs, l1_index); if (ret < 0) { *table = l2_table; trace_qcow2_l2_allocate_done(bs, l1_index, 0); return 0; fail: trace_qcow2_l2_allocate_done(bs, l1_index, ret); if (l2_table != NULL) { qcow2_cache_put(bs, s->l2_table_cache, (void**) table); s->l1_table[l1_index] = old_l2_offset; if (l2_offset > 0) { qcow2_free_clusters(bs, l2_offset, s->l2_size * sizeof(uint64_t), QCOW2_DISCARD_ALWAYS); return ret;","Yes, it is vulnerable."773771,"void get_tmp_filename(char *filename, int size) { char temp_dir[MAX_PATH]; GetTempPath(MAX_PATH, temp_dir); GetTempFileName(temp_dir, ""qem"", 0, filename); }","Yes, it is vulnerable."774772,"static int handle_p_frame_apng(AVCodecContext *avctx, PNGDecContext *s, AVFrame *p) { size_t x, y; uint8_t *buffer = av_malloc(s->image_linesize * s->height); if (!buffer) return AVERROR(ENOMEM); if (s->blend_op == APNG_BLEND_OP_OVER && avctx->pix_fmt != AV_PIX_FMT_RGBA && avctx->pix_fmt != AV_PIX_FMT_GRAY8A && avctx->pix_fmt != AV_PIX_FMT_PAL8) { avpriv_request_sample(avctx, ""Blending with pixel format %s"", av_get_pix_fmt_name(avctx->pix_fmt)); return AVERROR_PATCHWELCOME; } // Do the disposal operation specified by the last frame on the frame if (s->last_dispose_op != APNG_DISPOSE_OP_PREVIOUS) { ff_thread_await_progress(&s->last_picture, INT_MAX, 0); memcpy(buffer, s->last_picture.f->data[0], s->image_linesize * s->height); if (s->last_dispose_op == APNG_DISPOSE_OP_BACKGROUND) for (y = s->last_y_offset; y < s->last_y_offset + s->last_h; ++y) memset(buffer + s->image_linesize * y + s->bpp * s->last_x_offset, 0, s->bpp * s->last_w); memcpy(s->previous_picture.f->data[0], buffer, s->image_linesize * s->height); ff_thread_report_progress(&s->previous_picture, INT_MAX, 0); } else { ff_thread_await_progress(&s->previous_picture, INT_MAX, 0); memcpy(buffer, s->previous_picture.f->data[0], s->image_linesize * s->height); } // Perform blending if (s->blend_op == APNG_BLEND_OP_SOURCE) { for (y = s->y_offset; y < s->y_offset + s->cur_h; ++y) { size_t row_start = s->image_linesize * y + s->bpp * s->x_offset; memcpy(buffer + row_start, p->data[0] + row_start, s->bpp * s->cur_w); } } else { // APNG_BLEND_OP_OVER for (y = s->y_offset; y < s->y_offset + s->cur_h; ++y) { uint8_t *foreground = p->data[0] + s->image_linesize * y + s->bpp * s->x_offset; uint8_t *background = buffer + s->image_linesize * y + s->bpp * s->x_offset; for (x = s->x_offset; x < s->x_offset + s->cur_w; ++x, foreground += s->bpp, background += s->bpp) { size_t b; uint8_t foreground_alpha, background_alpha, output_alpha; uint8_t output[4]; // Since we might be blending alpha onto alpha, we use the following equations: // output_alpha = foreground_alpha + (1 - foreground_alpha) * background_alpha // output = (foreground_alpha * foreground + (1 - foreground_alpha) * background_alpha * background) / output_alpha switch (avctx->pix_fmt) { case AV_PIX_FMT_RGBA: foreground_alpha = foreground[3]; background_alpha = background[3]; break; case AV_PIX_FMT_GRAY8A: foreground_alpha = foreground[1]; background_alpha = background[1]; break; case AV_PIX_FMT_PAL8: foreground_alpha = s->palette[foreground[0]] >> 24; background_alpha = s->palette[background[0]] >> 24; break; } if (foreground_alpha == 0) continue; if (foreground_alpha == 255) { memcpy(background, foreground, s->bpp); continue; } if (avctx->pix_fmt == AV_PIX_FMT_PAL8) { // TODO: Alpha blending with PAL8 will likely need the entire image converted over to RGBA first avpriv_request_sample(avctx, ""Alpha blending palette samples""); background[0] = foreground[0]; continue; } output_alpha = foreground_alpha + FAST_DIV255((255 - foreground_alpha) * background_alpha); for (b = 0; b < s->bpp - 1; ++b) { if (output_alpha == 0) { output[b] = 0; } else if (background_alpha == 255) { output[b] = FAST_DIV255(foreground_alpha * foreground[b] + (255 - foreground_alpha) * background[b]); } else { output[b] = (255 * foreground_alpha * foreground[b] + (255 - foreground_alpha) * background_alpha * background[b]) / (255 * output_alpha); } } output[b] = output_alpha; memcpy(background, output, s->bpp); } } } // Copy blended buffer into the frame and free memcpy(p->data[0], buffer, s->image_linesize * s->height); av_free(buffer); return 0; }","Yes, it is vulnerable."775773,"void microblaze_load_kernel(MicroBlazeCPU *cpu, target_phys_addr_t ddr_base, uint32_t ramsize, const char *dtb_filename, void (*machine_cpu_reset)(MicroBlazeCPU *)) { QemuOpts *machine_opts; const char *kernel_filename = NULL; const char *kernel_cmdline = NULL; machine_opts = qemu_opts_find(qemu_find_opts(""machine""), 0); if (machine_opts) { const char *dtb_arg; kernel_filename = qemu_opt_get(machine_opts, ""kernel""); kernel_cmdline = qemu_opt_get(machine_opts, ""append""); dtb_arg = qemu_opt_get(machine_opts, ""dtb""); if (dtb_arg) { /* Preference a -dtb argument */ dtb_filename = dtb_arg; } else { /* default to pcbios dtb as passed by machine_init */ dtb_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, dtb_filename); } } boot_info.machine_cpu_reset = machine_cpu_reset; qemu_register_reset(main_cpu_reset, cpu); if (kernel_filename) { int kernel_size; uint64_t entry, low, high; uint32_t base32; int big_endian = 0; #ifdef TARGET_WORDS_BIGENDIAN big_endian = 1; #endif /* Boots a kernel elf binary. */ kernel_size = load_elf(kernel_filename, NULL, NULL, &entry, &low, &high, big_endian, ELF_MACHINE, 0); base32 = entry; if (base32 == 0xc0000000) { kernel_size = load_elf(kernel_filename, translate_kernel_address, NULL, &entry, NULL, NULL, big_endian, ELF_MACHINE, 0); } /* Always boot into physical ram. */ boot_info.bootstrap_pc = ddr_base + (entry & 0x0fffffff); /* If it wasn't an ELF image, try an u-boot image. */ if (kernel_size < 0) { target_phys_addr_t uentry, loadaddr; kernel_size = load_uimage(kernel_filename, &uentry, &loadaddr, 0); boot_info.bootstrap_pc = uentry; high = (loadaddr + kernel_size + 3) & ~3; } /* Not an ELF image nor an u-boot image, try a RAW image. */ if (kernel_size < 0) { kernel_size = load_image_targphys(kernel_filename, ddr_base, ram_size); boot_info.bootstrap_pc = ddr_base; high = (ddr_base + kernel_size + 3) & ~3; } boot_info.cmdline = high + 4096; if (kernel_cmdline && strlen(kernel_cmdline)) { pstrcpy_targphys(""cmdline"", boot_info.cmdline, 256, kernel_cmdline); } /* Provide a device-tree. */ boot_info.fdt = boot_info.cmdline + 4096; microblaze_load_dtb(boot_info.fdt, ram_size, kernel_cmdline, dtb_filename); } }","No, it is non-vulnerable."776774,"void qemu_clock_enable(QEMUClockType type, bool enabled) { QEMUClock *clock = qemu_clock_ptr(type); QEMUTimerList *tl; bool old = clock->enabled; clock->enabled = enabled; if (enabled && !old) { qemu_clock_notify(type); } else if (!enabled && old) { QLIST_FOREACH(tl, &clock->timerlists, list) { qemu_event_wait(&tl->timers_done_ev); } } }","No, it is non-vulnerable."777775,"static uint64_t grlib_gptimer_read(void *opaque, target_phys_addr_t addr, unsigned size) { GPTimerUnit *unit = opaque; target_phys_addr_t timer_addr; int id; uint32_t value = 0; addr &= 0xff; /* Unit registers */ switch (addr) { case SCALER_OFFSET: trace_grlib_gptimer_readl(-1, addr, unit->scaler); return unit->scaler; case SCALER_RELOAD_OFFSET: trace_grlib_gptimer_readl(-1, addr, unit->reload); return unit->reload; case CONFIG_OFFSET: trace_grlib_gptimer_readl(-1, addr, unit->config); return unit->config; default: break; } timer_addr = (addr % TIMER_BASE); id = (addr - TIMER_BASE) / TIMER_BASE; if (id >= 0 && id < unit->nr_timers) { /* GPTimer registers */ switch (timer_addr) { case COUNTER_OFFSET: value = ptimer_get_count(unit->timers[id].ptimer); trace_grlib_gptimer_readl(id, addr, value); return value; case COUNTER_RELOAD_OFFSET: value = unit->timers[id].reload; trace_grlib_gptimer_readl(id, addr, value); return value; case CONFIG_OFFSET: trace_grlib_gptimer_readl(id, addr, unit->timers[id].config); return unit->timers[id].config; default: break; } } trace_grlib_gptimer_readl(-1, addr, 0); return 0; }","No, it is non-vulnerable."778776,"static int get_cpsr(QEMUFile *f, void *opaque, size_t size, VMStateField *field) { ARMCPU *cpu = opaque; CPUARMState *env = &cpu->env; uint32_t val = qemu_get_be32(f); if (arm_feature(env, ARM_FEATURE_M)) { if (val & XPSR_EXCP) { /* This is a CPSR format value from an older QEMU. (We can tell * because values transferred in XPSR format always have zero * for the EXCP field, and CPSR format will always have bit 4 * set in CPSR_M.) Rearrange it into XPSR format. The significant * differences are that the T bit is not in the same place, the * primask/faultmask info may be in the CPSR I and F bits, and * we do not want the mode bits. */ uint32_t newval = val; newval &= (CPSR_NZCV | CPSR_Q | CPSR_IT | CPSR_GE); if (val & CPSR_T) { newval |= XPSR_T; } /* If the I or F bits are set then this is a migration from * an old QEMU which still stored the M profile FAULTMASK * and PRIMASK in env->daif. For a new QEMU, the data is * transferred using the vmstate_m_faultmask_primask subsection. */ if (val & CPSR_F) { env->v7m.faultmask = 1; } if (val & CPSR_I) { env->v7m.primask = 1; } val = newval; } /* Ignore the low bits, they are handled by vmstate_m. */ xpsr_write(env, val, ~XPSR_EXCP); return 0; } env->aarch64 = ((val & PSTATE_nRW) == 0); if (is_a64(env)) { pstate_write(env, val); return 0; } cpsr_write(env, val, 0xffffffff, CPSRWriteRaw); return 0; }","No, it is non-vulnerable."779777,"static void pcnet_receive(void *opaque, const uint8_t *buf, int size) { PCNetState *s = opaque; int is_padr = 0, is_bcast = 0, is_ladr = 0; uint8_t buf1[60]; if (CSR_DRX(s) || CSR_STOP(s) || CSR_SPND(s) || !size) return; #ifdef PCNET_DEBUG printf(""pcnet_receive size=%d\n"", size); #endif /* if too small buffer, then expand it */ if (size < MIN_BUF_SIZE) { memcpy(buf1, buf, size); memset(buf1 + size, 0, MIN_BUF_SIZE - size); buf = buf1; size = MIN_BUF_SIZE; } if (CSR_PROM(s) || (is_padr=padr_match(s, buf, size)) || (is_bcast=padr_bcast(s, buf, size)) || (is_ladr=ladr_match(s, buf, size))) { pcnet_rdte_poll(s); if (!(CSR_CRST(s) & 0x8000) && s->rdra) { struct pcnet_RMD rmd; int rcvrc = CSR_RCVRC(s)-1,i; target_phys_addr_t nrda; for (i = CSR_RCVRL(s)-1; i > 0; i--, rcvrc--) { if (rcvrc <= 1) rcvrc = CSR_RCVRL(s); nrda = s->rdra + (CSR_RCVRL(s) - rcvrc) * (BCR_SWSTYLE(s) ? 16 : 8 ); RMDLOAD(&rmd, PHYSADDR(s,nrda)); if (GET_FIELD(rmd.status, RMDS, OWN)) { #ifdef PCNET_DEBUG_RMD printf(""pcnet - scan buffer: RCVRC=%d PREV_RCVRC=%d\n"", rcvrc, CSR_RCVRC(s)); #endif CSR_RCVRC(s) = rcvrc; pcnet_rdte_poll(s); break; } } } if (!(CSR_CRST(s) & 0x8000)) { #ifdef PCNET_DEBUG_RMD printf(""pcnet - no buffer: RCVRC=%d\n"", CSR_RCVRC(s)); #endif s->csr[0] |= 0x1000; /* Set MISS flag */ CSR_MISSC(s)++; } else { uint8_t *src = &s->buffer[8]; target_phys_addr_t crda = CSR_CRDA(s); struct pcnet_RMD rmd; int pktcount = 0; memcpy(src, buf, size); #if 1 /* no need to compute the CRC */ src[size] = 0; src[size + 1] = 0; src[size + 2] = 0; src[size + 3] = 0; size += 4; #else /* XXX: avoid CRC generation */ if (!CSR_ASTRP_RCV(s)) { uint32_t fcs = ~0; uint8_t *p = src; while (size < 46) { src[size++] = 0; } while (p != &src[size]) { CRC(fcs, *p++); } ((uint32_t *)&src[size])[0] = htonl(fcs); size += 4; /* FCS at end of packet */ } else size += 4; #endif #ifdef PCNET_DEBUG_MATCH PRINT_PKTHDR(buf); #endif RMDLOAD(&rmd, PHYSADDR(s,crda)); /*if (!CSR_LAPPEN(s))*/ SET_FIELD(&rmd.status, RMDS, STP, 1); #define PCNET_RECV_STORE() do { \ int count = MIN(4096 - GET_FIELD(rmd.buf_length, RMDL, BCNT),size); \ target_phys_addr_t rbadr = PHYSADDR(s, rmd.rbadr); \ s->phys_mem_write(s->dma_opaque, rbadr, src, count, CSR_BSWP(s)); \ src += count; size -= count; \ SET_FIELD(&rmd.msg_length, RMDM, MCNT, count); \ SET_FIELD(&rmd.status, RMDS, OWN, 0); \ RMDSTORE(&rmd, PHYSADDR(s,crda)); \ pktcount++; \ } while (0) PCNET_RECV_STORE(); if ((size > 0) && CSR_NRDA(s)) { target_phys_addr_t nrda = CSR_NRDA(s); RMDLOAD(&rmd, PHYSADDR(s,nrda)); if (GET_FIELD(rmd.status, RMDS, OWN)) { crda = nrda; PCNET_RECV_STORE(); if ((size > 0) && (nrda=CSR_NNRD(s))) { RMDLOAD(&rmd, PHYSADDR(s,nrda)); if (GET_FIELD(rmd.status, RMDS, OWN)) { crda = nrda; PCNET_RECV_STORE(); } } } } #undef PCNET_RECV_STORE RMDLOAD(&rmd, PHYSADDR(s,crda)); if (size == 0) { SET_FIELD(&rmd.status, RMDS, ENP, 1); SET_FIELD(&rmd.status, RMDS, PAM, !CSR_PROM(s) && is_padr); SET_FIELD(&rmd.status, RMDS, LFAM, !CSR_PROM(s) && is_ladr); SET_FIELD(&rmd.status, RMDS, BAM, !CSR_PROM(s) && is_bcast); } else { SET_FIELD(&rmd.status, RMDS, OFLO, 1); SET_FIELD(&rmd.status, RMDS, BUFF, 1); SET_FIELD(&rmd.status, RMDS, ERR, 1); } RMDSTORE(&rmd, PHYSADDR(s,crda)); s->csr[0] |= 0x0400; #ifdef PCNET_DEBUG printf(""RCVRC=%d CRDA=0x%08x BLKS=%d\n"", CSR_RCVRC(s), PHYSADDR(s,CSR_CRDA(s)), pktcount); #endif #ifdef PCNET_DEBUG_RMD PRINT_RMD(&rmd); #endif while (pktcount--) { if (CSR_RCVRC(s) <= 1) CSR_RCVRC(s) = CSR_RCVRL(s); else CSR_RCVRC(s)--; } pcnet_rdte_poll(s); } } pcnet_poll(s); pcnet_update_irq(s); }","No, it is non-vulnerable."780778,"static uint32_t m5206_mbar_readl(void *opaque, target_phys_addr_t offset) { m5206_mbar_state *s = (m5206_mbar_state *)opaque; int width; offset &= 0x3ff; if (offset >= 0x200) { hw_error(""Bad MBAR read offset 0x%x"", (int)offset); } width = m5206_mbar_width[offset >> 2]; if (width < 4) { uint32_t val; val = m5206_mbar_readw(opaque, offset) << 16; val |= m5206_mbar_readw(opaque, offset + 2); return val; } return m5206_mbar_read(s, offset, 4); }","No, it is non-vulnerable."781779,"uint64_t qcow2_alloc_compressed_cluster_offset(BlockDriverState *bs, uint64_t offset, int compressed_size) { BDRVQcowState *s = bs->opaque; int l2_index, ret; uint64_t *l2_table; int64_t cluster_offset; int nb_csectors; ret = get_cluster_table(bs, offset, &l2_table, &l2_index); if (ret < 0) { return 0; } /* Compression can't overwrite anything. Fail if the cluster was already * allocated. */ cluster_offset = be64_to_cpu(l2_table[l2_index]); if (cluster_offset & L2E_OFFSET_MASK) { qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); return 0; } cluster_offset = qcow2_alloc_bytes(bs, compressed_size); if (cluster_offset < 0) { qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); return 0; } nb_csectors = ((cluster_offset + compressed_size - 1) >> 9) - (cluster_offset >> 9); cluster_offset |= QCOW_OFLAG_COMPRESSED | ((uint64_t)nb_csectors << s->csize_shift); /* update L2 table */ /* compressed clusters never have the copied flag */ BLKDBG_EVENT(bs->file, BLKDBG_L2_UPDATE_COMPRESSED); qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table); l2_table[l2_index] = cpu_to_be64(cluster_offset); ret = qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); if (ret < 0) { return 0; } return cluster_offset; }","No, it is non-vulnerable."782780,"void spapr_core_unplug_request(HotplugHandler *hotplug_dev, DeviceState *dev, Error **errp) { int index; sPAPRDRConnector *drc; sPAPRDRConnectorClass *drck; Error *local_err = NULL; CPUCore *cc = CPU_CORE(dev); int smt = kvmppc_smt_threads(); if (!spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index)) { error_setg(errp, ""Unable to find CPU core with core-id: %d"", cc->core_id); return; } if (index == 0) { error_setg(errp, ""Boot CPU core may not be unplugged""); return; } drc = spapr_dr_connector_by_id(SPAPR_DR_CONNECTOR_TYPE_CPU, index * smt); g_assert(drc); drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc); drck->detach(drc, dev, spapr_core_release, NULL, &local_err); if (local_err) { error_propagate(errp, local_err); return; } spapr_hotplug_req_remove_by_index(drc); }","No, it is non-vulnerable."783781,"void commit_active_start(BlockDriverState *bs, BlockDriverState *base, int64_t speed, BlockdevOnError on_error, BlockDriverCompletionFunc *cb, void *opaque, Error **errp) { int64_t length, base_length; int orig_base_flags; int ret; Error *local_err = NULL; orig_base_flags = bdrv_get_flags(base); if (bdrv_reopen(base, bs->open_flags, errp)) { return; } length = bdrv_getlength(bs); if (length < 0) { error_setg_errno(errp, -length, ""Unable to determine length of %s"", bs->filename); goto error_restore_flags; } base_length = bdrv_getlength(base); if (base_length < 0) { error_setg_errno(errp, -base_length, ""Unable to determine length of %s"", base->filename); goto error_restore_flags; } if (length > base_length) { ret = bdrv_truncate(base, length); if (ret < 0) { error_setg_errno(errp, -ret, ""Top image %s is larger than base image %s, and "" ""resize of base image failed"", bs->filename, base->filename); goto error_restore_flags; } } bdrv_ref(base); mirror_start_job(bs, base, speed, 0, 0, on_error, on_error, cb, opaque, &local_err, &commit_active_job_driver, false, base); if (error_is_set(&local_err)) { error_propagate(errp, local_err); goto error_restore_flags; } return; error_restore_flags: /* ignore error and errp for bdrv_reopen, because we want to propagate * the original error */ bdrv_reopen(base, orig_base_flags, NULL); return; }","No, it is non-vulnerable."784782,"static void term_up_char(void) { int idx; if (term_hist_entry == 0) return; if (term_hist_entry == -1) { /* Find latest entry */ for (idx = 0; idx < TERM_MAX_CMDS; idx++) { if (term_history[idx] == NULL) break; } term_hist_entry = idx; } term_hist_entry--; if (term_hist_entry >= 0) { pstrcpy(term_cmd_buf, sizeof(term_cmd_buf), term_history[term_hist_entry]); term_cmd_buf_index = term_cmd_buf_size = strlen(term_cmd_buf); } }","No, it is non-vulnerable."785783,"static int kalman_smoothen(WMAVoiceContext *s, int pitch, const float *in, float *out, int size) { int n; float optimal_gain = 0, dot; const float *ptr = &in[-FFMAX(s->min_pitch_val, pitch - 3)], *end = &in[-FFMIN(s->max_pitch_val, pitch + 3)], *best_hist_ptr; /* find best fitting point in history */ do { dot = ff_scalarproduct_float_c(in, ptr, size); if (dot > optimal_gain) { optimal_gain = dot; best_hist_ptr = ptr; } } while (--ptr >= end); if (optimal_gain <= 0) return -1; dot = ff_scalarproduct_float_c(best_hist_ptr, best_hist_ptr, size); if (dot <= 0) // would be 1.0 return -1; if (optimal_gain <= dot) { dot = dot / (dot + 0.6 * optimal_gain); // 0.625-1.000 } else dot = 0.625; /* actual smoothing */ for (n = 0; n < size; n++) out[n] = best_hist_ptr[n] + dot * (in[n] - best_hist_ptr[n]); return 0; }","Yes, it is vulnerable."786784,"static inline void gen_intermediate_code_internal(CPUState *env, TranslationBlock *tb, int search_pc) { DisasContext dc1, *dc = &dc1; CPUBreakpoint *bp; uint16_t *gen_opc_end; int j, lj; target_ulong pc_start; uint32_t next_page_start; int num_insns; int max_insns; /* generate intermediate code */ pc_start = tb->pc; dc->tb = tb; gen_opc_end = gen_opc_buf + OPC_MAX_SIZE; dc->is_jmp = DISAS_NEXT; dc->pc = pc_start; dc->singlestep_enabled = env->singlestep_enabled; dc->condjmp = 0; dc->thumb = ARM_TBFLAG_THUMB(tb->flags); dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1; dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4; #if !defined(CONFIG_USER_ONLY) dc->user = (ARM_TBFLAG_PRIV(tb->flags) == 0); #endif dc->vfp_enabled = ARM_TBFLAG_VFPEN(tb->flags); dc->vec_len = ARM_TBFLAG_VECLEN(tb->flags); dc->vec_stride = ARM_TBFLAG_VECSTRIDE(tb->flags); cpu_F0s = tcg_temp_new_i32(); cpu_F1s = tcg_temp_new_i32(); cpu_F0d = tcg_temp_new_i64(); cpu_F1d = tcg_temp_new_i64(); cpu_V0 = cpu_F0d; cpu_V1 = cpu_F1d; /* FIXME: cpu_M0 can probably be the same as cpu_V0. */ cpu_M0 = tcg_temp_new_i64(); next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE; lj = -1; num_insns = 0; max_insns = tb->cflags & CF_COUNT_MASK; if (max_insns == 0) max_insns = CF_COUNT_MASK; gen_icount_start(); tcg_clear_temp_count(); /* A note on handling of the condexec (IT) bits: * * We want to avoid the overhead of having to write the updated condexec * bits back to the CPUState for every instruction in an IT block. So: * (1) if the condexec bits are not already zero then we write * zero back into the CPUState now. This avoids complications trying * to do it at the end of the block. (For example if we don't do this * it's hard to identify whether we can safely skip writing condexec * at the end of the TB, which we definitely want to do for the case * where a TB doesn't do anything with the IT state at all.) * (2) if we are going to leave the TB then we call gen_set_condexec() * which will write the correct value into CPUState if zero is wrong. * This is done both for leaving the TB at the end, and for leaving * it because of an exception we know will happen, which is done in * gen_exception_insn(). The latter is necessary because we need to * leave the TB with the PC/IT state just prior to execution of the * instruction which caused the exception. * (3) if we leave the TB unexpectedly (eg a data abort on a load) * then the CPUState will be wrong and we need to reset it. * This is handled in the same way as restoration of the * PC in these situations: we will be called again with search_pc=1 * and generate a mapping of the condexec bits for each PC in * gen_opc_condexec_bits[]. gen_pc_load[] then uses this to restore * the condexec bits. * * Note that there are no instructions which can read the condexec * bits, and none which can write non-static values to them, so * we don't need to care about whether CPUState is correct in the * middle of a TB. */ /* Reset the conditional execution bits immediately. This avoids complications trying to do it at the end of the block. */ if (dc->condexec_mask || dc->condexec_cond) { TCGv tmp = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp, 0); store_cpu_field(tmp, condexec_bits); do { #ifdef CONFIG_USER_ONLY /* Intercept jump to the magic kernel page. */ if (dc->pc >= 0xffff0000) { /* We always get here via a jump, so know we are not in a conditional execution block. */ gen_exception(EXCP_KERNEL_TRAP); dc->is_jmp = DISAS_UPDATE; break; #else if (dc->pc >= 0xfffffff0 && IS_M(env)) { /* We always get here via a jump, so know we are not in a conditional execution block. */ gen_exception(EXCP_EXCEPTION_EXIT); dc->is_jmp = DISAS_UPDATE; break; #endif if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) { QTAILQ_FOREACH(bp, &env->breakpoints, entry) { if (bp->pc == dc->pc) { gen_exception_insn(dc, 0, EXCP_DEBUG); /* Advance PC so that clearing the breakpoint will invalidate this TB. */ dc->pc += 2; goto done_generating; break; if (search_pc) { j = gen_opc_ptr - gen_opc_buf; if (lj < j) { lj++; while (lj < j) gen_opc_instr_start[lj++] = 0; gen_opc_pc[lj] = dc->pc; gen_opc_condexec_bits[lj] = (dc->condexec_cond << 4) | (dc->condexec_mask >> 1); gen_opc_instr_start[lj] = 1; gen_opc_icount[lj] = num_insns; if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO)) gen_io_start(); if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP))) { tcg_gen_debug_insn_start(dc->pc); if (dc->thumb) { disas_thumb_insn(env, dc); if (dc->condexec_mask) { dc->condexec_cond = (dc->condexec_cond & 0xe) | ((dc->condexec_mask >> 4) & 1); dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f; if (dc->condexec_mask == 0) { dc->condexec_cond = 0; } else { disas_arm_insn(env, dc); if (dc->condjmp && !dc->is_jmp) { gen_set_label(dc->condlabel); dc->condjmp = 0; /* Translation stops when a conditional branch is encountered. * Otherwise the subsequent code could get translated several times. * Also stop translation when a page boundary is reached. This * ensures prefetch aborts occur at the right place. */ num_insns ++; } while (!dc->is_jmp && gen_opc_ptr < gen_opc_end && !env->singlestep_enabled && !singlestep && dc->pc < next_page_start && num_insns < max_insns); if (tb->cflags & CF_LAST_IO) { if (dc->condjmp) { /* FIXME: This can theoretically happen with self-modifying code. */ cpu_abort(env, ""IO on conditional branch instruction""); gen_io_end(); /* At this stage dc->condjmp will only be set when the skipped instruction was a conditional branch or trap, and the PC has already been written. */ if (unlikely(env->singlestep_enabled)) { /* Make sure the pc is updated, and raise a debug exception. */ if (dc->condjmp) { gen_set_condexec(dc); if (dc->is_jmp == DISAS_SWI) { gen_exception(EXCP_SWI); } else { gen_exception(EXCP_DEBUG); gen_set_label(dc->condlabel); if (dc->condjmp || !dc->is_jmp) { gen_set_pc_im(dc->pc); dc->condjmp = 0; gen_set_condexec(dc); if (dc->is_jmp == DISAS_SWI && !dc->condjmp) { gen_exception(EXCP_SWI); } else { /* FIXME: Single stepping a WFI insn will not halt the CPU. */ gen_exception(EXCP_DEBUG); } else { /* While branches must always occur at the end of an IT block, there are a few other things that can cause us to terminate the TB in the middel of an IT block: - Exception generating instructions (bkpt, swi, undefined). - Page boundaries. - Hardware watchpoints. Hardware breakpoints have already been handled and skip this code. */ gen_set_condexec(dc); switch(dc->is_jmp) { case DISAS_NEXT: gen_goto_tb(dc, 1, dc->pc); break; default: case DISAS_JUMP: case DISAS_UPDATE: /* indicate that the hash table must be used to find the next TB */ tcg_gen_exit_tb(0); break; case DISAS_TB_JUMP: /* nothing more to generate */ break; case DISAS_WFI: gen_helper_wfi(); break; case DISAS_SWI: gen_exception(EXCP_SWI); break; if (dc->condjmp) { gen_set_label(dc->condlabel); gen_set_condexec(dc); gen_goto_tb(dc, 1, dc->pc); dc->condjmp = 0; done_generating: gen_icount_end(tb, num_insns); *gen_opc_ptr = INDEX_op_end; #ifdef DEBUG_DISAS if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) { qemu_log(""----------------\n""); qemu_log(""IN: %s\n"", lookup_symbol(pc_start)); log_target_disas(pc_start, dc->pc - pc_start, dc->thumb); qemu_log(""\n""); #endif if (search_pc) { j = gen_opc_ptr - gen_opc_buf; lj++; while (lj <= j) gen_opc_instr_start[lj++] = 0; } else { tb->size = dc->pc - pc_start; tb->icount = num_insns;","Yes, it is vulnerable."787785,"static av_always_inline void thread_park_workers(SliceThreadContext *c, int thread_count) { while (c->current_job != thread_count + c->job_count) pthread_cond_wait(&c->last_job_cond, &c->current_job_lock); pthread_mutex_unlock(&c->current_job_lock); }","Yes, it is vulnerable."788786,"int av_image_get_linesize(enum PixelFormat pix_fmt, int width, int plane) { const AVPixFmtDescriptor *desc = &av_pix_fmt_descriptors[pix_fmt]; int max_step [4]; /* max pixel step for each plane */ int max_step_comp[4]; /* the component for each plane which has the max pixel step */ int s, linesize; if ((unsigned)pix_fmt >= PIX_FMT_NB || desc->flags & PIX_FMT_HWACCEL) return AVERROR(EINVAL); av_image_fill_max_pixsteps(max_step, max_step_comp, desc); s = (max_step_comp[plane] == 1 || max_step_comp[plane] == 2) ? desc->log2_chroma_w : 0; linesize = max_step[plane] * (((width + (1 << s) - 1)) >> s); if (desc->flags & PIX_FMT_BITSTREAM) linesize = (linesize + 7) >> 3; return linesize; }","No, it is non-vulnerable."789787,"static int field_end(H264Context *h, int in_setup) { MpegEncContext *const s = &h->s; AVCodecContext *const avctx = s->avctx; int err = 0; s->mb_y = 0; if (!in_setup && !s->droppable) ff_thread_report_progress(&s->current_picture_ptr->f, INT_MAX, s->picture_structure == PICT_BOTTOM_FIELD); if (CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU) ff_vdpau_h264_set_reference_frames(s); if (in_setup || !(avctx->active_thread_type & FF_THREAD_FRAME)) { if (!s->droppable) { err = ff_h264_execute_ref_pic_marking(h, h->mmco, h->mmco_index); h->prev_poc_msb = h->poc_msb; h->prev_poc_lsb = h->poc_lsb; } h->prev_frame_num_offset = h->frame_num_offset; h->prev_frame_num = h->frame_num; h->outputed_poc = h->next_outputed_poc; } if (avctx->hwaccel) { if (avctx->hwaccel->end_frame(avctx) < 0) av_log(avctx, AV_LOG_ERROR, ""hardware accelerator failed to decode picture\n""); } if (CONFIG_H264_VDPAU_DECODER && s->avctx->codec->capabilities & CODEC_CAP_HWACCEL_VDPAU) ff_vdpau_h264_picture_complete(s); /* * FIXME: Error handling code does not seem to support interlaced * when slices span multiple rows * The ff_er_add_slice calls don't work right for bottom * fields; they cause massive erroneous error concealing * Error marking covers both fields (top and bottom). * This causes a mismatched s->error_count * and a bad error table. Further, the error count goes to * INT_MAX when called for bottom field, because mb_y is * past end by one (callers fault) and resync_mb_y != 0 * causes problems for the first MB line, too. */ if (!FIELD_PICTURE && h->current_slice) ff_er_frame_end(s); ff_MPV_frame_end(s); h->current_slice = 0; return err; }","No, it is non-vulnerable."790788,"static int vmd_decode(VmdVideoContext *s, AVFrame *frame) { int i; unsigned int *palette32; unsigned char r, g, b; GetByteContext gb; unsigned char meth; unsigned char *dp; /* pointer to current frame */ unsigned char *pp; /* pointer to previous frame */ unsigned char len; int ofs; int frame_x, frame_y; int frame_width, frame_height; frame_x = AV_RL16(&s->buf[6]); frame_y = AV_RL16(&s->buf[8]); frame_width = AV_RL16(&s->buf[10]) - frame_x + 1; frame_height = AV_RL16(&s->buf[12]) - frame_y + 1; if (frame_x < 0 || frame_width < 0 || frame_x >= s->avctx->width || frame_width > s->avctx->width || frame_x + frame_width > s->avctx->width) { av_log(s->avctx, AV_LOG_ERROR, ""Invalid horizontal range %d-%d\n"", frame_x, frame_width); return AVERROR_INVALIDDATA; } if (frame_y < 0 || frame_height < 0 || frame_y >= s->avctx->height || frame_height > s->avctx->height || frame_y + frame_height > s->avctx->height) { av_log(s->avctx, AV_LOG_ERROR, ""Invalid vertical range %d-%d\n"", frame_x, frame_width); return AVERROR_INVALIDDATA; } if ((frame_width == s->avctx->width && frame_height == s->avctx->height) && (frame_x || frame_y)) { s->x_off = frame_x; s->y_off = frame_y; } frame_x -= s->x_off; frame_y -= s->y_off; /* if only a certain region will be updated, copy the entire previous * frame before the decode */ if (s->prev_frame.data[0] && (frame_x || frame_y || (frame_width != s->avctx->width) || (frame_height != s->avctx->height))) { memcpy(frame->data[0], s->prev_frame.data[0], s->avctx->height * frame->linesize[0]); } /* check if there is a new palette */ bytestream2_init(&gb, s->buf + 16, s->size - 16); if (s->buf[15] & 0x02) { bytestream2_skip(&gb, 2); palette32 = (unsigned int *)s->palette; if (bytestream2_get_bytes_left(&gb) >= PALETTE_COUNT * 3) { for (i = 0; i < PALETTE_COUNT; i++) { r = bytestream2_get_byteu(&gb) * 4; g = bytestream2_get_byteu(&gb) * 4; b = bytestream2_get_byteu(&gb) * 4; palette32[i] = (r << 16) | (g << 8) | (b); } } else { av_log(s->avctx, AV_LOG_ERROR, ""Incomplete palette\n""); return AVERROR_INVALIDDATA; } s->size -= PALETTE_COUNT * 3 + 2; } if (s->size > 0) { /* originally UnpackFrame in VAG's code */ bytestream2_init(&gb, gb.buffer, s->buf + s->size - gb.buffer); if (bytestream2_get_bytes_left(&gb) < 1) return AVERROR_INVALIDDATA; meth = bytestream2_get_byteu(&gb); if (meth & 0x80) { lz_unpack(gb.buffer, bytestream2_get_bytes_left(&gb), s->unpack_buffer, s->unpack_buffer_size); meth &= 0x7F; bytestream2_init(&gb, s->unpack_buffer, s->unpack_buffer_size); } dp = &frame->data[0][frame_y * frame->linesize[0] + frame_x]; pp = &s->prev_frame.data[0][frame_y * s->prev_frame.linesize[0] + frame_x]; switch (meth) { case 1: for (i = 0; i < frame_height; i++) { ofs = 0; do { len = bytestream2_get_byte(&gb); if (len & 0x80) { len = (len & 0x7F) + 1; if (ofs + len > frame_width || bytestream2_get_bytes_left(&gb) < len) return AVERROR_INVALIDDATA; bytestream2_get_buffer(&gb, &dp[ofs], len); ofs += len; } else { /* interframe pixel copy */ if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) return AVERROR_INVALIDDATA; memcpy(&dp[ofs], &pp[ofs], len + 1); ofs += len + 1; } } while (ofs < frame_width); if (ofs > frame_width) { av_log(s->avctx, AV_LOG_ERROR, ""VMD video: offset > width (%d > %d)\n"", ofs, frame_width); return AVERROR_INVALIDDATA; } dp += frame->linesize[0]; pp += s->prev_frame.linesize[0]; } break; case 2: for (i = 0; i < frame_height; i++) { bytestream2_get_buffer(&gb, dp, frame_width); dp += frame->linesize[0]; pp += s->prev_frame.linesize[0]; } break; case 3: for (i = 0; i < frame_height; i++) { ofs = 0; do { len = bytestream2_get_byte(&gb); if (len & 0x80) { len = (len & 0x7F) + 1; if (bytestream2_get_byte(&gb) == 0xFF) len = rle_unpack(gb.buffer, &dp[ofs], len, bytestream2_get_bytes_left(&gb), frame_width - ofs); else bytestream2_get_buffer(&gb, &dp[ofs], len); bytestream2_skip(&gb, len); } else { /* interframe pixel copy */ if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) return AVERROR_INVALIDDATA; memcpy(&dp[ofs], &pp[ofs], len + 1); ofs += len + 1; } } while (ofs < frame_width); if (ofs > frame_width) { av_log(s->avctx, AV_LOG_ERROR, ""VMD video: offset > width (%d > %d)\n"", ofs, frame_width); return AVERROR_INVALIDDATA; } dp += frame->linesize[0]; pp += s->prev_frame.linesize[0]; } break; } } return 0; }","No, it is non-vulnerable."791789,"static void joint_decode(COOKContext *q, float* mlt_buffer1, float* mlt_buffer2) { int i,j; int decouple_tab[SUBBAND_SIZE]; float decode_buffer[2048]; //Only 1060 might be needed. int idx, cpl_tmp,tmp_idx; float f1,f2; float* cplscale; memset(decouple_tab, 0, sizeof(decouple_tab)); memset(decode_buffer, 0, sizeof(decode_buffer)); /* Make sure the buffers are zeroed out. */ memset(mlt_buffer1,0, 1024*sizeof(float)); memset(mlt_buffer2,0, 1024*sizeof(float)); decouple_info(q, decouple_tab); mono_decode(q, decode_buffer); /* The two channels are stored interleaved in decode_buffer. */ for (i=0 ; i<q->js_subband_start ; i++) { for (j=0 ; j<SUBBAND_SIZE ; j++) { mlt_buffer1[i*20+j] = decode_buffer[i*40+j]; mlt_buffer2[i*20+j] = decode_buffer[i*40+20+j]; } } /* When we reach js_subband_start (the higher frequencies) the coefficients are stored in a coupling scheme. */ idx = (1 << q->js_vlc_bits) - 1; if (q->js_subband_start < q->subbands) { for (i=0 ; i<q->subbands ; i++) { cpl_tmp = cplband[i + q->js_subband_start]; idx -=decouple_tab[cpl_tmp]; cplscale = (float*)cplscales[q->js_vlc_bits-2]; //choose decoupler table f1 = cplscale[decouple_tab[cpl_tmp]]; f2 = cplscale[idx-1]; for (j=0 ; j<SUBBAND_SIZE ; j++) { tmp_idx = ((2*q->js_subband_start + i)*20)+j; mlt_buffer1[20*(i+q->js_subband_start) + j] = f1 * decode_buffer[tmp_idx]; mlt_buffer2[20*(i+q->js_subband_start) + j] = f2 * decode_buffer[tmp_idx]; } idx = (1 << q->js_vlc_bits) - 1; } } }","No, it is non-vulnerable."792790,"static inline int nvic_exec_prio(NVICState *s) { CPUARMState *env = &s->cpu->env; int running; if (env->daif & PSTATE_F) { /* FAULTMASK */ running = -1; } else if (env->daif & PSTATE_I) { /* PRIMASK */ running = 0; } else if (env->v7m.basepri > 0) { running = env->v7m.basepri & nvic_gprio_mask(s); } else { running = NVIC_NOEXC_PRIO; /* lower than any possible priority */ } /* consider priority of active handler */ return MIN(running, s->exception_prio); }","No, it is non-vulnerable."793791,"static int get_uint16(QEMUFile *f, void *pv, size_t size) { uint16_t *v = pv; qemu_get_be16s(f, v); return 0; }","Yes, it is vulnerable."794792,void *qemu_malloc(size_t size) { if (!size && !allow_zero_malloc()) { abort(); } return oom_check(malloc(size ? size : 1)); },"Yes, it is vulnerable."795793,"int nbd_receive_negotiate(int csock, const char *name, uint32_t *flags, off_t *size, size_t *blocksize) { char buf[256]; uint64_t magic, s; uint16_t tmp; TRACE(""Receiving negotiation.""); if (read_sync(csock, buf, 8) != 8) { LOG(""read failed""); errno = EINVAL; return -1; } buf[8] = '\0'; if (strlen(buf) == 0) { LOG(""server connection closed""); errno = EINVAL; return -1; } TRACE(""Magic is %c%c%c%c%c%c%c%c"", qemu_isprint(buf[0]) ? buf[0] : '.', qemu_isprint(buf[1]) ? buf[1] : '.', qemu_isprint(buf[2]) ? buf[2] : '.', qemu_isprint(buf[3]) ? buf[3] : '.', qemu_isprint(buf[4]) ? buf[4] : '.', qemu_isprint(buf[5]) ? buf[5] : '.', qemu_isprint(buf[6]) ? buf[6] : '.', qemu_isprint(buf[7]) ? buf[7] : '.'); if (memcmp(buf, ""NBDMAGIC"", 8) != 0) { LOG(""Invalid magic received""); errno = EINVAL; return -1; } if (read_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) { LOG(""read failed""); errno = EINVAL; return -1; } magic = be64_to_cpu(magic); TRACE(""Magic is 0x%"" PRIx64, magic); if (name) { uint32_t reserved = 0; uint32_t opt; uint32_t namesize; TRACE(""Checking magic (opts_magic)""); if (magic != 0x49484156454F5054LL) { LOG(""Bad magic received""); errno = EINVAL; return -1; } if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) { LOG(""flags read failed""); errno = EINVAL; return -1; } *flags = be16_to_cpu(tmp) << 16; /* reserved for future use */ if (write_sync(csock, &reserved, sizeof(reserved)) != sizeof(reserved)) { LOG(""write failed (reserved)""); errno = EINVAL; return -1; } /* write the export name */ magic = cpu_to_be64(magic); if (write_sync(csock, &magic, sizeof(magic)) != sizeof(magic)) { LOG(""write failed (magic)""); errno = EINVAL; return -1; } opt = cpu_to_be32(NBD_OPT_EXPORT_NAME); if (write_sync(csock, &opt, sizeof(opt)) != sizeof(opt)) { LOG(""write failed (opt)""); errno = EINVAL; return -1; } namesize = cpu_to_be32(strlen(name)); if (write_sync(csock, &namesize, sizeof(namesize)) != sizeof(namesize)) { LOG(""write failed (namesize)""); errno = EINVAL; return -1; } if (write_sync(csock, (char*)name, strlen(name)) != strlen(name)) { LOG(""write failed (name)""); errno = EINVAL; return -1; } } else { TRACE(""Checking magic (cli_magic)""); if (magic != 0x00420281861253LL) { LOG(""Bad magic received""); errno = EINVAL; return -1; } } if (read_sync(csock, &s, sizeof(s)) != sizeof(s)) { LOG(""read failed""); errno = EINVAL; return -1; } *size = be64_to_cpu(s); *blocksize = 1024; TRACE(""Size is %"" PRIu64, *size); if (!name) { if (read_sync(csock, flags, sizeof(*flags)) != sizeof(*flags)) { LOG(""read failed (flags)""); errno = EINVAL; return -1; } *flags = be32_to_cpup(flags); } else { if (read_sync(csock, &tmp, sizeof(tmp)) != sizeof(tmp)) { LOG(""read failed (tmp)""); errno = EINVAL; return -1; } *flags |= be32_to_cpu(tmp); } if (read_sync(csock, &buf, 124) != 124) { LOG(""read failed (buf)""); errno = EINVAL; return -1; } return 0; }","No, it is non-vulnerable."796794,"static bool timer_mod_ns_locked(QEMUTimerList *timer_list, QEMUTimer *ts, int64_t expire_time) { QEMUTimer **pt, *t; /* add the timer in the sorted list */ pt = &timer_list->active_timers; for (;;) { t = *pt; if (!timer_expired_ns(t, expire_time)) { break; } pt = &t->next; } ts->expire_time = MAX(expire_time, 0); ts->next = *pt; *pt = ts; return pt == &timer_list->active_timers; }","No, it is non-vulnerable."797795,"static void qvirtio_9p_start(void) { char *args; test_share = g_strdup(""/tmp/qtest.XXXXXX""); g_assert_nonnull(mkdtemp(test_share)); args = g_strdup_printf(""-fsdev local,id=fsdev0,security_model=none,path=%s "" ""-device virtio-9p-pci,fsdev=fsdev0,mount_tag=%s"", test_share, mount_tag); qtest_start(args); g_free(args); }","No, it is non-vulnerable."798796,"static void build_fs_mount_list(FsMountList *mounts, Error **errp) { FsMount *mount; char const *mountinfo = ""/proc/self/mountinfo""; FILE *fp; char *line = NULL, *dash; size_t n; char check; unsigned int devmajor, devminor; int ret, dir_s, dir_e, type_s, type_e, dev_s, dev_e; fp = fopen(mountinfo, ""r""); if (!fp) { build_fs_mount_list_from_mtab(mounts, errp); return; } while (getline(&line, &n, fp) != -1) { ret = sscanf(line, ""%*u %*u %u:%u %*s %n%*s%n%c"", &devmajor, &devminor, &dir_s, &dir_e, &check); if (ret < 3) { continue; } dash = strstr(line + dir_e, "" - ""); if (!dash) { continue; } ret = sscanf(dash, "" - %n%*s%n %n%*s%n%c"", &type_s, &type_e, &dev_s, &dev_e, &check); if (ret < 1) { continue; } line[dir_e] = 0; dash[type_e] = 0; dash[dev_e] = 0; decode_mntname(line + dir_s, dir_e - dir_s); decode_mntname(dash + dev_s, dev_e - dev_s); if (devmajor == 0) { /* btrfs reports major number = 0 */ if (strcmp(""btrfs"", dash + type_s) != 0 || dev_major_minor(dash + dev_s, &devmajor, &devminor) < 0) { continue; } } mount = g_malloc0(sizeof(FsMount)); mount->dirname = g_strdup(line + dir_s); mount->devtype = g_strdup(dash + type_s); mount->devmajor = devmajor; mount->devminor = devminor; QTAILQ_INSERT_TAIL(mounts, mount, next); } free(line); fclose(fp); }","Yes, it is vulnerable."799797,"float64 int32_to_float64( int32 a STATUS_PARAM ) { flag zSign; uint32 absA; int8 shiftCount; bits64 zSig; if ( a == 0 ) return 0; zSign = ( a < 0 ); absA = zSign ? - a : a; shiftCount = countLeadingZeros32( absA ) + 21; zSig = absA; return packFloat64( zSign, 0x432 - shiftCount, zSig<<shiftCount ); }","No, it is non-vulnerable."800798,"void blkconf_serial(BlockConf *conf, char **serial) { DriveInfo *dinfo; if (!*serial) { /* try to fall back to value set with legacy -drive serial=... */ dinfo = drive_get_by_blockdev(conf->bs); if (*dinfo->serial) { *serial = g_strdup(dinfo->serial); } } }","No, it is non-vulnerable."801799,"int bitbang_i2c_set(bitbang_i2c_interface *i2c, int line, int level) { int data; if (level != 0 && level != 1) { abort(); } if (line == BITBANG_I2C_SDA) { if (level == i2c->last_data) { return bitbang_i2c_nop(i2c); } i2c->last_data = level; if (i2c->last_clock == 0) { return bitbang_i2c_nop(i2c); } if (level == 0) { DPRINTF(""START\n""); /* START condition. */ i2c->state = SENDING_BIT7; i2c->current_addr = -1; } else { /* STOP condition. */ bitbang_i2c_enter_stop(i2c); } return bitbang_i2c_ret(i2c, 1); } data = i2c->last_data; if (i2c->last_clock == level) { return bitbang_i2c_nop(i2c); } i2c->last_clock = level; if (level == 0) { /* State is set/read at the start of the clock pulse. release the data line at the end. */ return bitbang_i2c_ret(i2c, 1); } switch (i2c->state) { case STOPPED: case SENT_NACK: return bitbang_i2c_ret(i2c, 1); case SENDING_BIT7 ... SENDING_BIT0: i2c->buffer = (i2c->buffer << 1) | data; /* will end up in WAITING_FOR_ACK */ i2c->state++; return bitbang_i2c_ret(i2c, 1); case WAITING_FOR_ACK: if (i2c->current_addr < 0) { i2c->current_addr = i2c->buffer; DPRINTF(""Address 0x%02x\n"", i2c->current_addr); i2c_start_transfer(i2c->bus, i2c->current_addr >> 1, i2c->current_addr & 1); } else { DPRINTF(""Sent 0x%02x\n"", i2c->buffer); i2c_send(i2c->bus, i2c->buffer); } if (i2c->current_addr & 1) { i2c->state = RECEIVING_BIT7; } else { i2c->state = SENDING_BIT7; } return bitbang_i2c_ret(i2c, 0); case RECEIVING_BIT7: i2c->buffer = i2c_recv(i2c->bus); DPRINTF(""RX byte 0x%02x\n"", i2c->buffer); /* Fall through... */ case RECEIVING_BIT6 ... RECEIVING_BIT0: data = i2c->buffer >> 7; /* will end up in SENDING_ACK */ i2c->state++; i2c->buffer <<= 1; return bitbang_i2c_ret(i2c, data); case SENDING_ACK: i2c->state = RECEIVING_BIT7; if (data != 0) { DPRINTF(""NACKED\n""); i2c->state = SENT_NACK; i2c_nack(i2c->bus); } else { DPRINTF(""ACKED\n""); } return bitbang_i2c_ret(i2c, 1); } abort(); }","No, it is non-vulnerable."802800,"static void peripheral_device_del_completion(ReadLineState *rs, const char *str, size_t len) { Object *peripheral; GSList *list = NULL, *item; peripheral = object_resolve_path(""/machine/peripheral/"", NULL); if (peripheral == NULL) { return; } object_child_foreach(peripheral, qdev_build_hotpluggable_device_list, &list); for (item = list; item; item = g_slist_next(item)) { DeviceState *dev = item->data; if (dev->id && !strncmp(str, dev->id, len)) { readline_add_completion(rs, dev->id); } } g_slist_free(list); }","Yes, it is vulnerable."803801,av_cold void ff_synth_filter_init(SynthFilterContext *c) { c->synth_filter_float = synth_filter_float; if (ARCH_ARM) ff_synth_filter_init_arm(c); if (ARCH_X86) ff_synth_filter_init_x86(c); },"No, it is non-vulnerable."804802,"static void tcp_accept_incoming_migration(void *opaque) { struct sockaddr_in addr; socklen_t addrlen = sizeof(addr); int s = (unsigned long)opaque; QEMUFile *f; int c, ret; do { c = qemu_accept(s, (struct sockaddr *)&addr, &addrlen); } while (c == -1 && socket_error() == EINTR); DPRINTF(""accepted migration\n""); if (c == -1) { fprintf(stderr, ""could not accept migration connection\n""); return; } f = qemu_fopen_socket(c); if (f == NULL) { fprintf(stderr, ""could not qemu_fopen socket\n""); goto out; } ret = qemu_loadvm_state(f); if (ret < 0) { fprintf(stderr, ""load of migration failed\n""); goto out_fopen; } qemu_announce_self(); DPRINTF(""successfully loaded vm state\n""); /* we've successfully migrated, close the server socket */ qemu_set_fd_handler2(s, NULL, NULL, NULL, NULL); close(s); if (autostart) vm_start(); out_fopen: qemu_fclose(f); out: close(c); }","No, it is non-vulnerable."805803,"int main(int argc, char** argv) { FILE *f= fopen(argv[1], ""rb+""); int count= atoi(argv[2]); int maxburst= atoi(argv[3]); int length; srand (time (0)); fseek(f, 0, SEEK_END); length= ftell(f); fseek(f, 0, SEEK_SET); while(count--){ int burst= 1 + random() * (uint64_t) (abs(maxburst)-1) / RAND_MAX; int pos= random() * (uint64_t) length / RAND_MAX; fseek(f, pos, SEEK_SET); if(maxburst<0) burst= -maxburst; if(pos + burst > length) continue; while(burst--){ int val= random() * 256ULL / RAND_MAX; if(maxburst<0) val=0; fwrite(&val, 1, 1, f); } } return 0; }","No, it is non-vulnerable."806804,"static void do_info_network(int argc, const char **argv) { int i, j; NetDriverState *nd; for(i = 0; i < nb_nics; i++) { nd = &nd_table[i]; term_printf(""%d: ifname=%s macaddr="", i, nd->ifname); for(j = 0; j < 6; j++) { if (j > 0) term_printf("":""); term_printf(""%02x"", nd->macaddr[j]); } term_printf(""\n""); } }","No, it is non-vulnerable."807805,"static int qemu_rdma_registration_handle(QEMUFile *f, void *opaque) { RDMAControlHeader reg_resp = { .len = sizeof(RDMARegisterResult), .type = RDMA_CONTROL_REGISTER_RESULT, .repeat = 0, }; RDMAControlHeader unreg_resp = { .len = 0, .type = RDMA_CONTROL_UNREGISTER_FINISHED, .repeat = 0, }; RDMAControlHeader blocks = { .type = RDMA_CONTROL_RAM_BLOCKS_RESULT, .repeat = 1 }; QIOChannelRDMA *rioc = QIO_CHANNEL_RDMA(opaque); RDMAContext *rdma = rioc->rdma; RDMALocalBlocks *local = &rdma->local_ram_blocks; RDMAControlHeader head; RDMARegister *reg, *registers; RDMACompress *comp; RDMARegisterResult *reg_result; static RDMARegisterResult results[RDMA_CONTROL_MAX_COMMANDS_PER_MESSAGE]; RDMALocalBlock *block; void *host_addr; int ret = 0; int idx = 0; int count = 0; int i = 0; CHECK_ERROR_STATE(); do { trace_qemu_rdma_registration_handle_wait(); ret = qemu_rdma_exchange_recv(rdma, &head, RDMA_CONTROL_NONE); if (ret < 0) { break; } if (head.repeat > RDMA_CONTROL_MAX_COMMANDS_PER_MESSAGE) { error_report(""rdma: Too many requests in this message (%d)."" ""Bailing."", head.repeat); ret = -EIO; break; } switch (head.type) { case RDMA_CONTROL_COMPRESS: comp = (RDMACompress *) rdma->wr_data[idx].control_curr; network_to_compress(comp); trace_qemu_rdma_registration_handle_compress(comp->length, comp->block_idx, comp->offset); if (comp->block_idx >= rdma->local_ram_blocks.nb_blocks) { error_report(""rdma: 'compress' bad block index %u (vs %d)"", (unsigned int)comp->block_idx, rdma->local_ram_blocks.nb_blocks); ret = -EIO; goto out; } block = &(rdma->local_ram_blocks.block[comp->block_idx]); host_addr = block->local_host_addr + (comp->offset - block->offset); ram_handle_compressed(host_addr, comp->value, comp->length); break; case RDMA_CONTROL_REGISTER_FINISHED: trace_qemu_rdma_registration_handle_finished(); goto out; case RDMA_CONTROL_RAM_BLOCKS_REQUEST: trace_qemu_rdma_registration_handle_ram_blocks(); /* Sort our local RAM Block list so it's the same as the source, * we can do this since we've filled in a src_index in the list * as we received the RAMBlock list earlier. */ qsort(rdma->local_ram_blocks.block, rdma->local_ram_blocks.nb_blocks, sizeof(RDMALocalBlock), dest_ram_sort_func); if (rdma->pin_all) { ret = qemu_rdma_reg_whole_ram_blocks(rdma); if (ret) { error_report(""rdma migration: error dest "" ""registering ram blocks""); goto out; } } /* * Dest uses this to prepare to transmit the RAMBlock descriptions * to the source VM after connection setup. * Both sides use the ""remote"" structure to communicate and update * their ""local"" descriptions with what was sent. */ for (i = 0; i < local->nb_blocks; i++) { rdma->dest_blocks[i].remote_host_addr = (uintptr_t)(local->block[i].local_host_addr); if (rdma->pin_all) { rdma->dest_blocks[i].remote_rkey = local->block[i].mr->rkey; } rdma->dest_blocks[i].offset = local->block[i].offset; rdma->dest_blocks[i].length = local->block[i].length; dest_block_to_network(&rdma->dest_blocks[i]); trace_qemu_rdma_registration_handle_ram_blocks_loop( local->block[i].block_name, local->block[i].offset, local->block[i].length, local->block[i].local_host_addr, local->block[i].src_index); } blocks.len = rdma->local_ram_blocks.nb_blocks * sizeof(RDMADestBlock); ret = qemu_rdma_post_send_control(rdma, (uint8_t *) rdma->dest_blocks, &blocks); if (ret < 0) { error_report(""rdma migration: error sending remote info""); goto out; } break; case RDMA_CONTROL_REGISTER_REQUEST: trace_qemu_rdma_registration_handle_register(head.repeat); reg_resp.repeat = head.repeat; registers = (RDMARegister *) rdma->wr_data[idx].control_curr; for (count = 0; count < head.repeat; count++) { uint64_t chunk; uint8_t *chunk_start, *chunk_end; reg = &registers[count]; network_to_register(reg); reg_result = &results[count]; trace_qemu_rdma_registration_handle_register_loop(count, reg->current_index, reg->key.current_addr, reg->chunks); if (reg->current_index >= rdma->local_ram_blocks.nb_blocks) { error_report(""rdma: 'register' bad block index %u (vs %d)"", (unsigned int)reg->current_index, rdma->local_ram_blocks.nb_blocks); ret = -ENOENT; goto out; } block = &(rdma->local_ram_blocks.block[reg->current_index]); if (block->is_ram_block) { if (block->offset > reg->key.current_addr) { error_report(""rdma: bad register address for block %s"" "" offset: %"" PRIx64 "" current_addr: %"" PRIx64, block->block_name, block->offset, reg->key.current_addr); ret = -ERANGE; goto out; } host_addr = (block->local_host_addr + (reg->key.current_addr - block->offset)); chunk = ram_chunk_index(block->local_host_addr, (uint8_t *) host_addr); } else { chunk = reg->key.chunk; host_addr = block->local_host_addr + (reg->key.chunk * (1UL << RDMA_REG_CHUNK_SHIFT)); /* Check for particularly bad chunk value */ if (host_addr < (void *)block->local_host_addr) { error_report(""rdma: bad chunk for block %s"" "" chunk: %"" PRIx64, block->block_name, reg->key.chunk); ret = -ERANGE; goto out; } } chunk_start = ram_chunk_start(block, chunk); chunk_end = ram_chunk_end(block, chunk + reg->chunks); if (qemu_rdma_register_and_get_keys(rdma, block, (uintptr_t)host_addr, NULL, &reg_result->rkey, chunk, chunk_start, chunk_end)) { error_report(""cannot get rkey""); ret = -EINVAL; goto out; } reg_result->host_addr = (uintptr_t)block->local_host_addr; trace_qemu_rdma_registration_handle_register_rkey( reg_result->rkey); result_to_network(reg_result); } ret = qemu_rdma_post_send_control(rdma, (uint8_t *) results, &reg_resp); if (ret < 0) { error_report(""Failed to send control buffer""); goto out; } break; case RDMA_CONTROL_UNREGISTER_REQUEST: trace_qemu_rdma_registration_handle_unregister(head.repeat); unreg_resp.repeat = head.repeat; registers = (RDMARegister *) rdma->wr_data[idx].control_curr; for (count = 0; count < head.repeat; count++) { reg = &registers[count]; network_to_register(reg); trace_qemu_rdma_registration_handle_unregister_loop(count, reg->current_index, reg->key.chunk); block = &(rdma->local_ram_blocks.block[reg->current_index]); ret = ibv_dereg_mr(block->pmr[reg->key.chunk]); block->pmr[reg->key.chunk] = NULL; if (ret != 0) { perror(""rdma unregistration chunk failed""); ret = -ret; goto out; } rdma->total_registrations--; trace_qemu_rdma_registration_handle_unregister_success( reg->key.chunk); } ret = qemu_rdma_post_send_control(rdma, NULL, &unreg_resp); if (ret < 0) { error_report(""Failed to send control buffer""); goto out; } break; case RDMA_CONTROL_REGISTER_RESULT: error_report(""Invalid RESULT message at dest.""); ret = -EIO; goto out; default: error_report(""Unknown control message %s"", control_desc[head.type]); ret = -EIO; goto out; } } while (1); out: if (ret < 0) { rdma->error_state = ret; } return ret; }","No, it is non-vulnerable."808806,"void xen_invalidate_map_cache(void) { unsigned long i; MapCacheRev *reventry; /* Flush pending AIO before destroying the mapcache */ bdrv_drain_all(); QTAILQ_FOREACH(reventry, &mapcache->locked_entries, next) { DPRINTF(""There should be no locked mappings at this time, "" ""but ""TARGET_FMT_plx"" -> %p is present\n"", reventry->paddr_index, reventry->vaddr_req); } mapcache_lock(); for (i = 0; i < mapcache->nr_buckets; i++) { MapCacheEntry *entry = &mapcache->entry[i]; if (entry->vaddr_base == NULL) { continue; } if (entry->lock > 0) { continue; } if (munmap(entry->vaddr_base, entry->size) != 0) { perror(""unmap fails""); exit(-1); } entry->paddr_index = 0; entry->vaddr_base = NULL; entry->size = 0; g_free(entry->valid_mapping); entry->valid_mapping = NULL; } mapcache->last_entry = NULL; mapcache_unlock(); }","No, it is non-vulnerable."809807,"static uint64_t omap_clkdsp_read(void *opaque, target_phys_addr_t addr, unsigned size) { struct omap_mpu_state_s *s = (struct omap_mpu_state_s *) opaque; if (size != 2) { return omap_badwidth_read16(opaque, addr); } switch (addr) { case 0x04: /* DSP_IDLECT1 */ return s->clkm.dsp_idlect1; case 0x08: /* DSP_IDLECT2 */ return s->clkm.dsp_idlect2; case 0x14: /* DSP_RSTCT2 */ return s->clkm.dsp_rstct2; case 0x18: /* DSP_SYSST */ return (s->clkm.clocking_scheme << 11) | s->clkm.cold_start | (s->cpu->env.halted << 6); /* Quite useless... */ } OMAP_BAD_REG(addr); return 0; }","No, it is non-vulnerable."810808,"static int fd_close(MigrationState *s) { DPRINTF(""fd_close\n""); if (s->fd != -1) { close(s->fd); s->fd = -1; } return 0; }","Yes, it is vulnerable."811809,"static av_cold int oggvorbis_encode_init(AVCodecContext *avccontext) { OggVorbisContext *context = avccontext->priv_data; ogg_packet header, header_comm, header_code; uint8_t *p; unsigned int offset; vorbis_info_init(&context->vi); if (oggvorbis_init_encoder(&context->vi, avccontext) < 0) { av_log(avccontext, AV_LOG_ERROR, ""oggvorbis_encode_init: init_encoder failed\n""); return -1; } vorbis_analysis_init(&context->vd, &context->vi); vorbis_block_init(&context->vd, &context->vb); vorbis_comment_init(&context->vc); vorbis_comment_add_tag(&context->vc, ""encoder"", LIBAVCODEC_IDENT); vorbis_analysis_headerout(&context->vd, &context->vc, &header, &header_comm, &header_code); avccontext->extradata_size = 1 + xiph_len(header.bytes) + xiph_len(header_comm.bytes) + header_code.bytes; p = avccontext->extradata = av_malloc(avccontext->extradata_size + FF_INPUT_BUFFER_PADDING_SIZE); p[0] = 2; offset = 1; offset += av_xiphlacing(&p[offset], header.bytes); offset += av_xiphlacing(&p[offset], header_comm.bytes); memcpy(&p[offset], header.packet, header.bytes); offset += header.bytes; memcpy(&p[offset], header_comm.packet, header_comm.bytes); offset += header_comm.bytes; memcpy(&p[offset], header_code.packet, header_code.bytes); offset += header_code.bytes; assert(offset == avccontext->extradata_size); #if 0 vorbis_block_clear(&context->vb); vorbis_dsp_clear(&context->vd); vorbis_info_clear(&context->vi); #endif vorbis_comment_clear(&context->vc); avccontext->frame_size = OGGVORBIS_FRAME_SIZE; avccontext->coded_frame = avcodec_alloc_frame(); return 0; }","No, it is non-vulnerable."812810,"static int iff_read_header(AVFormatContext *s) { IffDemuxContext *iff = s->priv_data; AVIOContext *pb = s->pb; AVStream *st; uint8_t *buf; uint32_t chunk_id, data_size; uint32_t screenmode = 0, num, den; unsigned transparency = 0; unsigned masking = 0; // no mask uint8_t fmt[16]; int fmt_size; st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); st->codec->channels = 1; st->codec->channel_layout = AV_CH_LAYOUT_MONO; avio_skip(pb, 8); // codec_tag used by ByteRun1 decoder to distinguish progressive (PBM) and interlaced (ILBM) content st->codec->codec_tag = avio_rl32(pb); while(!url_feof(pb)) { uint64_t orig_pos; int res; const char *metadata_tag = NULL; chunk_id = avio_rl32(pb); data_size = avio_rb32(pb); orig_pos = avio_tell(pb); switch(chunk_id) { case ID_VHDR: st->codec->codec_type = AVMEDIA_TYPE_AUDIO; if (data_size < 14) return AVERROR_INVALIDDATA; avio_skip(pb, 12); st->codec->sample_rate = avio_rb16(pb); if (data_size >= 16) { avio_skip(pb, 1); iff->svx8_compression = avio_r8(pb); } break; case ID_MHDR: st->codec->codec_type = AVMEDIA_TYPE_AUDIO; iff->maud_bits = -1; iff->maud_compression = -1; if (data_size < 32) return AVERROR_INVALIDDATA; avio_skip(pb, 4); iff->maud_bits = avio_rb16(pb); avio_skip(pb, 2); num = avio_rb32(pb); den = avio_rb16(pb); if (!den) return AVERROR_INVALIDDATA; avio_skip(pb, 2); st->codec->sample_rate = num / den; st->codec->channels = avio_rb16(pb); iff->maud_compression = avio_rb16(pb); if (st->codec->channels == 1) st->codec->channel_layout = AV_CH_LAYOUT_MONO; else if (st->codec->channels == 2) st->codec->channel_layout = AV_CH_LAYOUT_STEREO; break; case ID_ABIT: case ID_BODY: case ID_DBOD: case ID_MDAT: iff->body_pos = avio_tell(pb); iff->body_size = data_size; break; case ID_CHAN: if (data_size < 4) return AVERROR_INVALIDDATA; if (avio_rb32(pb) < 6) { st->codec->channels = 1; st->codec->channel_layout = AV_CH_LAYOUT_MONO; } else { st->codec->channels = 2; st->codec->channel_layout = AV_CH_LAYOUT_STEREO; } break; case ID_CAMG: if (data_size < 4) return AVERROR_INVALIDDATA; screenmode = avio_rb32(pb); break; case ID_CMAP: st->codec->extradata_size = data_size + IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(data_size + IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); if (avio_read(pb, st->codec->extradata + IFF_EXTRA_VIDEO_SIZE, data_size) < 0) return AVERROR(EIO); break; case ID_BMHD: iff->bitmap_compression = -1; st->codec->codec_type = AVMEDIA_TYPE_VIDEO; if (data_size <= 8) return AVERROR_INVALIDDATA; st->codec->width = avio_rb16(pb); st->codec->height = avio_rb16(pb); avio_skip(pb, 4); // x, y offset st->codec->bits_per_coded_sample = avio_r8(pb); if (data_size >= 10) masking = avio_r8(pb); if (data_size >= 11) iff->bitmap_compression = avio_r8(pb); if (data_size >= 14) { avio_skip(pb, 1); // padding transparency = avio_rb16(pb); } if (data_size >= 16) { st->sample_aspect_ratio.num = avio_r8(pb); st->sample_aspect_ratio.den = avio_r8(pb); } break; case ID_DPEL: if (data_size < 4 || (data_size & 3)) return AVERROR_INVALIDDATA; if ((fmt_size = avio_read(pb, fmt, sizeof(fmt))) < 0) return fmt_size; if (fmt_size == sizeof(deep_rgb24) && !memcmp(fmt, deep_rgb24, sizeof(deep_rgb24))) st->codec->pix_fmt = AV_PIX_FMT_RGB24; else if (fmt_size == sizeof(deep_rgba) && !memcmp(fmt, deep_rgba, sizeof(deep_rgba))) st->codec->pix_fmt = AV_PIX_FMT_RGBA; else if (fmt_size == sizeof(deep_bgra) && !memcmp(fmt, deep_bgra, sizeof(deep_bgra))) st->codec->pix_fmt = AV_PIX_FMT_BGRA; else if (fmt_size == sizeof(deep_argb) && !memcmp(fmt, deep_argb, sizeof(deep_argb))) st->codec->pix_fmt = AV_PIX_FMT_ARGB; else if (fmt_size == sizeof(deep_abgr) && !memcmp(fmt, deep_abgr, sizeof(deep_abgr))) st->codec->pix_fmt = AV_PIX_FMT_ABGR; else { av_log_ask_for_sample(s, ""unsupported color format\n""); return AVERROR_PATCHWELCOME; } break; case ID_DGBL: st->codec->codec_type = AVMEDIA_TYPE_VIDEO; if (data_size < 8) return AVERROR_INVALIDDATA; st->codec->width = avio_rb16(pb); st->codec->height = avio_rb16(pb); iff->bitmap_compression = avio_rb16(pb); st->sample_aspect_ratio.num = avio_r8(pb); st->sample_aspect_ratio.den = avio_r8(pb); st->codec->bits_per_coded_sample = 24; break; case ID_DLOC: if (data_size < 4) return AVERROR_INVALIDDATA; st->codec->width = avio_rb16(pb); st->codec->height = avio_rb16(pb); break; case ID_ANNO: case ID_TEXT: metadata_tag = ""comment""; break; case ID_AUTH: metadata_tag = ""artist""; break; case ID_COPYRIGHT: metadata_tag = ""copyright""; break; case ID_NAME: metadata_tag = ""title""; break; } if (metadata_tag) { if ((res = get_metadata(s, metadata_tag, data_size)) < 0) { av_log(s, AV_LOG_ERROR, ""cannot allocate metadata tag %s!\n"", metadata_tag); return res; } } avio_skip(pb, data_size - (avio_tell(pb) - orig_pos) + (data_size & 1)); } avio_seek(pb, iff->body_pos, SEEK_SET); switch(st->codec->codec_type) { case AVMEDIA_TYPE_AUDIO: avpriv_set_pts_info(st, 32, 1, st->codec->sample_rate); if (st->codec->codec_tag == ID_16SV) st->codec->codec_id = AV_CODEC_ID_PCM_S16BE_PLANAR; else if (st->codec->codec_tag == ID_MAUD) { if (iff->maud_bits == 8 && !iff->maud_compression) { st->codec->codec_id = AV_CODEC_ID_PCM_U8; } else if (iff->maud_bits == 16 && !iff->maud_compression) { st->codec->codec_id = AV_CODEC_ID_PCM_S16BE; } else if (iff->maud_bits == 8 && iff->maud_compression == 2) { st->codec->codec_id = AV_CODEC_ID_PCM_ALAW; } else if (iff->maud_bits == 8 && iff->maud_compression == 3) { st->codec->codec_id = AV_CODEC_ID_PCM_MULAW; } else { av_log_ask_for_sample(s, ""unsupported compression %d and bit depth %d\n"", iff->maud_compression, iff->maud_bits); return AVERROR_PATCHWELCOME; } st->codec->bits_per_coded_sample = av_get_bits_per_sample(st->codec->codec_id); st->codec->block_align = st->codec->bits_per_coded_sample * st->codec->channels / 8; } else { switch (iff->svx8_compression) { case COMP_NONE: st->codec->codec_id = AV_CODEC_ID_PCM_S8_PLANAR; break; case COMP_FIB: st->codec->codec_id = AV_CODEC_ID_8SVX_FIB; break; case COMP_EXP: st->codec->codec_id = AV_CODEC_ID_8SVX_EXP; break; default: av_log(s, AV_LOG_ERROR, ""Unknown SVX8 compression method '%d'\n"", iff->svx8_compression); return -1; } } st->codec->bits_per_coded_sample = av_get_bits_per_sample(st->codec->codec_id); st->codec->bit_rate = st->codec->channels * st->codec->sample_rate * st->codec->bits_per_coded_sample; st->codec->block_align = st->codec->channels * st->codec->bits_per_coded_sample; break; case AVMEDIA_TYPE_VIDEO: iff->bpp = st->codec->bits_per_coded_sample; if ((screenmode & 0x800 /* Hold And Modify */) && iff->bpp <= 8) { iff->ham = iff->bpp > 6 ? 6 : 4; st->codec->bits_per_coded_sample = 24; } iff->flags = (screenmode & 0x80 /* Extra HalfBrite */) && iff->bpp <= 8; iff->masking = masking; iff->transparency = transparency; if (!st->codec->extradata) { st->codec->extradata_size = IFF_EXTRA_VIDEO_SIZE; st->codec->extradata = av_malloc(IFF_EXTRA_VIDEO_SIZE + FF_INPUT_BUFFER_PADDING_SIZE); if (!st->codec->extradata) return AVERROR(ENOMEM); } buf = st->codec->extradata; bytestream_put_be16(&buf, IFF_EXTRA_VIDEO_SIZE); bytestream_put_byte(&buf, iff->bitmap_compression); bytestream_put_byte(&buf, iff->bpp); bytestream_put_byte(&buf, iff->ham); bytestream_put_byte(&buf, iff->flags); bytestream_put_be16(&buf, iff->transparency); bytestream_put_byte(&buf, iff->masking); st->codec->codec_id = AV_CODEC_ID_IFF_ILBM; break; default: return -1; } return 0; }","No, it is non-vulnerable."813811,"static int unpack_modes(Vp3DecodeContext *s, GetBitContext *gb) { int i, j, k; int scheme; int current_macroblock; int current_fragment; int coding_mode; int custom_mode_alphabet[CODING_MODE_COUNT]; if (s->keyframe) { for (i = 0; i < s->fragment_count; i++) s->all_fragments[i].coding_method = MODE_INTRA; } else { /* fetch the mode coding scheme for this frame */ scheme = get_bits(gb, 3); /* is it a custom coding scheme? */ if (scheme == 0) { custom_mode_alphabet[get_bits(gb, 3)] = i; } /* iterate through all of the macroblocks that contain 1 or more * coded fragments */ for (i = 0; i < s->u_superblock_start; i++) { for (j = 0; j < 4; j++) { current_macroblock = s->superblock_macroblocks[i * 4 + j]; if ((current_macroblock == -1) || (s->macroblock_coding[current_macroblock] == MODE_COPY)) continue; if (current_macroblock >= s->macroblock_count) { av_log(s->avctx, AV_LOG_ERROR, "" vp3:unpack_modes(): bad macroblock number (%d >= %d)\n"", current_macroblock, s->macroblock_count); return 1; } /* mode 7 means get 3 bits for each coding mode */ if (scheme == 7) coding_mode = get_bits(gb, 3); else if(scheme == 0) coding_mode = custom_mode_alphabet [get_vlc2(gb, s->mode_code_vlc.table, 3, 3)]; else coding_mode = ModeAlphabet[scheme-1] [get_vlc2(gb, s->mode_code_vlc.table, 3, 3)]; s->macroblock_coding[current_macroblock] = coding_mode; for (k = 0; k < 6; k++) { current_fragment = s->macroblock_fragments[current_macroblock * 6 + k]; if (current_fragment == -1) continue; if (current_fragment >= s->fragment_count) { av_log(s->avctx, AV_LOG_ERROR, "" vp3:unpack_modes(): bad fragment number (%d >= %d)\n"", current_fragment, s->fragment_count); return 1; } if (s->all_fragments[current_fragment].coding_method != MODE_COPY) s->all_fragments[current_fragment].coding_method = coding_mode; } } } } return 0; }","Yes, it is vulnerable."814812,"struct USBEndpoint *usb_ep_get(USBDevice *dev, int pid, int ep) { struct USBEndpoint *eps = pid == USB_TOKEN_IN ? dev->ep_in : dev->ep_out; if (ep == 0) { return &dev->ep_ctl; } assert(pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT); assert(ep > 0 && ep <= USB_MAX_ENDPOINTS); return eps + ep - 1; }","No, it is non-vulnerable."815813,"static int vpx_decode(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt) { VPxContext *ctx = avctx->priv_data; AVFrame *picture = data; const void *iter = NULL; const void *iter_alpha = NULL; struct vpx_image *img, *img_alpha; int ret; uint8_t *side_data = NULL; int side_data_size = 0; ret = decode_frame(avctx, &ctx->decoder, avpkt->data, avpkt->size); if (ret) return ret; side_data = av_packet_get_side_data(avpkt, AV_PKT_DATA_MATROSKA_BLOCKADDITIONAL, &side_data_size); if (side_data_size > 1) { const uint64_t additional_id = AV_RB64(side_data); side_data += 8; side_data_size -= 8; if (additional_id == 1) { // 1 stands for alpha channel data. if (!ctx->has_alpha_channel) { ctx->has_alpha_channel = 1; ret = vpx_init(avctx, #if CONFIG_LIBVPX_VP8_DECODER && CONFIG_LIBVPX_VP9_DECODER (avctx->codec_id == AV_CODEC_ID_VP8) ? &vpx_codec_vp8_dx_algo : &vpx_codec_vp9_dx_algo, #elif CONFIG_LIBVPX_VP8_DECODER &vpx_codec_vp8_dx_algo, #else &vpx_codec_vp9_dx_algo, #endif 1); if (ret) return ret; } ret = decode_frame(avctx, &ctx->decoder_alpha, side_data, side_data_size); if (ret) return ret; } } if ((img = vpx_codec_get_frame(&ctx->decoder, &iter)) && (!ctx->has_alpha_channel || (img_alpha = vpx_codec_get_frame(&ctx->decoder_alpha, &iter_alpha)))) { uint8_t *planes[4]; int linesizes[4]; if (img->d_w > img->w || img->d_h > img->h) { av_log(avctx, AV_LOG_ERROR, ""Display dimensions %dx%d exceed storage %dx%d\n"", img->d_w, img->d_h, img->w, img->h); return AVERROR_EXTERNAL; } if ((ret = set_pix_fmt(avctx, img, ctx->has_alpha_channel)) < 0) { #ifdef VPX_IMG_FMT_HIGHBITDEPTH av_log(avctx, AV_LOG_ERROR, ""Unsupported output colorspace (%d) / bit_depth (%d)\n"", img->fmt, img->bit_depth); #else av_log(avctx, AV_LOG_ERROR, ""Unsupported output colorspace (%d) / bit_depth (%d)\n"", img->fmt, 8); #endif return ret; } if ((int) img->d_w != avctx->width || (int) img->d_h != avctx->height) { av_log(avctx, AV_LOG_INFO, ""dimension change! %dx%d -> %dx%d\n"", avctx->width, avctx->height, img->d_w, img->d_h); ret = ff_set_dimensions(avctx, img->d_w, img->d_h); if (ret < 0) return ret; } if ((ret = ff_get_buffer(avctx, picture, 0)) < 0) return ret; planes[0] = img->planes[VPX_PLANE_Y]; planes[1] = img->planes[VPX_PLANE_U]; planes[2] = img->planes[VPX_PLANE_V]; planes[3] = ctx->has_alpha_channel ? img_alpha->planes[VPX_PLANE_Y] : NULL; linesizes[0] = img->stride[VPX_PLANE_Y]; linesizes[1] = img->stride[VPX_PLANE_U]; linesizes[2] = img->stride[VPX_PLANE_V]; linesizes[3] = ctx->has_alpha_channel ? img_alpha->stride[VPX_PLANE_Y] : 0; av_image_copy(picture->data, picture->linesize, (const uint8_t**)planes, linesizes, avctx->pix_fmt, img->d_w, img->d_h); *got_frame = 1; } return avpkt->size; }","No, it is non-vulnerable."816814,"static int ipvideo_decode_block_opcode_0xB(IpvideoContext *s) { int y; /* 64-color encoding (each pixel in block is a different color) */ CHECK_STREAM_PTR(64); for (y = 0; y < 8; y++) { memcpy(s->pixel_ptr, s->stream_ptr, 8); s->stream_ptr += 8; s->pixel_ptr += s->stride; } /* report success */ return 0; }","No, it is non-vulnerable."817815,"static int mov_read_tkhd(MOVContext *c, AVIOContext *pb, MOVAtom atom) { int i; int width; int height; int64_t disp_transform[2]; int display_matrix[3][3]; AVStream *st; MOVStreamContext *sc; int version; int flags; if (c->fc->nb_streams < 1) return 0; st = c->fc->streams[c->fc->nb_streams-1]; sc = st->priv_data; version = avio_r8(pb); flags = avio_rb24(pb); st->disposition |= (flags & MOV_TKHD_FLAG_ENABLED) ? AV_DISPOSITION_DEFAULT : 0; if (version == 1) { avio_rb64(pb); avio_rb64(pb); } else { avio_rb32(pb); /* creation time */ avio_rb32(pb); /* modification time */ } st->id = (int)avio_rb32(pb); /* track id (NOT 0 !)*/ avio_rb32(pb); /* reserved */ /* highlevel (considering edits) duration in movie timebase */ (version == 1) ? avio_rb64(pb) : avio_rb32(pb); avio_rb32(pb); /* reserved */ avio_rb32(pb); /* reserved */ avio_rb16(pb); /* layer */ avio_rb16(pb); /* alternate group */ avio_rb16(pb); /* volume */ avio_rb16(pb); /* reserved */ //read in the display matrix (outlined in ISO 14496-12, Section 6.2.2) // they're kept in fixed point format through all calculations // save u,v,z to store the whole matrix in the AV_PKT_DATA_DISPLAYMATRIX // side data, but the scale factor is not needed to calculate aspect ratio for (i = 0; i < 3; i++) { display_matrix[i][0] = avio_rb32(pb); // 16.16 fixed point display_matrix[i][1] = avio_rb32(pb); // 16.16 fixed point display_matrix[i][2] = avio_rb32(pb); // 2.30 fixed point } width = avio_rb32(pb); // 16.16 fixed point track width height = avio_rb32(pb); // 16.16 fixed point track height sc->width = width >> 16; sc->height = height >> 16; // save the matrix when it is not the default identity if (display_matrix[0][0] != (1 << 16) || display_matrix[1][1] != (1 << 16) || display_matrix[2][2] != (1 << 30) || display_matrix[0][1] || display_matrix[0][2] || display_matrix[1][0] || display_matrix[1][2] || display_matrix[2][0] || display_matrix[2][1]) { int i, j; av_freep(&sc->display_matrix); sc->display_matrix = av_malloc(sizeof(int32_t) * 9); if (!sc->display_matrix) return AVERROR(ENOMEM); for (i = 0; i < 3; i++) for (j = 0; j < 3; j++) sc->display_matrix[i * 3 + j] = display_matrix[j][i]; } // transform the display width/height according to the matrix // skip this if the rotation angle is 0 degrees // to keep the same scale, use [width height 1<<16] if (width && height && sc->display_matrix && av_display_rotation_get(sc->display_matrix) != 0.0f) { for (i = 0; i < 2; i++) disp_transform[i] = (int64_t) width * display_matrix[0][i] + (int64_t) height * display_matrix[1][i] + ((int64_t) display_matrix[2][i] << 16); //sample aspect ratio is new width/height divided by old width/height st->sample_aspect_ratio = av_d2q( ((double) disp_transform[0] * height) / ((double) disp_transform[1] * width), INT_MAX); } return 0; }","No, it is non-vulnerable."818816,"uint8_t *av_packet_new_side_data(AVPacket *pkt, enum AVPacketSideDataType type, int size) { int elems = pkt->side_data_elems; if ((unsigned)elems + 1 > INT_MAX / sizeof(*pkt->side_data)) return NULL; if ((unsigned)size > INT_MAX - FF_INPUT_BUFFER_PADDING_SIZE) return NULL; pkt->side_data = av_realloc(pkt->side_data, (elems + 1) * sizeof(*pkt->side_data)); if (!pkt->side_data) return NULL; pkt->side_data[elems].data = av_malloc(size + FF_INPUT_BUFFER_PADDING_SIZE); if (!pkt->side_data[elems].data) return NULL; pkt->side_data[elems].size = size; pkt->side_data[elems].type = type; pkt->side_data_elems++; return pkt->side_data[elems].data; }","Yes, it is vulnerable."819817,"static void pointer_event(VncState *vs, int button_mask, int x, int y) { static uint32_t bmap[INPUT_BUTTON_MAX] = { [INPUT_BUTTON_LEFT] = 0x01, [INPUT_BUTTON_MIDDLE] = 0x02, [INPUT_BUTTON_RIGHT] = 0x04, [INPUT_BUTTON_WHEEL_UP] = 0x08, [INPUT_BUTTON_WHEEL_DOWN] = 0x10, }; QemuConsole *con = vs->vd->dcl.con; int width = surface_width(vs->vd->ds); int height = surface_height(vs->vd->ds); if (vs->last_bmask != button_mask) { qemu_input_update_buttons(con, bmap, vs->last_bmask, button_mask); vs->last_bmask = button_mask; } if (vs->absolute) { qemu_input_queue_abs(con, INPUT_AXIS_X, x, width); qemu_input_queue_abs(con, INPUT_AXIS_Y, y, height); } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) { qemu_input_queue_rel(con, INPUT_AXIS_X, x - 0x7FFF); qemu_input_queue_rel(con, INPUT_AXIS_Y, y - 0x7FFF); } else { if (vs->last_x != -1) { qemu_input_queue_rel(con, INPUT_AXIS_X, x - vs->last_x); qemu_input_queue_rel(con, INPUT_AXIS_Y, y - vs->last_y); } vs->last_x = x; vs->last_y = y; } qemu_input_event_sync(); }","Yes, it is vulnerable."820818,"void visit_type_uint16(Visitor *v, uint16_t *obj, const char *name, Error **errp) { int64_t value; if (!error_is_set(errp)) { if (v->type_uint16) { v->type_uint16(v, obj, name, errp); } else { value = *obj; v->type_int(v, &value, name, errp); if (value < 0 || value > UINT16_MAX) { error_set(errp, QERR_INVALID_PARAMETER_VALUE, name ? name : ""null"", ""uint16_t""); return; } *obj = value; } } }","Yes, it is vulnerable."821819,"static void rtsp_parse_transport(RTSPMessageHeader *reply, const char *p) { char transport_protocol[16]; char profile[16]; char lower_transport[16]; char parameter[16]; RTSPTransportField *th; char buf[256]; reply->nb_transports = 0; for(;;) { skip_spaces(&p); if (*p == '\0') break; th = &reply->transports[reply->nb_transports]; get_word_sep(transport_protocol, sizeof(transport_protocol), ""/"", &p); if (!strcasecmp (transport_protocol, ""rtp"")) { get_word_sep(profile, sizeof(profile), ""/;,"", &p); lower_transport[0] = '\0'; /* rtp/avp/<protocol> */ if (*p == '/') { get_word_sep(lower_transport, sizeof(lower_transport), "";,"", &p); } th->transport = RTSP_TRANSPORT_RTP; } else if (!strcasecmp (transport_protocol, ""x-pn-tng"") || !strcasecmp (transport_protocol, ""x-real-rdt"")) { /* x-pn-tng/<protocol> */ get_word_sep(lower_transport, sizeof(lower_transport), ""/;,"", &p); profile[0] = '\0'; th->transport = RTSP_TRANSPORT_RDT; } if (!strcasecmp(lower_transport, ""TCP"")) th->lower_transport = RTSP_LOWER_TRANSPORT_TCP; else th->lower_transport = RTSP_LOWER_TRANSPORT_UDP; if (*p == ';') p++; /* get each parameter */ while (*p != '\0' && *p != ',') { get_word_sep(parameter, sizeof(parameter), ""=;,"", &p); if (!strcmp(parameter, ""port"")) { if (*p == '=') { p++; rtsp_parse_range(&th->port_min, &th->port_max, &p); } } else if (!strcmp(parameter, ""client_port"")) { if (*p == '=') { p++; rtsp_parse_range(&th->client_port_min, &th->client_port_max, &p); } } else if (!strcmp(parameter, ""server_port"")) { if (*p == '=') { p++; rtsp_parse_range(&th->server_port_min, &th->server_port_max, &p); } } else if (!strcmp(parameter, ""interleaved"")) { if (*p == '=') { p++; rtsp_parse_range(&th->interleaved_min, &th->interleaved_max, &p); } } else if (!strcmp(parameter, ""multicast"")) { if (th->lower_transport == RTSP_LOWER_TRANSPORT_UDP) th->lower_transport = RTSP_LOWER_TRANSPORT_UDP_MULTICAST; } else if (!strcmp(parameter, ""ttl"")) { if (*p == '=') { p++; th->ttl = strtol(p, (char **)&p, 10); } } else if (!strcmp(parameter, ""destination"")) { struct in_addr ipaddr; if (*p == '=') { p++; get_word_sep(buf, sizeof(buf), "";,"", &p); if (inet_aton(buf, &ipaddr)) th->destination = ntohl(ipaddr.s_addr); } } while (*p != ';' && *p != '\0' && *p != ',') p++; if (*p == ';') p++; } if (*p == ',') p++; reply->nb_transports++; } }","No, it is non-vulnerable."822820,"static int mov_write_avcc_tag(ByteIOContext *pb, MOVTrack *track) { offset_t pos = url_ftell(pb); put_be32(pb, 0); put_tag(pb, ""avcC""); if (track->vosLen > 6) { /* check for h264 start code */ if (AV_RB32(track->vosData) == 0x00000001) { uint8_t *buf, *end; uint32_t sps_size=0, pps_size=0; uint8_t *sps=0, *pps=0; avc_parse_nal_units(&track->vosData, &track->vosLen); buf = track->vosData; end = track->vosData + track->vosLen; /* look for sps and pps */ while (buf < end) { unsigned int size; uint8_t nal_type; size = AV_RB32(buf); nal_type = buf[4] & 0x1f; if (nal_type == 7) { /* SPS */ sps = buf + 4; sps_size = size; } else if (nal_type == 8) { /* PPS */ pps = buf + 4; pps_size = size; } buf += size + 4; } assert(sps); assert(pps); put_byte(pb, 1); /* version */ put_byte(pb, sps[1]); /* profile */ put_byte(pb, sps[2]); /* profile compat */ put_byte(pb, sps[3]); /* level */ put_byte(pb, 0xff); /* 6 bits reserved (111111) + 2 bits nal size length - 1 (11) */ put_byte(pb, 0xe1); /* 3 bits reserved (111) + 5 bits number of sps (00001) */ put_be16(pb, sps_size); put_buffer(pb, sps, sps_size); put_byte(pb, 1); /* number of pps */ put_be16(pb, pps_size); put_buffer(pb, pps, pps_size); } else { put_buffer(pb, track->vosData, track->vosLen); } } return updateSize(pb, pos); }","No, it is non-vulnerable."823821,"static inline int compress_coeffs(int *coef, int order, int c_bits) { int i, res = 0; const int low_idx = c_bits ? 4 : 2; const int shift_val = c_bits ? 8 : 4; const int high_idx = c_bits ? 11 : 5; for (i = 0; i < order; i++) if (coef[i] < low_idx || coef[i] > high_idx) res++; if (res == order) for (i = 0; i < order; i++) coef[i] -= (coef[i] > high_idx) ? shift_val : 0; return res == order; }","No, it is non-vulnerable."824822,static av_cold int indeo3_decode_end(AVCodecContext *avctx) { Indeo3DecodeContext *s = avctx->priv_data; iv_free_func(s); return 0; },"Yes, it is vulnerable."825823,void qemu_iovec_destroy(QEMUIOVector *qiov) { assert(qiov->nalloc != -1); g_free(qiov->iov); },"Yes, it is vulnerable."826824,"bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *blk, VirtIOBlockDataPlane **dataplane) { VirtIOBlockDataPlane *s; int fd; *dataplane = NULL; if (!blk->data_plane) { return true; if (blk->scsi) { error_report(""device is incompatible with x-data-plane, use scsi=off""); if (blk->config_wce) { error_report(""device is incompatible with x-data-plane, "" ""use config-wce=off""); fd = raw_get_aio_fd(blk->conf.bs); if (fd < 0) { error_report(""drive is incompatible with x-data-plane, "" ""use format=raw,cache=none,aio=native""); s = g_new0(VirtIOBlockDataPlane, 1); s->vdev = vdev; s->fd = fd; s->blk = blk; /* Prevent block operations that conflict with data plane thread */ bdrv_set_in_use(blk->conf.bs, 1); *dataplane = s; return true;","Yes, it is vulnerable."827825,"void helper_sysexit(int dflag) { int cpl; cpl = env->hflags & HF_CPL_MASK; if (env->sysenter_cs == 0 || cpl != 0) { raise_exception_err(EXCP0D_GPF, 0); } cpu_x86_set_cpl(env, 3); #ifdef TARGET_X86_64 if (dflag == 2) { cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 32) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK); cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 40) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_W_MASK | DESC_A_MASK); } else #endif { cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_W_MASK | DESC_A_MASK); } ESP = ECX; EIP = EDX; #ifdef CONFIG_KQEMU if (kqemu_is_ok(env)) { env->exception_index = -1; cpu_loop_exit(); } #endif }","No, it is non-vulnerable."828826,"static void ecc_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val) { printf(""ECC: Unsupported write 0x"" TARGET_FMT_plx "" %02x\n"", addr, val & 0xff); }","No, it is non-vulnerable."829827,"static int bdrv_write_em(BlockDriverState *bs, int64_t sector_num, const uint8_t *buf, int nb_sectors) { int async_ret; BlockDriverAIOCB *acb; struct iovec iov; QEMUIOVector qiov; async_ret = NOT_DONE; iov.iov_base = (void *)buf; iov.iov_len = nb_sectors * BDRV_SECTOR_SIZE; qemu_iovec_init_external(&qiov, &iov, 1); acb = bs->drv->bdrv_aio_writev(bs, sector_num, &qiov, nb_sectors, bdrv_rw_em_cb, &async_ret); if (acb == NULL) { async_ret = -1; goto fail; } while (async_ret == NOT_DONE) { qemu_aio_wait(); } fail: return async_ret; }","No, it is non-vulnerable."830828,"static uint32_t virtio_9p_get_features(VirtIODevice *vdev, uint32_t features) { features |= 1 << VIRTIO_9P_MOUNT_TAG; return features; }","No, it is non-vulnerable."831829,"static void restore_median_il(uint8_t *src, int step, int stride, int width, int height, int slices, int rmode) { int i, j, slice; int A, B, C; uint8_t *bsrc; int slice_start, slice_height; const int cmask = ~(rmode ? 3 : 1); const int stride2 = stride << 1; for (slice = 0; slice < slices; slice++) { slice_start = ((slice * height) / slices) & cmask; slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_start; slice_height >>= 1; bsrc = src + slice_start * stride; // first line - left neighbour prediction bsrc[0] += 0x80; A = bsrc[0]; for (i = step; i < width * step; i += step) { bsrc[i] += A; A = bsrc[i]; } for (i = 0; i < width * step; i += step) { bsrc[stride + i] += A; A = bsrc[stride + i]; } bsrc += stride2; if (slice_height == 1) continue; // second line - first element has top prediction, the rest uses median C = bsrc[-stride2]; bsrc[0] += C; A = bsrc[0]; for (i = step; i < width * step; i += step) { B = bsrc[i - stride2]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[i]; } for (i = 0; i < width * step; i += step) { B = bsrc[i - stride]; bsrc[stride + i] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[stride + i]; } bsrc += stride2; // the rest of lines use continuous median prediction for (j = 2; j < slice_height; j++) { for (i = 0; i < width * step; i += step) { B = bsrc[i - stride2]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[i]; } for (i = 0; i < width * step; i += step) { B = bsrc[i - stride]; bsrc[i + stride] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[i + stride]; } bsrc += stride2; } } }","No, it is non-vulnerable."832830,"AVOpenCLExternalEnv *av_opencl_alloc_external_env(void) { AVOpenCLExternalEnv *ext = av_mallocz(sizeof(AVOpenCLExternalEnv)); if (!ext) { av_log(&openclutils, AV_LOG_ERROR, ""Could not malloc external opencl environment data space\n""); } return ext; }","No, it is non-vulnerable."833831,"static uint64_t error_mem_read(void *opaque, target_phys_addr_t addr, unsigned size) { abort(); }","No, it is non-vulnerable."834832,"static void openpic_set_irq(void *opaque, int n_IRQ, int level) { OpenPICState *opp = opaque; IRQSource *src; if (n_IRQ >= MAX_IRQ) { fprintf(stderr, ""%s: IRQ %d out of range\n"", __func__, n_IRQ); abort(); } src = &opp->src[n_IRQ]; DPRINTF(""openpic: set irq %d = %d ivpr=0x%08x\n"", n_IRQ, level, src->ivpr); if (src->level) { /* level-sensitive irq */ src->pending = level; if (!level) { src->ivpr &= ~IVPR_ACTIVITY_MASK; } } else { /* edge-sensitive irq */ if (level) { src->pending = 1; } } openpic_update_irq(opp, n_IRQ); }","No, it is non-vulnerable."835833,"static int context_init(H264Context *h){ CHECKED_ALLOCZ(h->top_borders[0], h->s.mb_width * (16+8+8) * sizeof(uint8_t)) CHECKED_ALLOCZ(h->top_borders[1], h->s.mb_width * (16+8+8) * sizeof(uint8_t)) return 0; fail: return -1; // free_tables will clean up for us }","No, it is non-vulnerable."836834,"void ff_snow_vertical_compose97i_mmx(DWTELEM *b0, DWTELEM *b1, DWTELEM *b2, DWTELEM *b3, DWTELEM *b4, DWTELEM *b5, int width){ long i = width; while(i & 0x7) { i--; b4[i] -= (W_DM*(b3[i] + b5[i])+W_DO)>>W_DS; b3[i] -= (W_CM*(b2[i] + b4[i])+W_CO)>>W_CS; b2[i] += (W_BM*(b1[i] + b3[i])+4*b2[i]+W_BO)>>W_BS; b1[i] += (W_AM*(b0[i] + b2[i])+W_AO)>>W_AS; } asm volatile( ""jmp 2f \n\t"" ""1: \n\t"" ""mov %6, %%""REG_a"" \n\t"" ""mov %4, %%""REG_S"" \n\t"" snow_vertical_compose_mmx_load(REG_S,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_a,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_move(""mm0"",""mm2"",""mm4"",""mm6"",""mm1"",""mm3"",""mm5"",""mm7"") snow_vertical_compose_mmx_r2r_add(""mm0"",""mm2"",""mm4"",""mm6"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_r2r_add(""mm1"",""mm3"",""mm5"",""mm7"",""mm0"",""mm2"",""mm4"",""mm6"") ""pcmpeqd %%mm1, %%mm1 \n\t"" ""pslld $31, %%mm1 \n\t"" ""psrld $29, %%mm1 \n\t"" ""mov %5, %%""REG_a"" \n\t"" snow_vertical_compose_mmx_r2r_add(""mm1"",""mm1"",""mm1"",""mm1"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_sra(""3"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_load(REG_a,""mm1"",""mm3"",""mm5"",""mm7"") snow_vertical_compose_mmx_sub(""mm0"",""mm2"",""mm4"",""mm6"",""mm1"",""mm3"",""mm5"",""mm7"") snow_vertical_compose_mmx_store(REG_a,""mm1"",""mm3"",""mm5"",""mm7"") ""mov %3, %%""REG_c"" \n\t"" snow_vertical_compose_mmx_load(REG_S,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_c,""mm1"",""mm3"",""mm5"",""mm7"") snow_vertical_compose_mmx_sub(""mm1"",""mm3"",""mm5"",""mm7"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_store(REG_S,""mm0"",""mm2"",""mm4"",""mm6"") ""mov %2, %%""REG_a"" \n\t"" snow_vertical_compose_mmx_add(REG_a,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_sra(""2"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_c,""mm0"",""mm2"",""mm4"",""mm6"") ""pcmpeqd %%mm1, %%mm1 \n\t"" ""pslld $31, %%mm1 \n\t"" ""psrld $30, %%mm1 \n\t"" ""mov %1, %%""REG_S"" \n\t"" snow_vertical_compose_mmx_r2r_add(""mm1"",""mm1"",""mm1"",""mm1"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_sra(""2"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_c,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_store(REG_c,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_S,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_move(""mm0"",""mm2"",""mm4"",""mm6"",""mm1"",""mm3"",""mm5"",""mm7"") snow_vertical_compose_mmx_sra(""1"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_r2r_add(""mm1"",""mm3"",""mm5"",""mm7"",""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_add(REG_a,""mm0"",""mm2"",""mm4"",""mm6"") snow_vertical_compose_mmx_store(REG_a,""mm0"",""mm2"",""mm4"",""mm6"") ""2: \n\t"" ""sub $8, %%""REG_d"" \n\t"" ""jge 1b \n\t"" :""+d""(i) : ""m""(b0),""m""(b1),""m""(b2),""m""(b3),""m""(b4),""m""(b5): ""%""REG_a"""",""%""REG_S"""",""%""REG_c""""); }","Yes, it is vulnerable."837835,"static int mxf_read_material_package(void *arg, AVIOContext *pb, int tag, int size, UID uid) { MXFPackage *package = arg; switch(tag) { case 0x4403: package->tracks_count = avio_rb32(pb); if (package->tracks_count >= UINT_MAX / sizeof(UID)) return -1; package->tracks_refs = av_malloc(package->tracks_count * sizeof(UID)); if (!package->tracks_refs) return -1; avio_skip(pb, 4); /* useless size of objects, always 16 according to specs */ avio_read(pb, (uint8_t *)package->tracks_refs, package->tracks_count * sizeof(UID)); break; } return 0; }","Yes, it is vulnerable."838836,"static void rng_egd_finalize(Object *obj) { RngEgd *s = RNG_EGD(obj); if (s->chr) { qemu_chr_add_handlers(s->chr, NULL, NULL, NULL, NULL); qemu_chr_fe_release(s->chr); } g_free(s->chr_name); rng_egd_free_requests(s); }","No, it is non-vulnerable."839837,"static int cinepak_decode_strip (CinepakContext *s, cvid_strip_t *strip, uint8_t *data, int size) { uint8_t *eod = (data + size); int chunk_id, chunk_size; /* coordinate sanity checks */ if (strip->x1 >= s->width || strip->x2 > s->width || strip->y1 >= s->height || strip->y2 > s->height || strip->x1 >= strip->x2 || strip->y1 >= strip->y2) while ((data + 4) <= eod) { chunk_id = BE_16 (&data[0]); chunk_size = BE_16 (&data[2]) - 4; data += 4; chunk_size = ((data + chunk_size) > eod) ? (eod - data) : chunk_size; switch (chunk_id) { case 0x2000: case 0x2100: case 0x2400: case 0x2500: cinepak_decode_codebook (strip->v4_codebook, chunk_id, chunk_size, data); break; case 0x2200: case 0x2300: case 0x2600: case 0x2700: cinepak_decode_codebook (strip->v1_codebook, chunk_id, chunk_size, data); break; case 0x3000: case 0x3100: case 0x3200: return cinepak_decode_vectors (s, strip, chunk_id, chunk_size, data); } data += chunk_size; } }","Yes, it is vulnerable."840838,"void *av_realloc_array(void *ptr, size_t nmemb, size_t size) { if (size <= 0 || nmemb >= INT_MAX / size) return NULL; return av_realloc(ptr, nmemb * size); }","No, it is non-vulnerable."841839,"static inline void RENAME(vu9_to_vu12)(const uint8_t *src1, const uint8_t *src2, uint8_t *dst1, uint8_t *dst2, unsigned width, unsigned height, int srcStride1, int srcStride2, int dstStride1, int dstStride2) { unsigned int y,x,h; int w; w=width/2; h=height/2; #ifdef HAVE_MMX asm volatile( PREFETCH"" %0\n\t"" PREFETCH"" %1\n\t"" ::""m""(*(src1+srcStride1)),""m""(*(src2+srcStride2)):""memory""); #endif for(y=0;y<h;y++){ const uint8_t* s1=src1+srcStride1*(y>>1); uint8_t* d=dst1+dstStride1*y; x=0; #ifdef HAVE_MMX for(;x<w-31;x+=32) { asm volatile( PREFETCH"" 32%1\n\t"" ""movq %1, %%mm0\n\t"" ""movq 8%1, %%mm2\n\t"" ""movq 16%1, %%mm4\n\t"" ""movq 24%1, %%mm6\n\t"" ""movq %%mm0, %%mm1\n\t"" ""movq %%mm2, %%mm3\n\t"" ""movq %%mm4, %%mm5\n\t"" ""movq %%mm6, %%mm7\n\t"" ""punpcklbw %%mm0, %%mm0\n\t"" ""punpckhbw %%mm1, %%mm1\n\t"" ""punpcklbw %%mm2, %%mm2\n\t"" ""punpckhbw %%mm3, %%mm3\n\t"" ""punpcklbw %%mm4, %%mm4\n\t"" ""punpckhbw %%mm5, %%mm5\n\t"" ""punpcklbw %%mm6, %%mm6\n\t"" ""punpckhbw %%mm7, %%mm7\n\t"" MOVNTQ"" %%mm0, %0\n\t"" MOVNTQ"" %%mm1, 8%0\n\t"" MOVNTQ"" %%mm2, 16%0\n\t"" MOVNTQ"" %%mm3, 24%0\n\t"" MOVNTQ"" %%mm4, 32%0\n\t"" MOVNTQ"" %%mm5, 40%0\n\t"" MOVNTQ"" %%mm6, 48%0\n\t"" MOVNTQ"" %%mm7, 56%0"" :""=m""(d[2*x]) :""m""(s1[x]) :""memory""); } #endif for(;x<w;x++) d[2*x]=d[2*x+1]=s1[x]; } for(y=0;y<h;y++){ const uint8_t* s2=src2+srcStride2*(y>>1); uint8_t* d=dst2+dstStride2*y; x=0; #ifdef HAVE_MMX for(;x<w-31;x+=32) { asm volatile( PREFETCH"" 32%1\n\t"" ""movq %1, %%mm0\n\t"" ""movq 8%1, %%mm2\n\t"" ""movq 16%1, %%mm4\n\t"" ""movq 24%1, %%mm6\n\t"" ""movq %%mm0, %%mm1\n\t"" ""movq %%mm2, %%mm3\n\t"" ""movq %%mm4, %%mm5\n\t"" ""movq %%mm6, %%mm7\n\t"" ""punpcklbw %%mm0, %%mm0\n\t"" ""punpckhbw %%mm1, %%mm1\n\t"" ""punpcklbw %%mm2, %%mm2\n\t"" ""punpckhbw %%mm3, %%mm3\n\t"" ""punpcklbw %%mm4, %%mm4\n\t"" ""punpckhbw %%mm5, %%mm5\n\t"" ""punpcklbw %%mm6, %%mm6\n\t"" ""punpckhbw %%mm7, %%mm7\n\t"" MOVNTQ"" %%mm0, %0\n\t"" MOVNTQ"" %%mm1, 8%0\n\t"" MOVNTQ"" %%mm2, 16%0\n\t"" MOVNTQ"" %%mm3, 24%0\n\t"" MOVNTQ"" %%mm4, 32%0\n\t"" MOVNTQ"" %%mm5, 40%0\n\t"" MOVNTQ"" %%mm6, 48%0\n\t"" MOVNTQ"" %%mm7, 56%0"" :""=m""(d[2*x]) :""m""(s2[x]) :""memory""); } #endif for(;x<w;x++) d[2*x]=d[2*x+1]=s2[x]; } #ifdef HAVE_MMX asm( EMMS"" \n\t"" SFENCE"" \n\t"" ::: ""memory"" ); #endif }","Yes, it is vulnerable."842840,"int pic_read_irq(DeviceState *d) { PICCommonState *s = DO_UPCAST(PICCommonState, dev.qdev, d); int irq, irq2, intno; irq = pic_get_irq(s); if (irq >= 0) { if (irq == 2) { irq2 = pic_get_irq(slave_pic); if (irq2 >= 0) { pic_intack(slave_pic, irq2); } else { /* spurious IRQ on slave controller */ irq2 = 7; intno = slave_pic->irq_base + irq2; } else { intno = s->irq_base + irq; pic_intack(s, irq); } else { /* spurious IRQ on host controller */ irq = 7; intno = s->irq_base + irq; #if defined(DEBUG_PIC) || defined(DEBUG_IRQ_LATENCY) if (irq == 2) { irq = irq2 + 8; #endif #ifdef DEBUG_IRQ_LATENCY printf(""IRQ%d latency=%0.3fus\n"", irq, (double)(qemu_get_clock_ns(vm_clock) - irq_time[irq]) * 1000000.0 / get_ticks_per_sec()); #endif DPRINTF(""pic_interrupt: irq=%d\n"", irq); return intno;","Yes, it is vulnerable."843841,"void memory_region_notify_one(IOMMUNotifier *notifier, IOMMUTLBEntry *entry) { IOMMUNotifierFlag request_flags; /* * Skip the notification if the notification does not overlap * with registered range. */ if (notifier->start > entry->iova + entry->addr_mask + 1 || notifier->end < entry->iova) { return; } if (entry->perm & IOMMU_RW) { request_flags = IOMMU_NOTIFIER_MAP; } else { request_flags = IOMMU_NOTIFIER_UNMAP; } if (notifier->notifier_flags & request_flags) { notifier->notify(notifier, entry); } }","Yes, it is vulnerable."844842,"static void udp_chr_close(CharDriverState *chr) { NetCharDriver *s = chr->opaque; if (s->tag) { g_source_remove(s->tag); s->tag = 0; } if (s->chan) { g_io_channel_unref(s->chan); closesocket(s->fd); } g_free(s); qemu_chr_be_event(chr, CHR_EVENT_CLOSED); }","Yes, it is vulnerable."845843,"static void av_estimate_timings_from_pts(AVFormatContext *ic) { AVPacket pkt1, *pkt = &pkt1; AVStream *st; int read_size, i, ret; int64_t end_time; int64_t filesize, offset, duration; /* free previous packet */ if (ic->cur_st && ic->cur_st->parser) av_free_packet(&ic->cur_pkt); ic->cur_st = NULL; /* flush packet queue */ flush_packet_queue(ic); for(i=0;i<ic->nb_streams;i++) { st = ic->streams[i]; if (st->parser) { av_parser_close(st->parser); st->parser= NULL; } } /* we read the first packets to get the first PTS (not fully accurate, but it is enough now) */ url_fseek(&ic->pb, 0, SEEK_SET); read_size = 0; for(;;) { if (read_size >= DURATION_MAX_READ_SIZE) break; /* if all info is available, we can stop */ for(i = 0;i < ic->nb_streams; i++) { st = ic->streams[i]; if (st->start_time == AV_NOPTS_VALUE) break; } if (i == ic->nb_streams) break; ret = av_read_packet(ic, pkt); if (ret != 0) break; read_size += pkt->size; st = ic->streams[pkt->stream_index]; if (pkt->pts != AV_NOPTS_VALUE) { if (st->start_time == AV_NOPTS_VALUE) st->start_time = pkt->pts; } av_free_packet(pkt); } /* estimate the end time (duration) */ /* XXX: may need to support wrapping */ filesize = ic->file_size; offset = filesize - DURATION_MAX_READ_SIZE; if (offset < 0) offset = 0; url_fseek(&ic->pb, offset, SEEK_SET); read_size = 0; for(;;) { if (read_size >= DURATION_MAX_READ_SIZE) break; /* if all info is available, we can stop */ for(i = 0;i < ic->nb_streams; i++) { st = ic->streams[i]; if (st->duration == AV_NOPTS_VALUE) break; } if (i == ic->nb_streams) break; ret = av_read_packet(ic, pkt); if (ret != 0) break; read_size += pkt->size; st = ic->streams[pkt->stream_index]; if (pkt->pts != AV_NOPTS_VALUE) { end_time = pkt->pts; duration = end_time - st->start_time; if (duration > 0) { if (st->duration == AV_NOPTS_VALUE || st->duration < duration) st->duration = duration; } } av_free_packet(pkt); } fill_all_stream_timings(ic); url_fseek(&ic->pb, 0, SEEK_SET); }","Yes, it is vulnerable."846844,"static int vmdaudio_decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8_t *buf, int buf_size) { VmdAudioContext *s = (VmdAudioContext *)avctx->priv_data; unsigned int sound_flags; unsigned char *output_samples = (unsigned char *)data; /* point to the start of the encoded data */ unsigned char *p = buf + 16; unsigned char *p_end = buf + buf_size; if (buf_size < 16) return buf_size; if (buf[6] == 1) { /* the chunk contains audio */ *data_size = vmdaudio_loadsound(s, output_samples, p, 0); } else if (buf[6] == 2) { /* the chunk contains audio and silence mixed together */ sound_flags = LE_32(p); p += 4; /* do something with extrabufs here? */ while (p < p_end) { if (sound_flags & 0x01) /* silence */ *data_size += vmdaudio_loadsound(s, output_samples, p, 1); else { /* audio */ *data_size += vmdaudio_loadsound(s, output_samples, p, 0); p += s->block_align; } output_samples += (s->block_align * s->bits / 8); sound_flags >>= 1; } } else if (buf[6] == 3) { /* silent chunk */ *data_size = vmdaudio_loadsound(s, output_samples, p, 1); } return buf_size; }","Yes, it is vulnerable."847845,"static void scsi_write_same_complete(void *opaque, int ret) { WriteSameCBData *data = opaque; SCSIDiskReq *r = data->r; SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, r->req.dev); assert(r->req.aiocb != NULL); r->req.aiocb = NULL; aio_context_acquire(blk_get_aio_context(s->qdev.conf.blk)); if (scsi_disk_req_check_error(r, ret, true)) { goto done; } block_acct_done(blk_get_stats(s->qdev.conf.blk), &r->acct); data->nb_sectors -= data->iov.iov_len / 512; data->sector += data->iov.iov_len / 512; data->iov.iov_len = MIN(data->nb_sectors * 512, data->iov.iov_len); if (data->iov.iov_len) { block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, data->iov.iov_len, BLOCK_ACCT_WRITE); /* Reinitialize qiov, to handle unaligned WRITE SAME request * where final qiov may need smaller size */ qemu_iovec_init_external(&data->qiov, &data->iov, 1); r->req.aiocb = blk_aio_pwritev(s->qdev.conf.blk, data->sector << BDRV_SECTOR_BITS, &data->qiov, 0, scsi_write_same_complete, data); return; } scsi_req_complete(&r->req, GOOD); done: scsi_req_unref(&r->req); qemu_vfree(data->iov.iov_base); g_free(data); }","Yes, it is vulnerable."848846,"PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size) { PXA2xxState *s; int i; DriveInfo *dinfo; s = (PXA2xxState *) g_malloc0(sizeof(PXA2xxState)); s->cpu = cpu_arm_init(""pxa255""); if (s->cpu == NULL) { fprintf(stderr, ""Unable to find CPU definition\n""); exit(1); } s->reset = qemu_allocate_irq(pxa2xx_reset, s, 0); /* SDRAM & Internal Memory Storage */ memory_region_init_ram(&s->sdram, NULL, ""pxa255.sdram"", sdram_size, &error_abort); vmstate_register_ram_global(&s->sdram); memory_region_add_subregion(address_space, PXA2XX_SDRAM_BASE, &s->sdram); memory_region_init_ram(&s->internal, NULL, ""pxa255.internal"", PXA2XX_INTERNAL_SIZE, &error_abort); vmstate_register_ram_global(&s->internal); memory_region_add_subregion(address_space, PXA2XX_INTERNAL_BASE, &s->internal); s->pic = pxa2xx_pic_init(0x40d00000, s->cpu); s->dma = pxa255_dma_init(0x40000000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_DMA)); sysbus_create_varargs(""pxa25x-timer"", 0x40a00000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 0), qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 1), qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 2), qdev_get_gpio_in(s->pic, PXA2XX_PIC_OST_0 + 3), NULL); s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85); dinfo = drive_get(IF_SD, 0, 0); if (!dinfo) { fprintf(stderr, ""qemu: missing SecureDigital device\n""); exit(1); } s->mmc = pxa2xx_mmci_init(address_space, 0x41100000, blk_by_legacy_dinfo(dinfo), qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC), qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI), qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI)); for (i = 0; pxa255_serial[i].io_base; i++) { if (serial_hds[i]) { serial_mm_init(address_space, pxa255_serial[i].io_base, 2, qdev_get_gpio_in(s->pic, pxa255_serial[i].irqn), 14745600 / 16, serial_hds[i], DEVICE_NATIVE_ENDIAN); } else { break; } } if (serial_hds[i]) s->fir = pxa2xx_fir_init(address_space, 0x40800000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_ICP), qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_ICP), qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_ICP), serial_hds[i]); s->lcd = pxa2xx_lcdc_init(address_space, 0x44000000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_LCD)); s->cm_base = 0x41300000; s->cm_regs[CCCR >> 2] = 0x02000210; /* 416.0 MHz */ s->clkcfg = 0x00000009; /* Turbo mode active */ memory_region_init_io(&s->cm_iomem, NULL, &pxa2xx_cm_ops, s, ""pxa2xx-cm"", 0x1000); memory_region_add_subregion(address_space, s->cm_base, &s->cm_iomem); vmstate_register(NULL, 0, &vmstate_pxa2xx_cm, s); pxa2xx_setup_cp14(s); s->mm_base = 0x48000000; s->mm_regs[MDMRS >> 2] = 0x00020002; s->mm_regs[MDREFR >> 2] = 0x03ca4000; s->mm_regs[MECR >> 2] = 0x00000001; /* Two PC Card sockets */ memory_region_init_io(&s->mm_iomem, NULL, &pxa2xx_mm_ops, s, ""pxa2xx-mm"", 0x1000); memory_region_add_subregion(address_space, s->mm_base, &s->mm_iomem); vmstate_register(NULL, 0, &vmstate_pxa2xx_mm, s); s->pm_base = 0x40f00000; memory_region_init_io(&s->pm_iomem, NULL, &pxa2xx_pm_ops, s, ""pxa2xx-pm"", 0x100); memory_region_add_subregion(address_space, s->pm_base, &s->pm_iomem); vmstate_register(NULL, 0, &vmstate_pxa2xx_pm, s); for (i = 0; pxa255_ssp[i].io_base; i ++); s->ssp = (SSIBus **)g_malloc0(sizeof(SSIBus *) * i); for (i = 0; pxa255_ssp[i].io_base; i ++) { DeviceState *dev; dev = sysbus_create_simple(TYPE_PXA2XX_SSP, pxa255_ssp[i].io_base, qdev_get_gpio_in(s->pic, pxa255_ssp[i].irqn)); s->ssp[i] = (SSIBus *)qdev_get_child_bus(dev, ""ssi""); } if (usb_enabled()) { sysbus_create_simple(""sysbus-ohci"", 0x4c000000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_USBH1)); } s->pcmcia[0] = pxa2xx_pcmcia_init(address_space, 0x20000000); s->pcmcia[1] = pxa2xx_pcmcia_init(address_space, 0x30000000); sysbus_create_simple(TYPE_PXA2XX_RTC, 0x40900000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_RTCALARM)); s->i2c[0] = pxa2xx_i2c_init(0x40301600, qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2C), 0xffff); s->i2c[1] = pxa2xx_i2c_init(0x40f00100, qdev_get_gpio_in(s->pic, PXA2XX_PIC_PWRI2C), 0xff); s->i2s = pxa2xx_i2s_init(address_space, 0x40400000, qdev_get_gpio_in(s->pic, PXA2XX_PIC_I2S), qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_I2S), qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_I2S)); /* GPIO1 resets the processor */ /* The handler can be overridden by board-specific code */ qdev_connect_gpio_out(s->gpio, 1, s->reset); return s; }","Yes, it is vulnerable."849847,"static int audio_open(AVFormatContext *s1, int is_output, const char *audio_device) { AudioData *s = s1->priv_data; int audio_fd; int tmp, err; char *flip = getenv(""AUDIO_FLIP_LEFT""); if (is_output) audio_fd = avpriv_open(audio_device, O_WRONLY); else audio_fd = avpriv_open(audio_device, O_RDONLY); if (audio_fd < 0) { av_log(s1, AV_LOG_ERROR, ""%s: %s\n"", audio_device, strerror(errno)); return AVERROR(EIO); } if (flip && *flip == '1') { s->flip_left = 1; } /* non blocking mode */ if (!is_output) { if (fcntl(audio_fd, F_SETFL, O_NONBLOCK) < 0) { av_log(s1, AV_LOG_WARNING, ""%s: Could not enable non block mode (%s)\n"", audio_device, strerror(errno)); } } s->frame_size = AUDIO_BLOCK_SIZE; /* select format : favour native format */ err = ioctl(audio_fd, SNDCTL_DSP_GETFMTS, &tmp); #if HAVE_BIGENDIAN if (tmp & AFMT_S16_BE) { tmp = AFMT_S16_BE; } else if (tmp & AFMT_S16_LE) { tmp = AFMT_S16_LE; } else { tmp = 0; } #else if (tmp & AFMT_S16_LE) { tmp = AFMT_S16_LE; } else if (tmp & AFMT_S16_BE) { tmp = AFMT_S16_BE; } else { tmp = 0; } #endif switch(tmp) { case AFMT_S16_LE: s->codec_id = AV_CODEC_ID_PCM_S16LE; break; case AFMT_S16_BE: s->codec_id = AV_CODEC_ID_PCM_S16BE; break; default: av_log(s1, AV_LOG_ERROR, ""Soundcard does not support 16 bit sample format\n""); close(audio_fd); return AVERROR(EIO); } err=ioctl(audio_fd, SNDCTL_DSP_SETFMT, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_SETFMT: %s\n"", strerror(errno)); goto fail; } tmp = (s->channels == 2); err = ioctl(audio_fd, SNDCTL_DSP_STEREO, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_STEREO: %s\n"", strerror(errno)); goto fail; } tmp = s->sample_rate; err = ioctl(audio_fd, SNDCTL_DSP_SPEED, &tmp); if (err < 0) { av_log(s1, AV_LOG_ERROR, ""SNDCTL_DSP_SPEED: %s\n"", strerror(errno)); goto fail; } s->sample_rate = tmp; /* store real sample rate */ s->fd = audio_fd; return 0; fail: close(audio_fd); return AVERROR(EIO); }","Yes, it is vulnerable."850848,"static int mpeg_decode_mb(MpegEncContext *s, int16_t block[12][64]) { int i, j, k, cbp, val, mb_type, motion_type; const int mb_block_count = 4 + (1 << s->chroma_format); int ret; av_dlog(s->avctx, ""decode_mb: x=%d y=%d\n"", s->mb_x, s->mb_y); av_assert2(s->mb_skipped == 0); if (s->mb_skip_run-- != 0) { if (s->pict_type == AV_PICTURE_TYPE_P) { s->mb_skipped = 1; s->current_picture.mb_type[s->mb_x + s->mb_y * s->mb_stride] = MB_TYPE_SKIP | MB_TYPE_L0 | MB_TYPE_16x16; } else { int mb_type; if (s->mb_x) mb_type = s->current_picture.mb_type[s->mb_x + s->mb_y * s->mb_stride - 1]; else // FIXME not sure if this is allowed in MPEG at all mb_type = s->current_picture.mb_type[s->mb_width + (s->mb_y - 1) * s->mb_stride - 1]; if (IS_INTRA(mb_type)) { av_log(s->avctx, AV_LOG_ERROR, ""skip with previntra\n""); return AVERROR_INVALIDDATA; } s->current_picture.mb_type[s->mb_x + s->mb_y * s->mb_stride] = mb_type | MB_TYPE_SKIP; if ((s->mv[0][0][0] | s->mv[0][0][1] | s->mv[1][0][0] | s->mv[1][0][1]) == 0) s->mb_skipped = 1; } return 0; } switch (s->pict_type) { default: case AV_PICTURE_TYPE_I: if (get_bits1(&s->gb) == 0) { if (get_bits1(&s->gb) == 0) { av_log(s->avctx, AV_LOG_ERROR, ""invalid mb type in I Frame at %d %d\n"", s->mb_x, s->mb_y); return AVERROR_INVALIDDATA; } mb_type = MB_TYPE_QUANT | MB_TYPE_INTRA; } else { mb_type = MB_TYPE_INTRA; } break; case AV_PICTURE_TYPE_P: mb_type = get_vlc2(&s->gb, ff_mb_ptype_vlc.table, MB_PTYPE_VLC_BITS, 1); if (mb_type < 0) { av_log(s->avctx, AV_LOG_ERROR, ""invalid mb type in P Frame at %d %d\n"", s->mb_x, s->mb_y); return AVERROR_INVALIDDATA; } mb_type = ptype2mb_type[mb_type]; break; case AV_PICTURE_TYPE_B: mb_type = get_vlc2(&s->gb, ff_mb_btype_vlc.table, MB_BTYPE_VLC_BITS, 1); if (mb_type < 0) { av_log(s->avctx, AV_LOG_ERROR, ""invalid mb type in B Frame at %d %d\n"", s->mb_x, s->mb_y); return AVERROR_INVALIDDATA; } mb_type = btype2mb_type[mb_type]; break; } av_dlog(s->avctx, ""mb_type=%x\n"", mb_type); // motion_type = 0; /* avoid warning */ if (IS_INTRA(mb_type)) { s->bdsp.clear_blocks(s->block[0]); if (!s->chroma_y_shift) s->bdsp.clear_blocks(s->block[6]); /* compute DCT type */ // FIXME: add an interlaced_dct coded var? if (s->picture_structure == PICT_FRAME && !s->frame_pred_frame_dct) s->interlaced_dct = get_bits1(&s->gb); if (IS_QUANT(mb_type)) s->qscale = get_qscale(s); if (s->concealment_motion_vectors) { /* just parse them */ if (s->picture_structure != PICT_FRAME) skip_bits1(&s->gb); /* field select */ s->mv[0][0][0] = s->last_mv[0][0][0] = s->last_mv[0][1][0] = mpeg_decode_motion(s, s->mpeg_f_code[0][0], s->last_mv[0][0][0]); s->mv[0][0][1] = s->last_mv[0][0][1] = s->last_mv[0][1][1] = mpeg_decode_motion(s, s->mpeg_f_code[0][1], s->last_mv[0][0][1]); skip_bits1(&s->gb); /* marker */ } else { /* reset mv prediction */ memset(s->last_mv, 0, sizeof(s->last_mv)); } s->mb_intra = 1; // if 1, we memcpy blocks in xvmcvideo if ((CONFIG_MPEG1_XVMC_HWACCEL || CONFIG_MPEG2_XVMC_HWACCEL) && s->pack_pblocks) ff_xvmc_pack_pblocks(s, -1); // inter are always full blocks if (s->codec_id == AV_CODEC_ID_MPEG2VIDEO) { if (s->flags2 & CODEC_FLAG2_FAST) { for (i = 0; i < 6; i++) mpeg2_fast_decode_block_intra(s, *s->pblocks[i], i); } else { for (i = 0; i < mb_block_count; i++) if ((ret = mpeg2_decode_block_intra(s, *s->pblocks[i], i)) < 0) return ret; } } else { for (i = 0; i < 6; i++) if ((ret = mpeg1_decode_block_intra(s, *s->pblocks[i], i)) < 0) return ret; } } else { if (mb_type & MB_TYPE_ZERO_MV) { av_assert2(mb_type & MB_TYPE_CBP); s->mv_dir = MV_DIR_FORWARD; if (s->picture_structure == PICT_FRAME) { if (s->picture_structure == PICT_FRAME && !s->frame_pred_frame_dct) s->interlaced_dct = get_bits1(&s->gb); s->mv_type = MV_TYPE_16X16; } else { s->mv_type = MV_TYPE_FIELD; mb_type |= MB_TYPE_INTERLACED; s->field_select[0][0] = s->picture_structure - 1; } if (IS_QUANT(mb_type)) s->qscale = get_qscale(s); s->last_mv[0][0][0] = 0; s->last_mv[0][0][1] = 0; s->last_mv[0][1][0] = 0; s->last_mv[0][1][1] = 0; s->mv[0][0][0] = 0; s->mv[0][0][1] = 0; } else { av_assert2(mb_type & MB_TYPE_L0L1); // FIXME decide if MBs in field pictures are MB_TYPE_INTERLACED /* get additional motion vector type */ if (s->picture_structure == PICT_FRAME && s->frame_pred_frame_dct) { motion_type = MT_FRAME; } else { motion_type = get_bits(&s->gb, 2); if (s->picture_structure == PICT_FRAME && HAS_CBP(mb_type)) s->interlaced_dct = get_bits1(&s->gb); } if (IS_QUANT(mb_type)) s->qscale = get_qscale(s); /* motion vectors */ s->mv_dir = (mb_type >> 13) & 3; av_dlog(s->avctx, ""motion_type=%d\n"", motion_type); switch (motion_type) { case MT_FRAME: /* or MT_16X8 */ if (s->picture_structure == PICT_FRAME) { mb_type |= MB_TYPE_16x16; s->mv_type = MV_TYPE_16X16; for (i = 0; i < 2; i++) { if (USES_LIST(mb_type, i)) { /* MT_FRAME */ s->mv[i][0][0] = s->last_mv[i][0][0] = s->last_mv[i][1][0] = mpeg_decode_motion(s, s->mpeg_f_code[i][0], s->last_mv[i][0][0]); s->mv[i][0][1] = s->last_mv[i][0][1] = s->last_mv[i][1][1] = mpeg_decode_motion(s, s->mpeg_f_code[i][1], s->last_mv[i][0][1]); /* full_pel: only for MPEG-1 */ if (s->full_pel[i]) { s->mv[i][0][0] <<= 1; s->mv[i][0][1] <<= 1; } } } } else { mb_type |= MB_TYPE_16x8 | MB_TYPE_INTERLACED; s->mv_type = MV_TYPE_16X8; for (i = 0; i < 2; i++) { if (USES_LIST(mb_type, i)) { /* MT_16X8 */ for (j = 0; j < 2; j++) { s->field_select[i][j] = get_bits1(&s->gb); for (k = 0; k < 2; k++) { val = mpeg_decode_motion(s, s->mpeg_f_code[i][k], s->last_mv[i][j][k]); s->last_mv[i][j][k] = val; s->mv[i][j][k] = val; } } } } } break; case MT_FIELD: s->mv_type = MV_TYPE_FIELD; if (s->picture_structure == PICT_FRAME) { mb_type |= MB_TYPE_16x8 | MB_TYPE_INTERLACED; for (i = 0; i < 2; i++) { if (USES_LIST(mb_type, i)) { for (j = 0; j < 2; j++) { s->field_select[i][j] = get_bits1(&s->gb); val = mpeg_decode_motion(s, s->mpeg_f_code[i][0], s->last_mv[i][j][0]); s->last_mv[i][j][0] = val; s->mv[i][j][0] = val; av_dlog(s->avctx, ""fmx=%d\n"", val); val = mpeg_decode_motion(s, s->mpeg_f_code[i][1], s->last_mv[i][j][1] >> 1); s->last_mv[i][j][1] = 2 * val; s->mv[i][j][1] = val; av_dlog(s->avctx, ""fmy=%d\n"", val); } } } } else { av_assert0(!s->progressive_sequence); mb_type |= MB_TYPE_16x16 | MB_TYPE_INTERLACED; for (i = 0; i < 2; i++) { if (USES_LIST(mb_type, i)) { s->field_select[i][0] = get_bits1(&s->gb); for (k = 0; k < 2; k++) { val = mpeg_decode_motion(s, s->mpeg_f_code[i][k], s->last_mv[i][0][k]); s->last_mv[i][0][k] = val; s->last_mv[i][1][k] = val; s->mv[i][0][k] = val; } } } } break; case MT_DMV: if (s->progressive_sequence){ av_log(s->avctx, AV_LOG_ERROR, ""MT_DMV in progressive_sequence\n""); return AVERROR_INVALIDDATA; } s->mv_type = MV_TYPE_DMV; for (i = 0; i < 2; i++) { if (USES_LIST(mb_type, i)) { int dmx, dmy, mx, my, m; const int my_shift = s->picture_structure == PICT_FRAME; mx = mpeg_decode_motion(s, s->mpeg_f_code[i][0], s->last_mv[i][0][0]); s->last_mv[i][0][0] = mx; s->last_mv[i][1][0] = mx; dmx = get_dmv(s); my = mpeg_decode_motion(s, s->mpeg_f_code[i][1], s->last_mv[i][0][1] >> my_shift); dmy = get_dmv(s); s->last_mv[i][0][1] = my << my_shift; s->last_mv[i][1][1] = my << my_shift; s->mv[i][0][0] = mx; s->mv[i][0][1] = my; s->mv[i][1][0] = mx; // not used s->mv[i][1][1] = my; // not used if (s->picture_structure == PICT_FRAME) { mb_type |= MB_TYPE_16x16 | MB_TYPE_INTERLACED; // m = 1 + 2 * s->top_field_first; m = s->top_field_first ? 1 : 3; /* top -> top pred */ s->mv[i][2][0] = ((mx * m + (mx > 0)) >> 1) + dmx; s->mv[i][2][1] = ((my * m + (my > 0)) >> 1) + dmy - 1; m = 4 - m; s->mv[i][3][0] = ((mx * m + (mx > 0)) >> 1) + dmx; s->mv[i][3][1] = ((my * m + (my > 0)) >> 1) + dmy + 1; } else { mb_type |= MB_TYPE_16x16; s->mv[i][2][0] = ((mx + (mx > 0)) >> 1) + dmx; s->mv[i][2][1] = ((my + (my > 0)) >> 1) + dmy; if (s->picture_structure == PICT_TOP_FIELD) s->mv[i][2][1]--; else s->mv[i][2][1]++; } } } break; default: av_log(s->avctx, AV_LOG_ERROR, ""00 motion_type at %d %d\n"", s->mb_x, s->mb_y); return AVERROR_INVALIDDATA; } } s->mb_intra = 0; if (HAS_CBP(mb_type)) { s->bdsp.clear_blocks(s->block[0]); cbp = get_vlc2(&s->gb, ff_mb_pat_vlc.table, MB_PAT_VLC_BITS, 1); if (mb_block_count > 6) { cbp <<= mb_block_count - 6; cbp |= get_bits(&s->gb, mb_block_count - 6); s->bdsp.clear_blocks(s->block[6]); } if (cbp <= 0) { av_log(s->avctx, AV_LOG_ERROR, ""invalid cbp %d at %d %d\n"", cbp, s->mb_x, s->mb_y); return AVERROR_INVALIDDATA; } // if 1, we memcpy blocks in xvmcvideo if ((CONFIG_MPEG1_XVMC_HWACCEL || CONFIG_MPEG2_XVMC_HWACCEL) && s->pack_pblocks) ff_xvmc_pack_pblocks(s, cbp); if (s->codec_id == AV_CODEC_ID_MPEG2VIDEO) { if (s->flags2 & CODEC_FLAG2_FAST) { for (i = 0; i < 6; i++) { if (cbp & 32) mpeg2_fast_decode_block_non_intra(s, *s->pblocks[i], i); else s->block_last_index[i] = -1; cbp += cbp; } } else { cbp <<= 12 - mb_block_count; for (i = 0; i < mb_block_count; i++) { if (cbp & (1 << 11)) { if ((ret = mpeg2_decode_block_non_intra(s, *s->pblocks[i], i)) < 0) return ret; } else { s->block_last_index[i] = -1; } cbp += cbp; } } } else { if (s->flags2 & CODEC_FLAG2_FAST) { for (i = 0; i < 6; i++) { if (cbp & 32) mpeg1_fast_decode_block_inter(s, *s->pblocks[i], i); else s->block_last_index[i] = -1; cbp += cbp; } } else { for (i = 0; i < 6; i++) { if (cbp & 32) { if ((ret = mpeg1_decode_block_inter(s, *s->pblocks[i], i)) < 0) return ret; } else { s->block_last_index[i] = -1; } cbp += cbp; } } } } else { for (i = 0; i < 12; i++) s->block_last_index[i] = -1; } } s->current_picture.mb_type[s->mb_x + s->mb_y * s->mb_stride] = mb_type; return 0; }","No, it is non-vulnerable."851849,"void xen_be_unbind_evtchn(struct XenDevice *xendev) { if (xendev->local_port == -1) { return; } qemu_set_fd_handler(xc_evtchn_fd(xendev->evtchndev), NULL, NULL, NULL); xc_evtchn_unbind(xendev->evtchndev, xendev->local_port); xen_be_printf(xendev, 2, ""unbind evtchn port %d\n"", xendev->local_port); xendev->local_port = -1; }","No, it is non-vulnerable."852850,"int avio_printf(AVIOContext *s, const char *fmt, ...) { va_list ap; char buf[4096]; int ret; va_start(ap, fmt); ret = vsnprintf(buf, sizeof(buf), fmt, ap); va_end(ap); avio_write(s, buf, strlen(buf)); return ret; }","No, it is non-vulnerable."853851,"static int ppc_hash64_check_prot(int prot, int rw, int access_type) { int ret; if (access_type == ACCESS_CODE) { if (prot & PAGE_EXEC) { ret = 0; } else { ret = -2; } } else if (rw) { if (prot & PAGE_WRITE) { ret = 0; } else { ret = -2; } } else { if (prot & PAGE_READ) { ret = 0; } else { ret = -2; } } return ret; }","No, it is non-vulnerable."854852,"static int scsi_disk_emulate_inquiry(SCSIRequest *req, uint8_t *outbuf) { SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, req->dev); int buflen = 0; int start; if (req->cmd.buf[1] & 0x1) { /* Vital product data */ uint8_t page_code = req->cmd.buf[2]; outbuf[buflen++] = s->qdev.type & 0x1f; outbuf[buflen++] = page_code ; // this page outbuf[buflen++] = 0x00; outbuf[buflen++] = 0x00; start = buflen; switch (page_code) { case 0x00: /* Supported page codes, mandatory */ { DPRINTF(""Inquiry EVPD[Supported pages] "" ""buffer size %zd\n"", req->cmd.xfer); outbuf[buflen++] = 0x00; // list of supported pages (this page) if (s->serial) { outbuf[buflen++] = 0x80; // unit serial number } outbuf[buflen++] = 0x83; // device identification if (s->qdev.type == TYPE_DISK) { outbuf[buflen++] = 0xb0; // block limits outbuf[buflen++] = 0xb2; // thin provisioning } break; } case 0x80: /* Device serial number, optional */ { int l; if (!s->serial) { DPRINTF(""Inquiry (EVPD[Serial number] not supported\n""); return -1; } l = strlen(s->serial); if (l > 20) { l = 20; } DPRINTF(""Inquiry EVPD[Serial number] "" ""buffer size %zd\n"", req->cmd.xfer); memcpy(outbuf+buflen, s->serial, l); buflen += l; break; } case 0x83: /* Device identification page, mandatory */ { const char *str = s->serial ?: bdrv_get_device_name(s->qdev.conf.bs); int max_len = s->serial ? 20 : 255 - 8; int id_len = strlen(str); if (id_len > max_len) { id_len = max_len; } DPRINTF(""Inquiry EVPD[Device identification] "" ""buffer size %zd\n"", req->cmd.xfer); outbuf[buflen++] = 0x2; // ASCII outbuf[buflen++] = 0; // not officially assigned outbuf[buflen++] = 0; // reserved outbuf[buflen++] = id_len; // length of data following memcpy(outbuf+buflen, str, id_len); buflen += id_len; if (s->wwn) { outbuf[buflen++] = 0x1; // Binary outbuf[buflen++] = 0x3; // NAA outbuf[buflen++] = 0; // reserved outbuf[buflen++] = 8; stq_be_p(&outbuf[buflen], s->wwn); buflen += 8; } break; } case 0xb0: /* block limits */ { unsigned int unmap_sectors = s->qdev.conf.discard_granularity / s->qdev.blocksize; unsigned int min_io_size = s->qdev.conf.min_io_size / s->qdev.blocksize; unsigned int opt_io_size = s->qdev.conf.opt_io_size / s->qdev.blocksize; if (s->qdev.type == TYPE_ROM) { DPRINTF(""Inquiry (EVPD[%02X] not supported for CDROM\n"", page_code); return -1; } /* required VPD size with unmap support */ buflen = 0x40; memset(outbuf + 4, 0, buflen - 4); /* optimal transfer length granularity */ outbuf[6] = (min_io_size >> 8) & 0xff; outbuf[7] = min_io_size & 0xff; /* optimal transfer length */ outbuf[12] = (opt_io_size >> 24) & 0xff; outbuf[13] = (opt_io_size >> 16) & 0xff; outbuf[14] = (opt_io_size >> 8) & 0xff; outbuf[15] = opt_io_size & 0xff; /* optimal unmap granularity */ outbuf[28] = (unmap_sectors >> 24) & 0xff; outbuf[29] = (unmap_sectors >> 16) & 0xff; outbuf[30] = (unmap_sectors >> 8) & 0xff; outbuf[31] = unmap_sectors & 0xff; break; } case 0xb2: /* thin provisioning */ { buflen = 8; outbuf[4] = 0; outbuf[5] = 0xe0; /* unmap & write_same 10/16 all supported */ outbuf[6] = s->qdev.conf.discard_granularity ? 2 : 1; outbuf[7] = 0; break; } default: return -1; } /* done with EVPD */ assert(buflen - start <= 255); outbuf[start - 1] = buflen - start; return buflen; } /* Standard INQUIRY data */ if (req->cmd.buf[2] != 0) { return -1; } /* PAGE CODE == 0 */ buflen = req->cmd.xfer; if (buflen > SCSI_MAX_INQUIRY_LEN) { buflen = SCSI_MAX_INQUIRY_LEN; } memset(outbuf, 0, buflen); outbuf[0] = s->qdev.type & 0x1f; outbuf[1] = (s->features & (1 << SCSI_DISK_F_REMOVABLE)) ? 0x80 : 0; strpadcpy((char *) &outbuf[16], 16, s->product, ' '); strpadcpy((char *) &outbuf[8], 8, s->vendor, ' '); memset(&outbuf[32], 0, 4); memcpy(&outbuf[32], s->version, MIN(4, strlen(s->version))); /* * We claim conformance to SPC-3, which is required for guests * to ask for modern features like READ CAPACITY(16) or the * block characteristics VPD page by default. Not all of SPC-3 * is actually implemented, but we're good enough. */ outbuf[2] = 5; outbuf[3] = 2 | 0x10; /* Format 2, HiSup */ if (buflen > 36) { outbuf[4] = buflen - 5; /* Additional Length = (Len - 1) - 4 */ } else { /* If the allocation length of CDB is too small, the additional length is not adjusted */ outbuf[4] = 36 - 5; } /* Sync data transfer and TCQ. */ outbuf[7] = 0x10 | (req->bus->info->tcq ? 0x02 : 0); return buflen; }","Yes, it is vulnerable."855853,"static void vmd_decode(VmdVideoContext *s) { int i; unsigned int *palette32; unsigned char r, g, b; /* point to the start of the encoded data */ const unsigned char *p = s->buf + 16; const unsigned char *pb; unsigned char meth; unsigned char *dp; /* pointer to current frame */ unsigned char *pp; /* pointer to previous frame */ unsigned char len; int ofs; int frame_x, frame_y; int frame_width, frame_height; frame_x = AV_RL16(&s->buf[6]); frame_y = AV_RL16(&s->buf[8]); frame_width = AV_RL16(&s->buf[10]) - frame_x + 1; frame_height = AV_RL16(&s->buf[12]) - frame_y + 1; if (frame_x < 0 || frame_width < 0 || frame_x >= s->avctx->width || frame_width > s->avctx->width || frame_x + frame_width > s->avctx->width) return; if (frame_y < 0 || frame_height < 0 || frame_y >= s->avctx->height || frame_height > s->avctx->height || frame_y + frame_height > s->avctx->height) return; if ((frame_width == s->avctx->width && frame_height == s->avctx->height) && (frame_x || frame_y)) { s->x_off = frame_x; s->y_off = frame_y; } frame_x -= s->x_off; frame_y -= s->y_off; /* if only a certain region will be updated, copy the entire previous * frame before the decode */ if (s->prev_frame.data[0] && (frame_x || frame_y || (frame_width != s->avctx->width) || (frame_height != s->avctx->height))) { memcpy(s->frame.data[0], s->prev_frame.data[0], s->avctx->height * s->frame.linesize[0]); } /* check if there is a new palette */ if (s->buf[15] & 0x02) { p += 2; palette32 = (unsigned int *)s->palette; for (i = 0; i < PALETTE_COUNT; i++) { r = *p++ * 4; g = *p++ * 4; b = *p++ * 4; palette32[i] = (r << 16) | (g << 8) | (b); } s->size -= (256 * 3 + 2); } if (s->size >= 0) { /* originally UnpackFrame in VAG's code */ pb = p; meth = *pb++; if (meth & 0x80) { lz_unpack(pb, s->unpack_buffer, s->unpack_buffer_size); meth &= 0x7F; pb = s->unpack_buffer; } dp = &s->frame.data[0][frame_y * s->frame.linesize[0] + frame_x]; pp = &s->prev_frame.data[0][frame_y * s->prev_frame.linesize[0] + frame_x]; switch (meth) { case 1: for (i = 0; i < frame_height; i++) { ofs = 0; do { len = *pb++; if (len & 0x80) { len = (len & 0x7F) + 1; if (ofs + len > frame_width) return; memcpy(&dp[ofs], pb, len); pb += len; ofs += len; } else { /* interframe pixel copy */ if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) return; memcpy(&dp[ofs], &pp[ofs], len + 1); ofs += len + 1; } } while (ofs < frame_width); if (ofs > frame_width) { av_log(s->avctx, AV_LOG_ERROR, ""VMD video: offset > width (%d > %d)\n"", ofs, frame_width); break; } dp += s->frame.linesize[0]; pp += s->prev_frame.linesize[0]; } break; case 2: for (i = 0; i < frame_height; i++) { memcpy(dp, pb, frame_width); pb += frame_width; dp += s->frame.linesize[0]; pp += s->prev_frame.linesize[0]; } break; case 3: for (i = 0; i < frame_height; i++) { ofs = 0; do { len = *pb++; if (len & 0x80) { len = (len & 0x7F) + 1; if (*pb++ == 0xFF) len = rle_unpack(pb, &dp[ofs], len, frame_width - ofs); else memcpy(&dp[ofs], pb, len); pb += len; ofs += len; } else { /* interframe pixel copy */ if (ofs + len + 1 > frame_width || !s->prev_frame.data[0]) return; memcpy(&dp[ofs], &pp[ofs], len + 1); ofs += len + 1; } } while (ofs < frame_width); if (ofs > frame_width) { av_log(s->avctx, AV_LOG_ERROR, ""VMD video: offset > width (%d > %d)\n"", ofs, frame_width); } dp += s->frame.linesize[0]; pp += s->prev_frame.linesize[0]; } break; } } }","Yes, it is vulnerable."856854,"static int unin_agp_pci_host_init(PCIDevice *d) { pci_config_set_vendor_id(d->config, PCI_VENDOR_ID_APPLE); pci_config_set_device_id(d->config, PCI_DEVICE_ID_APPLE_UNI_N_AGP); d->config[0x08] = 0x00; // revision pci_config_set_class(d->config, PCI_CLASS_BRIDGE_HOST); d->config[0x0C] = 0x08; // cache_line_size d->config[0x0D] = 0x10; // latency_timer // d->config[0x34] = 0x80; // capabilities_pointer return 0; }","No, it is non-vulnerable."857855,"static void float_number(void) { int i; struct { const char *encoded; double decoded; int skip; } test_cases[] = { { ""32.43"", 32.43 }, { ""0.222"", 0.222 }, { ""-32.12313"", -32.12313 }, { ""-32.20e-10"", -32.20e-10, .skip = 1 }, { }, }; for (i = 0; test_cases[i].encoded; i++) { QObject *obj; QFloat *qfloat; obj = qobject_from_json(test_cases[i].encoded); g_assert(obj != NULL); g_assert(qobject_type(obj) == QTYPE_QFLOAT); qfloat = qobject_to_qfloat(obj); g_assert(qfloat_get_double(qfloat) == test_cases[i].decoded); if (test_cases[i].skip == 0) { QString *str; str = qobject_to_json(obj); g_assert(strcmp(qstring_get_str(str), test_cases[i].encoded) == 0); QDECREF(str); } QDECREF(qfloat); } }","No, it is non-vulnerable."858856,"static void colo_process_checkpoint(MigrationState *s) { QIOChannelBuffer *bioc; QEMUFile *fb = NULL; int64_t current_time, checkpoint_time = qemu_clock_get_ms(QEMU_CLOCK_HOST); Error *local_err = NULL; int ret; failover_init_state(); s->rp_state.from_dst_file = qemu_file_get_return_path(s->to_dst_file); if (!s->rp_state.from_dst_file) { error_report(""Open QEMUFile from_dst_file failed""); goto out; } /* * Wait for Secondary finish loading VM states and enter COLO * restore. */ colo_receive_check_message(s->rp_state.from_dst_file, COLO_MESSAGE_CHECKPOINT_READY, &local_err); if (local_err) { goto out; } bioc = qio_channel_buffer_new(COLO_BUFFER_BASE_SIZE); fb = qemu_fopen_channel_output(QIO_CHANNEL(bioc)); object_unref(OBJECT(bioc)); qemu_mutex_lock_iothread(); vm_start(); qemu_mutex_unlock_iothread(); trace_colo_vm_state_change(""stop"", ""run""); while (s->state == MIGRATION_STATUS_COLO) { if (failover_get_state() != FAILOVER_STATUS_NONE) { error_report(""failover request""); goto out; } current_time = qemu_clock_get_ms(QEMU_CLOCK_HOST); if (current_time - checkpoint_time < s->parameters.x_checkpoint_delay) { int64_t delay_ms; delay_ms = s->parameters.x_checkpoint_delay - (current_time - checkpoint_time); g_usleep(delay_ms * 1000); } ret = colo_do_checkpoint_transaction(s, bioc, fb); if (ret < 0) { goto out; } checkpoint_time = qemu_clock_get_ms(QEMU_CLOCK_HOST); } out: /* Throw the unreported error message after exited from loop */ if (local_err) { error_report_err(local_err); } if (fb) { qemu_fclose(fb); } if (s->rp_state.from_dst_file) { qemu_fclose(s->rp_state.from_dst_file); } }","No, it is non-vulnerable."859857,"static void ecc_mem_write(void *opaque, target_phys_addr_t addr, uint64_t val, unsigned size) { ECCState *s = opaque; switch (addr >> 2) { case ECC_MER: if (s->version == ECC_MCC) s->regs[ECC_MER] = (val & ECC_MER_MASK_0); else if (s->version == ECC_EMC) s->regs[ECC_MER] = s->version | (val & ECC_MER_MASK_1); else if (s->version == ECC_SMC) s->regs[ECC_MER] = s->version | (val & ECC_MER_MASK_2); trace_ecc_mem_writel_mer(val); break; case ECC_MDR: s->regs[ECC_MDR] = val & ECC_MDR_MASK; trace_ecc_mem_writel_mdr(val); break; case ECC_MFSR: s->regs[ECC_MFSR] = val; qemu_irq_lower(s->irq); trace_ecc_mem_writel_mfsr(val); break; case ECC_VCR: s->regs[ECC_VCR] = val; trace_ecc_mem_writel_vcr(val); break; case ECC_DR: s->regs[ECC_DR] = val; trace_ecc_mem_writel_dr(val); break; case ECC_ECR0: s->regs[ECC_ECR0] = val; trace_ecc_mem_writel_ecr0(val); break; case ECC_ECR1: s->regs[ECC_ECR0] = val; trace_ecc_mem_writel_ecr1(val); break; } }","No, it is non-vulnerable."860858,"static void gen_op_mull_T0_T1(void) { TCGv tmp1 = tcg_temp_new(TCG_TYPE_I64); TCGv tmp2 = tcg_temp_new(TCG_TYPE_I64); tcg_gen_extu_i32_i64(tmp1, cpu_T[0]); tcg_gen_extu_i32_i64(tmp2, cpu_T[1]); tcg_gen_mul_i64(tmp1, tmp1, tmp2); tcg_gen_trunc_i64_i32(cpu_T[0], tmp1); tcg_gen_shri_i64(tmp1, tmp1, 32); tcg_gen_trunc_i64_i32(cpu_T[1], tmp1); }","No, it is non-vulnerable."861859,"static int get_stats(AVCodecContext *avctx, int eos) { #ifdef TH_ENCCTL_2PASS_OUT TheoraContext *h = avctx->priv_data; uint8_t *buf; int bytes; bytes = th_encode_ctl(h->t_state, TH_ENCCTL_2PASS_OUT, &buf, sizeof(buf)); if (bytes < 0) { av_log(avctx, AV_LOG_ERROR, ""Error getting first pass stats\n""); return AVERROR_EXTERNAL; } if (!eos) { void *tmp = av_fast_realloc(h->stats, &h->stats_size, h->stats_offset + bytes); if (!tmp) h->stats = tmp; memcpy(h->stats + h->stats_offset, buf, bytes); h->stats_offset += bytes; } else { int b64_size = AV_BASE64_SIZE(h->stats_offset); // libtheora generates a summary header at the end memcpy(h->stats, buf, bytes); avctx->stats_out = av_malloc(b64_size); av_base64_encode(avctx->stats_out, b64_size, h->stats, h->stats_offset); } return 0; #else av_log(avctx, AV_LOG_ERROR, ""libtheora too old to support 2pass\n""); return AVERROR(ENOSUP); #endif }","Yes, it is vulnerable."862860,"static int allocate_buffers(ALACContext *alac) { int ch; int buf_size = alac->max_samples_per_frame * sizeof(int32_t); for (ch = 0; ch < FFMIN(alac->channels, 2); ch++) { FF_ALLOC_OR_GOTO(alac->avctx, alac->predict_error_buffer[ch], buf_size, buf_alloc_fail); alac->direct_output = alac->sample_size > 16 && av_sample_fmt_is_planar(alac->avctx->sample_fmt); if (!alac->direct_output) { FF_ALLOC_OR_GOTO(alac->avctx, alac->output_samples_buffer[ch], buf_size, buf_alloc_fail); } FF_ALLOC_OR_GOTO(alac->avctx, alac->extra_bits_buffer[ch], buf_size, buf_alloc_fail); } return 0; buf_alloc_fail: alac_decode_close(alac->avctx); return AVERROR(ENOMEM); }","Yes, it is vulnerable."863861,"static av_cold int iss_read_header(AVFormatContext *s) { IssDemuxContext *iss = s->priv_data; AVIOContext *pb = s->pb; AVStream *st; char token[MAX_TOKEN_SIZE]; int stereo, rate_divisor; get_token(pb, token, sizeof(token)); //""IMA_ADPCM_Sound"" get_token(pb, token, sizeof(token)); //packet size sscanf(token, ""%d"", &iss->packet_size); get_token(pb, token, sizeof(token)); //File ID get_token(pb, token, sizeof(token)); //out size get_token(pb, token, sizeof(token)); //stereo sscanf(token, ""%d"", &stereo); get_token(pb, token, sizeof(token)); //Unknown1 get_token(pb, token, sizeof(token)); //RateDivisor sscanf(token, ""%d"", &rate_divisor); get_token(pb, token, sizeof(token)); //Unknown2 get_token(pb, token, sizeof(token)); //Version ID get_token(pb, token, sizeof(token)); //Size if (iss->packet_size <= 0) { av_log(s, AV_LOG_ERROR, ""packet_size %d is invalid\n"", iss->packet_size); return AVERROR_INVALIDDATA; } iss->sample_start_pos = avio_tell(pb); st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); st->codec->codec_type = AVMEDIA_TYPE_AUDIO; st->codec->codec_id = AV_CODEC_ID_ADPCM_IMA_ISS; if (stereo) { st->codec->channels = 2; st->codec->channel_layout = AV_CH_LAYOUT_STEREO; } else { st->codec->channels = 1; st->codec->channel_layout = AV_CH_LAYOUT_MONO; } st->codec->sample_rate = 44100; if(rate_divisor > 0) st->codec->sample_rate /= rate_divisor; st->codec->bits_per_coded_sample = 4; st->codec->bit_rate = st->codec->channels * st->codec->sample_rate * st->codec->bits_per_coded_sample; st->codec->block_align = iss->packet_size; avpriv_set_pts_info(st, 32, 1, st->codec->sample_rate); return 0; }","Yes, it is vulnerable."864862,void do_subfco (void) { T2 = T0; T0 = T1 - T0; if (likely(T0 > T1)) { xer_ca = 0; } else { xer_ca = 1; } if (likely(!(((~T2) ^ T1 ^ (-1)) & ((~T2) ^ T0) & (1 << 31)))) { xer_ov = 0; } else { xer_so = 1; xer_ov = 1; } },"Yes, it is vulnerable."865863,"static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeCmd *cmd) { NvmeDeleteQ *c = (NvmeDeleteQ *)cmd; NvmeRequest *req, *next; NvmeSQueue *sq; NvmeCQueue *cq; uint16_t qid = le16_to_cpu(c->qid); if (!qid || nvme_check_sqid(n, qid)) { return NVME_INVALID_QID | NVME_DNR; } sq = n->sq[qid]; while (!QTAILQ_EMPTY(&sq->out_req_list)) { req = QTAILQ_FIRST(&sq->out_req_list); assert(req->aiocb); blk_aio_cancel(req->aiocb); } if (!nvme_check_cqid(n, sq->cqid)) { cq = n->cq[sq->cqid]; QTAILQ_REMOVE(&cq->sq_list, sq, entry); nvme_post_cqes(cq); QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next) { if (req->sq == sq) { QTAILQ_REMOVE(&cq->req_list, req, entry); QTAILQ_INSERT_TAIL(&sq->req_list, req, entry); } } } nvme_free_sq(sq, n); return NVME_SUCCESS; }","Yes, it is vulnerable."866864,"static void virtio_scsi_locate_device(VDev *vdev) { const uint16_t channel = 0; /* again, it's what QEMU does */ uint16_t target; static uint8_t data[16 + 8 * 63]; ScsiLunReport *r = (void *) data; ScsiDevice *sdev = vdev->scsi_device; int i, luns; /* QEMU has hardcoded channel #0 in many places. * If this hardcoded value is ever changed, we'll need to add code for * vdev->config.scsi.max_channel != 0 here. */ debug_print_int(""config.scsi.max_channel"", vdev->config.scsi.max_channel); debug_print_int(""config.scsi.max_target "", vdev->config.scsi.max_target); debug_print_int(""config.scsi.max_lun "", vdev->config.scsi.max_lun); debug_print_int(""config.scsi.max_sectors"", vdev->config.scsi.max_sectors); if (vdev->scsi_device_selected) { sdev->channel = vdev->selected_scsi_device.channel; sdev->target = vdev->selected_scsi_device.target; sdev->lun = vdev->selected_scsi_device.lun; IPL_check(sdev->channel == 0, ""non-zero channel requested""); IPL_check(sdev->target <= vdev->config.scsi.max_target, ""target# high""); IPL_check(sdev->lun <= vdev->config.scsi.max_lun, ""LUN# high""); return; } for (target = 0; target <= vdev->config.scsi.max_target; target++) { sdev->channel = channel; sdev->target = target; /* sdev->lun will be 0 here */ if (!scsi_report_luns(vdev, data, sizeof(data))) { if (resp.response == VIRTIO_SCSI_S_BAD_TARGET) { continue; } print_int(""target"", target); virtio_scsi_verify_response(&resp, ""SCSI cannot report LUNs""); } if (r->lun_list_len == 0) { print_int(""no LUNs for target"", target); continue; } luns = r->lun_list_len / 8; debug_print_int(""LUNs reported"", luns); if (luns == 1) { /* There is no "",lun=#"" arg for -device or "",lun=0"" given. * Hence, the only LUN reported. * Usually, it's 0. */ sdev->lun = r->lun[0].v16[0]; /* it's returned this way */ debug_print_int(""Have to use LUN"", sdev->lun); return; /* we have to use this device */ } for (i = 0; i < luns; i++) { if (r->lun[i].v64) { /* Look for non-zero LUN - we have where to choose from */ sdev->lun = r->lun[i].v16[0]; debug_print_int(""Will use LUN"", sdev->lun); return; /* we have found a device */ } } } panic(""\n! Cannot locate virtio-scsi device !\n""); }","Yes, it is vulnerable."867865,"static void qcow2_aio_read_cb(void *opaque, int ret) { QCowAIOCB *acb = opaque; BlockDriverState *bs = acb->common.bs; BDRVQcowState *s = bs->opaque; int index_in_cluster, n1; acb->hd_aiocb = NULL; if (ret < 0) goto done; /* post process the read buffer */ if (!acb->cluster_offset) { /* nothing to do */ } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) { /* nothing to do */ } else { if (s->crypt_method) { qcow2_encrypt_sectors(s, acb->sector_num, acb->cluster_data, acb->cluster_data, acb->cur_nr_sectors, 0, &s->aes_decrypt_key); qemu_iovec_reset(&acb->hd_qiov); qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done, acb->cur_nr_sectors * 512); qemu_iovec_from_buffer(&acb->hd_qiov, acb->cluster_data, 512 * acb->cur_nr_sectors); } } acb->remaining_sectors -= acb->cur_nr_sectors; acb->sector_num += acb->cur_nr_sectors; acb->bytes_done += acb->cur_nr_sectors * 512; if (acb->remaining_sectors == 0) { /* request completed */ ret = 0; goto done; } /* prepare next AIO request */ acb->cur_nr_sectors = acb->remaining_sectors; if (s->crypt_method) { acb->cur_nr_sectors = MIN(acb->cur_nr_sectors, QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors); } ret = qcow2_get_cluster_offset(bs, acb->sector_num << 9, &acb->cur_nr_sectors, &acb->cluster_offset); if (ret < 0) { goto done; } index_in_cluster = acb->sector_num & (s->cluster_sectors - 1); qemu_iovec_reset(&acb->hd_qiov); qemu_iovec_copy(&acb->hd_qiov, acb->qiov, acb->bytes_done, acb->cur_nr_sectors * 512); if (!acb->cluster_offset) { if (bs->backing_hd) { /* read from the base image */ n1 = qcow2_backing_read1(bs->backing_hd, &acb->hd_qiov, acb->sector_num, acb->cur_nr_sectors); if (n1 > 0) { BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO); acb->hd_aiocb = bdrv_aio_readv(bs->backing_hd, acb->sector_num, &acb->hd_qiov, acb->cur_nr_sectors, qcow2_aio_read_cb, acb); if (acb->hd_aiocb == NULL) goto done; } else { ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb); if (ret < 0) goto done; } } else { /* Note: in this case, no need to wait */ qemu_iovec_memset(&acb->hd_qiov, 0, 512 * acb->cur_nr_sectors); ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb); if (ret < 0) goto done; } } else if (acb->cluster_offset & QCOW_OFLAG_COMPRESSED) { /* add AIO support for compressed blocks ? */ if (qcow2_decompress_cluster(bs, acb->cluster_offset) < 0) goto done; qemu_iovec_from_buffer(&acb->hd_qiov, s->cluster_cache + index_in_cluster * 512, 512 * acb->cur_nr_sectors); ret = qcow2_schedule_bh(qcow2_aio_read_bh, acb); if (ret < 0) goto done; } else { if ((acb->cluster_offset & 511) != 0) { ret = -EIO; goto done; } if (s->crypt_method) { /* * For encrypted images, read everything into a temporary * contiguous buffer on which the AES functions can work. */ if (!acb->cluster_data) { acb->cluster_data = qemu_mallocz(QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size); } assert(acb->cur_nr_sectors <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_sectors); qemu_iovec_reset(&acb->hd_qiov); qemu_iovec_add(&acb->hd_qiov, acb->cluster_data, 512 * acb->cur_nr_sectors); } BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO); acb->hd_aiocb = bdrv_aio_readv(bs->file, (acb->cluster_offset >> 9) + index_in_cluster, &acb->hd_qiov, acb->cur_nr_sectors, qcow2_aio_read_cb, acb); if (acb->hd_aiocb == NULL) { ret = -EIO; goto done; } } return; done: acb->common.cb(acb->common.opaque, ret); qemu_iovec_destroy(&acb->hd_qiov); qemu_aio_release(acb); }","Yes, it is vulnerable."868866,"static int mmsh_open(URLContext *h, const char *uri, int flags) { int i, port, err; char httpname[256], path[256], host[128], location[1024]; char *stream_selection; char headers[1024]; MMSHContext *mmsh; MMSContext *mms; mmsh = h->priv_data = av_mallocz(sizeof(MMSHContext)); if (!h->priv_data) return AVERROR(ENOMEM); mmsh->request_seq = h->is_streamed = 1; mms = &mmsh->mms; av_strlcpy(location, uri, sizeof(location)); av_url_split(NULL, 0, NULL, 0, host, sizeof(host), &port, path, sizeof(path), location); if (port<0) port = 80; // default mmsh protocol port ff_url_join(httpname, sizeof(httpname), ""http"", NULL, host, port, path); if (url_alloc(&mms->mms_hd, httpname, URL_RDONLY) < 0) { return AVERROR(EIO); } snprintf(headers, sizeof(headers), ""Accept: */*\r\n"" USERAGENT ""Host: %s:%d\r\n"" ""Pragma: no-cache,rate=1.000000,stream-time=0,"" ""stream-offset=0:0,request-context=%u,max-duration=0\r\n"" CLIENTGUID ""Connection: Close\r\n\r\n"", host, port, mmsh->request_seq++); ff_http_set_headers(mms->mms_hd, headers); err = url_connect(mms->mms_hd); if (err) { goto fail; } err = get_http_header_data(mmsh); if (err) { av_log(NULL, AV_LOG_ERROR, ""Get http header data failed!\n""); goto fail; } // close the socket and then reopen it for sending the second play request. url_close(mms->mms_hd); memset(headers, 0, sizeof(headers)); if (url_alloc(&mms->mms_hd, httpname, URL_RDONLY) < 0) { return AVERROR(EIO); } stream_selection = av_mallocz(mms->stream_num * 19 + 1); if (!stream_selection) return AVERROR(ENOMEM); for (i = 0; i < mms->stream_num; i++) { char tmp[20]; err = snprintf(tmp, sizeof(tmp), ""ffff:%d:0 "", mms->streams[i].id); if (err < 0) goto fail; av_strlcat(stream_selection, tmp, mms->stream_num * 19 + 1); } // send play request err = snprintf(headers, sizeof(headers), ""Accept: */*\r\n"" USERAGENT ""Host: %s:%d\r\n"" ""Pragma: no-cache,rate=1.000000,request-context=%u\r\n"" ""Pragma: xPlayStrm=1\r\n"" CLIENTGUID ""Pragma: stream-switch-count=%d\r\n"" ""Pragma: stream-switch-entry=%s\r\n"" ""Connection: Close\r\n\r\n"", host, port, mmsh->request_seq++, mms->stream_num, stream_selection); av_freep(&stream_selection); if (err < 0) { av_log(NULL, AV_LOG_ERROR, ""Build play request failed!\n""); goto fail; } dprintf(NULL, ""out_buffer is %s"", headers); ff_http_set_headers(mms->mms_hd, headers); err = url_connect(mms->mms_hd); if (err) { goto fail; } err = get_http_header_data(mmsh); if (err) { av_log(NULL, AV_LOG_ERROR, ""Get http header data failed!\n""); goto fail; } dprintf(NULL, ""Connection successfully open\n""); return 0; fail: av_freep(&stream_selection); mmsh_close(h); dprintf(NULL, ""Connection failed with error %d\n"", err); return err; }","Yes, it is vulnerable."869867,"static void t_gen_btst(TCGv d, TCGv a, TCGv b) { TCGv sbit; TCGv bset; TCGv t0; int l1; /* des ref: The N flag is set according to the selected bit in the dest reg. The Z flag is set if the selected bit and all bits to the right are zero. The X flag is cleared. Other flags are left untouched. The destination reg is not affected. unsigned int fz, sbit, bset, mask, masked_t0; sbit = T1 & 31; bset = !!(T0 & (1 << sbit)); mask = sbit == 31 ? -1 : (1 << (sbit + 1)) - 1; masked_t0 = T0 & mask; fz = !(masked_t0 | bset); // Clear the X, N and Z flags. T0 = env->pregs[PR_CCS] & ~(X_FLAG | N_FLAG | Z_FLAG); // Set the N and Z flags accordingly. T0 |= (bset << 3) | (fz << 2); */ l1 = gen_new_label(); sbit = tcg_temp_new(TCG_TYPE_TL); bset = tcg_temp_new(TCG_TYPE_TL); t0 = tcg_temp_new(TCG_TYPE_TL); /* Compute bset and sbit. */ tcg_gen_andi_tl(sbit, b, 31); tcg_gen_shl_tl(t0, tcg_const_tl(1), sbit); tcg_gen_and_tl(bset, a, t0); tcg_gen_shr_tl(bset, bset, sbit); /* Displace to N_FLAG. */ tcg_gen_shli_tl(bset, bset, 3); tcg_gen_shl_tl(sbit, tcg_const_tl(2), sbit); tcg_gen_subi_tl(sbit, sbit, 1); tcg_gen_and_tl(sbit, a, sbit); tcg_gen_andi_tl(d, cpu_PR[PR_CCS], ~(X_FLAG | N_FLAG | Z_FLAG)); /* or in the N_FLAG. */ tcg_gen_or_tl(d, d, bset); tcg_gen_brcondi_tl(TCG_COND_NE, sbit, 0, l1); /* or in the Z_FLAG. */ tcg_gen_ori_tl(d, d, Z_FLAG); gen_set_label(l1); tcg_temp_free(sbit); tcg_temp_free(bset); }","No, it is non-vulnerable."870868,"read_f(int argc, char **argv) { struct timeval t1, t2; int Cflag = 0, pflag = 0, qflag = 0, vflag = 0; int Pflag = 0, sflag = 0, lflag = 0, bflag = 0; int c, cnt; char *buf; int64_t offset; int count; /* Some compilers get confused and warn if this is not initialized. */ int total = 0; int pattern = 0, pattern_offset = 0, pattern_count = 0; while ((c = getopt(argc, argv, ""bCl:pP:qs:v"")) != EOF) { switch (c) { case 'b': bflag = 1; break; case 'C': Cflag = 1; break; case 'l': lflag = 1; pattern_count = cvtnum(optarg); if (pattern_count < 0) { printf(""non-numeric length argument -- %s\n"", optarg); return 0; } break; case 'p': pflag = 1; break; case 'P': Pflag = 1; pattern = atoi(optarg); break; case 'q': qflag = 1; break; case 's': sflag = 1; pattern_offset = cvtnum(optarg); if (pattern_offset < 0) { printf(""non-numeric length argument -- %s\n"", optarg); return 0; } break; case 'v': vflag = 1; break; default: return command_usage(&read_cmd); } } if (optind != argc - 2) return command_usage(&read_cmd); if (bflag && pflag) { printf(""-b and -p cannot be specified at the same time\n""); return 0; } offset = cvtnum(argv[optind]); if (offset < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } optind++; count = cvtnum(argv[optind]); if (count < 0) { printf(""non-numeric length argument -- %s\n"", argv[optind]); return 0; } if (!Pflag && (lflag || sflag)) { return command_usage(&read_cmd); } if (!lflag) { pattern_count = count - pattern_offset; } if ((pattern_count < 0) || (pattern_count + pattern_offset > count)) { printf(""pattern verfication range exceeds end of read data\n""); return 0; } if (!pflag) if (offset & 0x1ff) { printf(""offset %lld is not sector aligned\n"", (long long)offset); return 0; if (count & 0x1ff) { printf(""count %d is not sector aligned\n"", count); return 0; } } buf = qemu_io_alloc(count, 0xab); gettimeofday(&t1, NULL); if (pflag) cnt = do_pread(buf, offset, count, &total); else if (bflag) cnt = do_load_vmstate(buf, offset, count, &total); else cnt = do_read(buf, offset, count, &total); gettimeofday(&t2, NULL); if (cnt < 0) { printf(""read failed: %s\n"", strerror(-cnt)); goto out; } if (Pflag) { void* cmp_buf = malloc(pattern_count); memset(cmp_buf, pattern, pattern_count); if (memcmp(buf + pattern_offset, cmp_buf, pattern_count)) { printf(""Pattern verification failed at offset %lld, "" ""%d bytes\n"", (long long) offset + pattern_offset, pattern_count); } free(cmp_buf); } if (qflag) goto out; if (vflag) dump_buffer(buf, offset, count); /* Finally, report back -- -C gives a parsable format */ t2 = tsub(t2, t1); print_report(""read"", &t2, offset, count, total, cnt, Cflag); out: qemu_io_free(buf); return 0; }","No, it is non-vulnerable."871869,"int ff_network_init(void) { #if HAVE_WINSOCK2_H WSADATA wsaData; #endif if (!ff_network_inited_globally) av_log(NULL, AV_LOG_WARNING, ""Using network protocols without global "" ""network initialization. Please use "" ""avformat_network_init(), this will "" ""become mandatory later.\n""); #if HAVE_WINSOCK2_H if (WSAStartup(MAKEWORD(1,1), &wsaData)) return 0; #endif return 1; }","No, it is non-vulnerable."872870,"static int handle_connect_error(URLContext *s, const char *desc) { RTMPContext *rt = s->priv_data; char buf[300], *ptr, authmod[15]; int i = 0, ret = 0; const char *user = """", *salt = """", *opaque = NULL, *challenge = NULL, *cptr = NULL, *nonce = NULL; if (!(cptr = strstr(desc, ""authmod=adobe"")) && !(cptr = strstr(desc, ""authmod=llnw""))) { av_log(s, AV_LOG_ERROR, ""Unknown connect error (unsupported authentication method?)\n""); return AVERROR_UNKNOWN; } cptr += strlen(""authmod=""); while (*cptr && *cptr != ' ' && i < sizeof(authmod) - 1) authmod[i++] = *cptr++; authmod[i] = '\0'; if (!rt->username[0] || !rt->password[0]) { av_log(s, AV_LOG_ERROR, ""No credentials set\n""); return AVERROR_UNKNOWN; } if (strstr(desc, ""?reason=authfailed"")) { av_log(s, AV_LOG_ERROR, ""Incorrect username/password\n""); return AVERROR_UNKNOWN; } else if (strstr(desc, ""?reason=nosuchuser"")) { av_log(s, AV_LOG_ERROR, ""Incorrect username\n""); return AVERROR_UNKNOWN; } if (rt->auth_tried) { av_log(s, AV_LOG_ERROR, ""Authentication failed\n""); return AVERROR_UNKNOWN; } rt->auth_params[0] = '\0'; if (strstr(desc, ""code=403 need auth"")) { snprintf(rt->auth_params, sizeof(rt->auth_params), ""?authmod=%s&user=%s"", authmod, rt->username); return 0; } if (!(cptr = strstr(desc, ""?reason=needauth""))) { av_log(s, AV_LOG_ERROR, ""No auth parameters found\n""); return AVERROR_UNKNOWN; } av_strlcpy(buf, cptr + 1, sizeof(buf)); ptr = buf; while (ptr) { char *next = strchr(ptr, '&'); char *value = strchr(ptr, '='); if (next) *next++ = '\0'; if (value) *value++ = '\0'; if (!strcmp(ptr, ""user"")) { user = value; } else if (!strcmp(ptr, ""salt"")) { salt = value; } else if (!strcmp(ptr, ""opaque"")) { opaque = value; } else if (!strcmp(ptr, ""challenge"")) { challenge = value; } else if (!strcmp(ptr, ""nonce"")) { nonce = value; } ptr = next; } if (!strcmp(authmod, ""adobe"")) { if ((ret = do_adobe_auth(rt, user, salt, opaque, challenge)) < 0) return ret; } else { if ((ret = do_llnw_auth(rt, user, nonce)) < 0) return ret; } rt->auth_tried = 1; return 0; }","Yes, it is vulnerable."873871,"static int jacosub_probe(AVProbeData *p) { const char *ptr = p->buf; const char *ptr_end = p->buf + p->buf_size; if (AV_RB24(ptr) == 0xEFBBBF) ptr += 3; /* skip UTF-8 BOM */ while (ptr < ptr_end) { while (jss_whitespace(*ptr)) ptr++; if (*ptr != '#' && *ptr != '\n') { if (timed_line(ptr)) return AVPROBE_SCORE_EXTENSION + 1; return 0; } ptr += strcspn(ptr, ""\n"") + 1; } return 0; }","Yes, it is vulnerable."874872,"static void vp6_parse_coeff(VP56Context *s) { VP56RangeCoder *c = s->ccp; VP56Model *model = s->modelp; uint8_t *permute = s->scantable.permutated; uint8_t *model1, *model2, *model3; int coeff, sign, coeff_idx; int b, i, cg, idx, ctx; int pt = 0; /* plane type (0 for Y, 1 for U or V) */ for (b=0; b<6; b++) { int ct = 1; /* code type */ int run = 1; if (b > 3) pt = 1; ctx = s->left_block[vp56_b6to4[b]].not_null_dc + s->above_blocks[s->above_block_idx[b]].not_null_dc; model1 = model->coeff_dccv[pt]; model2 = model->coeff_dcct[pt][ctx]; for (coeff_idx=0; coeff_idx<64; ) { if ((coeff_idx>1 && ct==0) || vp56_rac_get_prob(c, model2[0])) { /* parse a coeff */ if (vp56_rac_get_prob(c, model2[2])) { if (vp56_rac_get_prob(c, model2[3])) { idx = vp56_rac_get_tree(c, vp56_pc_tree, model1); coeff = vp56_coeff_bias[idx+5]; for (i=vp56_coeff_bit_length[idx]; i>=0; i--) coeff += vp56_rac_get_prob(c, vp56_coeff_parse_table[idx][i]) << i; } else { if (vp56_rac_get_prob(c, model2[4])) coeff = 3 + vp56_rac_get_prob(c, model1[5]); else coeff = 2; } ct = 2; } else { ct = 1; coeff = 1; } sign = vp56_rac_get(c); coeff = (coeff ^ -sign) + sign; if (coeff_idx) coeff *= s->dequant_ac; idx = model->coeff_index_to_pos[coeff_idx]; s->block_coeff[b][permute[idx]] = coeff; run = 1; } else { /* parse a run */ ct = 0; if (coeff_idx > 0) { if (!vp56_rac_get_prob(c, model2[1])) break; model3 = model->coeff_runv[coeff_idx >= 6]; run = vp56_rac_get_tree(c, vp6_pcr_tree, model3); if (!run) for (run=9, i=0; i<6; i++) run += vp56_rac_get_prob(c, model3[i+8]) << i; } } cg = vp6_coeff_groups[coeff_idx+=run]; model1 = model2 = model->coeff_ract[pt][ct][cg]; } s->left_block[vp56_b6to4[b]].not_null_dc = s->above_blocks[s->above_block_idx[b]].not_null_dc = !!s->block_coeff[b][0]; } }","Yes, it is vulnerable."875873,"static void test_parse_path(void) { g_test_trap_subprocess (""/logging/parse_path/subprocess"", 0, 0); g_test_trap_assert_passed(); g_test_trap_assert_stdout(""""); g_test_trap_assert_stderr(""""); }","Yes, it is vulnerable."876874,"int floatx80_unordered(floatx80 a, floatx80 b, float_status *status) { if ( ( ( extractFloatx80Exp( a ) == 0x7FFF ) && (uint64_t) ( extractFloatx80Frac( a )<<1 ) ) || ( ( extractFloatx80Exp( b ) == 0x7FFF ) && (uint64_t) ( extractFloatx80Frac( b )<<1 ) ) ) { float_raise(float_flag_invalid, status); return 1; } return 0; }","No, it is non-vulnerable."877875,"static void usbredir_do_attach(void *opaque) { USBRedirDevice *dev = opaque; /* In order to work properly with XHCI controllers we need these caps */ if ((dev->dev.port->speedmask & USB_SPEED_MASK_SUPER) && !( usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_ep_info_max_packet_size) && usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_32bits_bulk_length) && usbredirparser_peer_has_cap(dev->parser, usb_redir_cap_64bits_ids))) { ERROR(""usb-redir-host lacks capabilities needed for use with XHCI\n""); usbredir_reject_device(dev); return; } if (usb_device_attach(&dev->dev) != 0) { WARNING(""rejecting device due to speed mismatch\n""); usbredir_reject_device(dev); } }","No, it is non-vulnerable."878876,"uint64_t helper_fctidz (uint64_t arg) { CPU_DoubleU farg; farg.ll = arg; if (unlikely(float64_is_signaling_nan(farg.d))) { /* sNaN conversion */ farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXSNAN | POWERPC_EXCP_FP_VXCVI); } else if (unlikely(float64_is_nan(farg.d) || float64_is_infinity(farg.d))) { /* qNan / infinity conversion */ farg.ll = fload_invalid_op_excp(POWERPC_EXCP_FP_VXCVI); } else { farg.ll = float64_to_int64_round_to_zero(farg.d, &env->fp_status); } return farg.ll; }","No, it is non-vulnerable."879877,"static void vtd_iommu_notify_flag_changed(MemoryRegion *iommu, IOMMUNotifierFlag old, IOMMUNotifierFlag new) { VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu); if (new & IOMMU_NOTIFIER_MAP) { error_report(""Device at bus %s addr %02x.%d requires iommu "" ""notifier which is currently not supported by "" ""intel-iommu emulation"", vtd_as->bus->qbus.name, PCI_SLOT(vtd_as->devfn), PCI_FUNC(vtd_as->devfn)); exit(1); } }","No, it is non-vulnerable."880878,"static int xen_pt_long_reg_write(XenPCIPassthroughState *s, XenPTReg *cfg_entry, uint32_t *val, uint32_t dev_value, uint32_t valid_mask) { XenPTRegInfo *reg = cfg_entry->reg; uint32_t writable_mask = 0; uint32_t throughable_mask = get_throughable_mask(s, reg, valid_mask); /* modify emulate register */ writable_mask = reg->emu_mask & ~reg->ro_mask & valid_mask; cfg_entry->data = XEN_PT_MERGE_VALUE(*val, cfg_entry->data, writable_mask); /* create value for writing to I/O device register */ *val = XEN_PT_MERGE_VALUE(*val, dev_value, throughable_mask); return 0; }","No, it is non-vulnerable."881879,"coroutine_fn iscsi_co_write_zeroes(BlockDriverState *bs, int64_t sector_num, int nb_sectors, BdrvRequestFlags flags) { IscsiLun *iscsilun = bs->opaque; struct IscsiTask iTask; uint64_t lba; uint32_t nb_blocks; if (!is_request_lun_aligned(sector_num, nb_sectors, iscsilun)) { return -EINVAL; } if (!iscsilun->lbp.lbpws) { /* WRITE SAME is not supported by the target */ return -ENOTSUP; } lba = sector_qemu2lun(sector_num, iscsilun); nb_blocks = sector_qemu2lun(nb_sectors, iscsilun); if (iscsilun->zeroblock == NULL) { iscsilun->zeroblock = g_malloc0(iscsilun->block_size); } iscsi_co_init_iscsitask(iscsilun, &iTask); retry: if (iscsi_writesame16_task(iscsilun->iscsi, iscsilun->lun, lba, iscsilun->zeroblock, iscsilun->block_size, nb_blocks, 0, !!(flags & BDRV_REQ_MAY_UNMAP), 0, 0, iscsi_co_generic_cb, &iTask) == NULL) { return -EIO; } while (!iTask.complete) { iscsi_set_events(iscsilun); qemu_coroutine_yield(); } if (iTask.task != NULL) { scsi_free_scsi_task(iTask.task); iTask.task = NULL; } if (iTask.do_retry) { goto retry; } if (iTask.status != SCSI_STATUS_GOOD) { return -EIO; } return 0; }","Yes, it is vulnerable."882880,"static BlkverifyAIOCB *blkverify_aio_get(BlockDriverState *bs, bool is_write, int64_t sector_num, QEMUIOVector *qiov, int nb_sectors, BlockCompletionFunc *cb, void *opaque) { BlkverifyAIOCB *acb = qemu_aio_get(&blkverify_aiocb_info, bs, cb, opaque); acb->is_write = is_write; acb->sector_num = sector_num; acb->nb_sectors = nb_sectors; acb->ret = -EINPROGRESS; acb->done = 0; acb->qiov = qiov; acb->buf = NULL; acb->verify = NULL; return acb; }","Yes, it is vulnerable."883881,"int av_write_header(AVFormatContext *s) { int ret, i; AVStream *st; // some sanity checks if (s->nb_streams == 0) { av_log(s, AV_LOG_ERROR, ""no streams\n""); return -1; } for(i=0;i<s->nb_streams;i++) { st = s->streams[i]; switch (st->codec->codec_type) { case AVMEDIA_TYPE_AUDIO: if(st->codec->sample_rate<=0){ av_log(s, AV_LOG_ERROR, ""sample rate not set\n""); return -1; } if(!st->codec->block_align) st->codec->block_align = st->codec->channels * av_get_bits_per_sample(st->codec->codec_id) >> 3; break; case AVMEDIA_TYPE_VIDEO: if(st->codec->time_base.num<=0 || st->codec->time_base.den<=0){ //FIXME audio too? av_log(s, AV_LOG_ERROR, ""time base not set\n""); return -1; } if((st->codec->width<=0 || st->codec->height<=0) && !(s->oformat->flags & AVFMT_NODIMENSIONS)){ av_log(s, AV_LOG_ERROR, ""dimensions not set\n""); return -1; } if(av_cmp_q(st->sample_aspect_ratio, st->codec->sample_aspect_ratio)){ av_log(s, AV_LOG_ERROR, ""Aspect ratio mismatch between encoder and muxer layer\n""); return -1; } break; } if(s->oformat->codec_tag){ if(st->codec->codec_tag){ //FIXME //check that tag + id is in the table //if neither is in the table -> OK //if tag is in the table with another id -> FAIL //if id is in the table with another tag -> FAIL unless strict < ? }else st->codec->codec_tag= av_codec_get_tag(s->oformat->codec_tag, st->codec->codec_id); } if(s->oformat->flags & AVFMT_GLOBALHEADER && !(st->codec->flags & CODEC_FLAG_GLOBAL_HEADER)) av_log(s, AV_LOG_WARNING, ""Codec for stream %d does not use global headers but container format requires global headers\n"", i); } if (!s->priv_data && s->oformat->priv_data_size > 0) { s->priv_data = av_mallocz(s->oformat->priv_data_size); if (!s->priv_data) return AVERROR(ENOMEM); } #if LIBAVFORMAT_VERSION_MAJOR < 53 ff_metadata_mux_compat(s); #endif /* set muxer identification string */ if (!(s->streams[0]->codec->flags & CODEC_FLAG_BITEXACT)) { AVMetadata *m; AVMetadataTag *t; if (!(m = av_mallocz(sizeof(AVMetadata)))) return AVERROR(ENOMEM); av_metadata_set2(&m, ""encoder"", LIBAVFORMAT_IDENT, 0); metadata_conv(&m, s->oformat->metadata_conv, NULL); if ((t = av_metadata_get(m, """", NULL, AV_METADATA_IGNORE_SUFFIX))) av_metadata_set2(&s->metadata, t->key, t->value, 0); av_metadata_free(&m); } if(s->oformat->write_header){ ret = s->oformat->write_header(s); if (ret < 0) return ret; } /* init PTS generation */ for(i=0;i<s->nb_streams;i++) { int64_t den = AV_NOPTS_VALUE; st = s->streams[i]; switch (st->codec->codec_type) { case AVMEDIA_TYPE_AUDIO: den = (int64_t)st->time_base.num * st->codec->sample_rate; break; case AVMEDIA_TYPE_VIDEO: den = (int64_t)st->time_base.num * st->codec->time_base.den; break; default: break; } if (den != AV_NOPTS_VALUE) { if (den <= 0) return AVERROR_INVALIDDATA; av_frac_init(&st->pts, 0, 0, den); } } return 0; }","No, it is non-vulnerable."884882,"static int transcode_video(InputStream *ist, AVPacket *pkt, int *got_output, int64_t *pkt_pts) { AVFrame *decoded_frame, *filtered_frame = NULL; void *buffer_to_free = NULL; int i, ret = 0; float quality; #if CONFIG_AVFILTER int frame_available = 1; #endif if (!ist->decoded_frame && !(ist->decoded_frame = avcodec_alloc_frame())) return AVERROR(ENOMEM); else avcodec_get_frame_defaults(ist->decoded_frame); decoded_frame = ist->decoded_frame; pkt->pts = *pkt_pts; pkt->dts = ist->last_dts; *pkt_pts = AV_NOPTS_VALUE; ret = avcodec_decode_video2(ist->st->codec, decoded_frame, got_output, pkt); if (ret < 0) return ret; quality = same_quant ? decoded_frame->quality : 0; if (!*got_output) { /* no picture yet */ return ret; } decoded_frame->pts = guess_correct_pts(&ist->pts_ctx, decoded_frame->pkt_pts, decoded_frame->pkt_dts); pkt->size = 0; pre_process_video_frame(ist, (AVPicture *)decoded_frame, &buffer_to_free); rate_emu_sleep(ist); for (i = 0; i < nb_output_streams; i++) { OutputStream *ost = &output_streams[i]; int frame_size, resample_changed; if (!check_output_constraints(ist, ost) || !ost->encoding_needed) continue; #if CONFIG_AVFILTER resample_changed = ost->resample_width != decoded_frame->width || ost->resample_height != decoded_frame->height || ost->resample_pix_fmt != decoded_frame->format; if (resample_changed) { av_log(NULL, AV_LOG_INFO, ""Input stream #%d:%d frame changed from size:%dx%d fmt:%s to size:%dx%d fmt:%s\n"", ist->file_index, ist->st->index, ost->resample_width, ost->resample_height, av_get_pix_fmt_name(ost->resample_pix_fmt), decoded_frame->width, decoded_frame->height, av_get_pix_fmt_name(decoded_frame->format)); avfilter_graph_free(&ost->graph); if (configure_video_filters(ist, ost)) { av_log(NULL, AV_LOG_FATAL, ""Error reinitializing filters!\n""); exit_program(1); } ost->resample_width = decoded_frame->width; ost->resample_height = decoded_frame->height; ost->resample_pix_fmt = decoded_frame->format; } if (ist->st->sample_aspect_ratio.num) decoded_frame->sample_aspect_ratio = ist->st->sample_aspect_ratio; if (ist->st->codec->codec->capabilities & CODEC_CAP_DR1) { FrameBuffer *buf = decoded_frame->opaque; AVFilterBufferRef *fb = avfilter_get_video_buffer_ref_from_arrays( decoded_frame->data, decoded_frame->linesize, AV_PERM_READ | AV_PERM_PRESERVE, ist->st->codec->width, ist->st->codec->height, ist->st->codec->pix_fmt); avfilter_copy_frame_props(fb, decoded_frame); fb->buf->priv = buf; fb->buf->free = filter_release_buffer; buf->refcount++; av_buffersrc_buffer(ost->input_video_filter, fb); } else av_vsrc_buffer_add_frame(ost->input_video_filter, decoded_frame, decoded_frame->pts, decoded_frame->sample_aspect_ratio); if (!ist->filtered_frame && !(ist->filtered_frame = avcodec_alloc_frame())) { av_free(buffer_to_free); return AVERROR(ENOMEM); } else avcodec_get_frame_defaults(ist->filtered_frame); filtered_frame = ist->filtered_frame; frame_available = avfilter_poll_frame(ost->output_video_filter->inputs[0]); while (frame_available) { AVRational ist_pts_tb; get_filtered_video_frame(ost->output_video_filter, filtered_frame, &ost->picref, &ist_pts_tb); if (ost->picref) filtered_frame->pts = av_rescale_q(ost->picref->pts, ist_pts_tb, AV_TIME_BASE_Q); if (ost->picref->video && !ost->frame_aspect_ratio) ost->st->codec->sample_aspect_ratio = ost->picref->video->pixel_aspect; #else filtered_frame = decoded_frame; #endif do_video_out(output_files[ost->file_index].ctx, ost, ist, filtered_frame, &frame_size, same_quant ? quality : ost->st->codec->global_quality); if (vstats_filename && frame_size) do_video_stats(output_files[ost->file_index].ctx, ost, frame_size); #if CONFIG_AVFILTER frame_available = ost->output_video_filter && avfilter_poll_frame(ost->output_video_filter->inputs[0]); if (ost->picref) avfilter_unref_buffer(ost->picref); } #endif } av_free(buffer_to_free); return ret; }","Yes, it is vulnerable."885883,"static void test_validate_list(TestInputVisitorData *data, const void *unused) { UserDefOneList *head = NULL; Visitor *v; v = validate_test_init(data, ""[ { 'string': 'string0', 'integer': 42 }, { 'string': 'string1', 'integer': 43 }, { 'string': 'string2', 'integer': 44 } ]""); visit_type_UserDefOneList(v, NULL, &head, &error_abort); qapi_free_UserDefOneList(head); }","No, it is non-vulnerable."886884,"static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point_transform){ int i, mb_x, mb_y; uint16_t (*buffer)[4]; int left[3], top[3], topleft[3]; const int linesize= s->linesize[0]; const int mask= (1<<s->bits)-1; av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size, (unsigned)s->mb_width * 4 * sizeof(s->ljpeg_buffer[0][0])); buffer= s->ljpeg_buffer; for(i=0; i<3; i++){ buffer[0][i]= 1 << (s->bits + point_transform - 1); } for(mb_y = 0; mb_y < s->mb_height; mb_y++) { const int modified_predictor= mb_y ? predictor : 1; uint8_t *ptr = s->picture.data[0] + (linesize * mb_y); if (s->interlaced && s->bottom_field) ptr += linesize >> 1; for(i=0; i<3; i++){ top[i]= left[i]= topleft[i]= buffer[0][i]; } for(mb_x = 0; mb_x < s->mb_width; mb_x++) { if (s->restart_interval && !s->restart_count) s->restart_count = s->restart_interval; for(i=0;i<3;i++) { int pred; topleft[i]= top[i]; top[i]= buffer[mb_x][i]; PREDICT(pred, topleft[i], top[i], left[i], modified_predictor); left[i]= buffer[mb_x][i]= mask & (pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform)); } if (s->restart_interval && !--s->restart_count) { align_get_bits(&s->gb); skip_bits(&s->gb, 16); /* skip RSTn */ } } if(s->rct){ for(mb_x = 0; mb_x < s->mb_width; mb_x++) { ptr[3*mb_x+1] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2] - 0x200)>>2); ptr[3*mb_x+0] = buffer[mb_x][1] + ptr[3*mb_x+1]; ptr[3*mb_x+2] = buffer[mb_x][2] + ptr[3*mb_x+1]; } }else if(s->pegasus_rct){ for(mb_x = 0; mb_x < s->mb_width; mb_x++) { ptr[3*mb_x+1] = buffer[mb_x][0] - ((buffer[mb_x][1] + buffer[mb_x][2])>>2); ptr[3*mb_x+0] = buffer[mb_x][1] + ptr[3*mb_x+1]; ptr[3*mb_x+2] = buffer[mb_x][2] + ptr[3*mb_x+1]; } }else{ for(mb_x = 0; mb_x < s->mb_width; mb_x++) { ptr[3*mb_x+0] = buffer[mb_x][2]; ptr[3*mb_x+1] = buffer[mb_x][1]; ptr[3*mb_x+2] = buffer[mb_x][0]; } } } return 0; }","No, it is non-vulnerable."887885,"void vga_common_init(VGAState *s, DisplayState *ds, uint8_t *vga_ram_base, unsigned long vga_ram_offset, int vga_ram_size) { int i, j, v, b; for(i = 0;i < 256; i++) { v = 0; for(j = 0; j < 8; j++) { v |= ((i >> j) & 1) << (j * 4); } expand4[i] = v; v = 0; for(j = 0; j < 4; j++) { v |= ((i >> (2 * j)) & 3) << (j * 4); } expand2[i] = v; } for(i = 0; i < 16; i++) { v = 0; for(j = 0; j < 4; j++) { b = ((i >> j) & 1); v |= b << (2 * j); v |= b << (2 * j + 1); } expand4to8[i] = v; } vga_reset(s); s->vram_ptr = vga_ram_base; s->vram_offset = vga_ram_offset; s->vram_size = vga_ram_size; s->ds = ds; s->get_bpp = vga_get_bpp; s->get_offsets = vga_get_offsets; s->get_resolution = vga_get_resolution; s->update = vga_update_display; s->invalidate = vga_invalidate_display; s->screen_dump = vga_screen_dump; s->text_update = vga_update_text; switch (vga_retrace_method) { case VGA_RETRACE_DUMB: s->retrace = vga_dumb_retrace; s->update_retrace_info = vga_dumb_update_retrace_info; break; case VGA_RETRACE_PRECISE: s->retrace = vga_precise_retrace; s->update_retrace_info = vga_precise_update_retrace_info; memset(&s->retrace_info, 0, sizeof (s->retrace_info)); break; } }","No, it is non-vulnerable."888886,"void monitor_init(CharDriverState *chr, int show_banner) { int i; if (is_first_init) { key_timer = qemu_new_timer(vm_clock, release_keys, NULL); if (!key_timer) return; for (i = 0; i < MAX_MON; i++) { monitor_hd[i] = NULL; } is_first_init = 0; } for (i = 0; i < MAX_MON; i++) { if (monitor_hd[i] == NULL) { monitor_hd[i] = chr; break; } } hide_banner = !show_banner; qemu_chr_add_handlers(chr, term_can_read, term_read, term_event, cur_mon); readline_start("""", 0, monitor_command_cb, NULL); }","No, it is non-vulnerable."889887,"static int twinvq_read_bitstream(AVCodecContext *avctx, TwinVQContext *tctx, const uint8_t *buf, int buf_size) { TwinVQFrameData *bits = &tctx->bits; const TwinVQModeTab *mtab = tctx->mtab; int channels = tctx->avctx->channels; int sub; GetBitContext gb; int i, j, k; if (buf_size * 8 < avctx->bit_rate * mtab->size / avctx->sample_rate + 8) { av_log(avctx, AV_LOG_ERROR, ""Frame too small (%d bytes). Truncated file?\n"", buf_size); return AVERROR(EINVAL); } init_get_bits(&gb, buf, buf_size * 8); skip_bits(&gb, get_bits(&gb, 8)); bits->window_type = get_bits(&gb, TWINVQ_WINDOW_TYPE_BITS); if (bits->window_type > 8) { av_log(avctx, AV_LOG_ERROR, ""Invalid window type, broken sample?\n""); return AVERROR_INVALIDDATA; } bits->ftype = ff_twinvq_wtype_to_ftype_table[tctx->bits.window_type]; sub = mtab->fmode[bits->ftype].sub; read_cb_data(tctx, &gb, bits->main_coeffs, bits->ftype); for (i = 0; i < channels; i++) for (j = 0; j < sub; j++) for (k = 0; k < mtab->fmode[bits->ftype].bark_n_coef; k++) bits->bark1[i][j][k] = get_bits(&gb, mtab->fmode[bits->ftype].bark_n_bit); for (i = 0; i < channels; i++) for (j = 0; j < sub; j++) bits->bark_use_hist[i][j] = get_bits1(&gb); if (bits->ftype == TWINVQ_FT_LONG) { for (i = 0; i < channels; i++) bits->gain_bits[i] = get_bits(&gb, TWINVQ_GAIN_BITS); } else { for (i = 0; i < channels; i++) { bits->gain_bits[i] = get_bits(&gb, TWINVQ_GAIN_BITS); for (j = 0; j < sub; j++) bits->sub_gain_bits[i * sub + j] = get_bits(&gb, TWINVQ_SUB_GAIN_BITS); } } for (i = 0; i < channels; i++) { bits->lpc_hist_idx[i] = get_bits(&gb, mtab->lsp_bit0); bits->lpc_idx1[i] = get_bits(&gb, mtab->lsp_bit1); for (j = 0; j < mtab->lsp_split; j++) bits->lpc_idx2[i][j] = get_bits(&gb, mtab->lsp_bit2); } if (bits->ftype == TWINVQ_FT_LONG) { read_cb_data(tctx, &gb, bits->ppc_coeffs, 3); for (i = 0; i < channels; i++) { bits->p_coef[i] = get_bits(&gb, mtab->ppc_period_bit); bits->g_coef[i] = get_bits(&gb, mtab->pgain_bit); } } return 0; }","No, it is non-vulnerable."890888,"int iommu_dma_memory_rw(DMAContext *dma, dma_addr_t addr, void *buf, dma_addr_t len, DMADirection dir) { target_phys_addr_t paddr, plen; int err; #ifdef DEBUG_IOMMU fprintf(stderr, ""dma_memory_rw context=%p addr=0x"" DMA_ADDR_FMT "" len=0x"" DMA_ADDR_FMT "" dir=%d\n"", dma, addr, len, dir); #endif while (len) { err = dma->translate(dma, addr, &paddr, &plen, dir); if (err) { /* * In case of failure on reads from the guest, we clean the * destination buffer so that a device that doesn't test * for errors will not expose qemu internal memory. */ memset(buf, 0, len); return -1; } /* The translation might be valid for larger regions. */ if (plen > len) { plen = len; } address_space_rw(dma->as, paddr, buf, plen, dir == DMA_DIRECTION_FROM_DEVICE); len -= plen; addr += plen; buf += plen; } return 0; }","No, it is non-vulnerable."891889,"static void blend_frame(AVFilterContext *ctx, AVFrame *top_buf, AVFrame *bottom_buf, AVFrame *dst_buf) { BlendContext *b = ctx->priv; AVFilterLink *inlink = ctx->inputs[0]; FilterParams *param; int plane; for (plane = 0; dst_buf->data[plane]; plane++) { int hsub = plane == 1 || plane == 2 ? b->hsub : 0; int vsub = plane == 1 || plane == 2 ? b->vsub : 0; int outw = dst_buf->width >> hsub; int outh = dst_buf->height >> vsub; uint8_t *dst = dst_buf->data[plane]; uint8_t *top = top_buf->data[plane]; uint8_t *bottom = bottom_buf->data[plane]; param = &b->params[plane]; param->values[VAR_N] = inlink->frame_count; param->values[VAR_T] = dst_buf->pts == AV_NOPTS_VALUE ? NAN : dst_buf->pts * av_q2d(inlink->time_base); param->values[VAR_W] = outw; param->values[VAR_H] = outh; param->values[VAR_SW] = outw / dst_buf->width; param->values[VAR_SH] = outh / dst_buf->height; param->blend(top, top_buf->linesize[plane], bottom, bottom_buf->linesize[plane], dst, dst_buf->linesize[plane], outw, outh, param); } }","Yes, it is vulnerable."892890,"START_TEST(simple_list) { int i; struct { const char *encoded; LiteralQObject decoded; } test_cases[] = { { .encoded = ""[43,42]"", .decoded = QLIT_QLIST(((LiteralQObject[]){ QLIT_QINT(43), QLIT_QINT(42), { } })), }, { .encoded = ""[43]"", .decoded = QLIT_QLIST(((LiteralQObject[]){ QLIT_QINT(43), { } })), }, { .encoded = ""[]"", .decoded = QLIT_QLIST(((LiteralQObject[]){ { } })), }, { .encoded = ""[{}]"", .decoded = QLIT_QLIST(((LiteralQObject[]){ QLIT_QDICT(((LiteralQDictEntry[]){ {}, })), {}, })), }, { } }; for (i = 0; test_cases[i].encoded; i++) { QObject *obj; QString *str; obj = qobject_from_json(test_cases[i].encoded); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QLIST); fail_unless(compare_litqobj_to_qobj(&test_cases[i].decoded, obj) == 1); str = qobject_to_json(obj); qobject_decref(obj); obj = qobject_from_json(qstring_get_str(str)); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QLIST); fail_unless(compare_litqobj_to_qobj(&test_cases[i].decoded, obj) == 1); qobject_decref(obj); QDECREF(str); } }","No, it is non-vulnerable."893891,"static void readline_update(ReadLineState *rs) { int i, delta, len; if (rs->cmd_buf_size != rs->last_cmd_buf_size || memcmp(rs->cmd_buf, rs->last_cmd_buf, rs->cmd_buf_size) != 0) { for(i = 0; i < rs->last_cmd_buf_index; i++) { monitor_printf(rs->mon, ""\033[D""); } rs->cmd_buf[rs->cmd_buf_size] = '\0'; if (rs->read_password) { len = strlen(rs->cmd_buf); for(i = 0; i < len; i++) monitor_printf(rs->mon, ""*""); } else { monitor_printf(rs->mon, ""%s"", rs->cmd_buf); } monitor_printf(rs->mon, ""\033[K""); memcpy(rs->last_cmd_buf, rs->cmd_buf, rs->cmd_buf_size); rs->last_cmd_buf_size = rs->cmd_buf_size; rs->last_cmd_buf_index = rs->cmd_buf_size; } if (rs->cmd_buf_index != rs->last_cmd_buf_index) { delta = rs->cmd_buf_index - rs->last_cmd_buf_index; if (delta > 0) { for(i = 0;i < delta; i++) { monitor_printf(rs->mon, ""\033[C""); } } else { delta = -delta; for(i = 0;i < delta; i++) { monitor_printf(rs->mon, ""\033[D""); } } rs->last_cmd_buf_index = rs->cmd_buf_index; } monitor_flush(rs->mon); }","No, it is non-vulnerable."894892,"void virtio_queue_update_rings(VirtIODevice *vdev, int n) { VRing *vring = &vdev->vq[n].vring; if (!vring->desc) { /* not yet setup -> nothing to do */ return; } vring->avail = vring->desc + vring->num * sizeof(VRingDesc); vring->used = vring_align(vring->avail + offsetof(VRingAvail, ring[vring->num]), vring->align); virtio_init_region_cache(vdev, n); }","Yes, it is vulnerable."895893,"static int qcow2_write_snapshots(BlockDriverState *bs) { BDRVQcowState *s = bs->opaque; QCowSnapshot *sn; QCowSnapshotHeader h; QCowSnapshotExtraData extra; int i, name_size, id_str_size, snapshots_size; struct { uint32_t nb_snapshots; uint64_t snapshots_offset; } QEMU_PACKED header_data; int64_t offset, snapshots_offset; int ret; /* compute the size of the snapshots */ offset = 0; for(i = 0; i < s->nb_snapshots; i++) { sn = s->snapshots + i; offset = align_offset(offset, 8); offset += sizeof(h); offset += sizeof(extra); offset += strlen(sn->id_str); offset += strlen(sn->name); } snapshots_size = offset; /* Allocate space for the new snapshot list */ snapshots_offset = qcow2_alloc_clusters(bs, snapshots_size); bdrv_flush(bs->file); offset = snapshots_offset; if (offset < 0) { return offset; } /* Write all snapshots to the new list */ for(i = 0; i < s->nb_snapshots; i++) { sn = s->snapshots + i; memset(&h, 0, sizeof(h)); h.l1_table_offset = cpu_to_be64(sn->l1_table_offset); h.l1_size = cpu_to_be32(sn->l1_size); /* If it doesn't fit in 32 bit, older implementations should treat it * as a disk-only snapshot rather than truncate the VM state */ if (sn->vm_state_size <= 0xffffffff) { h.vm_state_size = cpu_to_be32(sn->vm_state_size); } h.date_sec = cpu_to_be32(sn->date_sec); h.date_nsec = cpu_to_be32(sn->date_nsec); h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec); h.extra_data_size = cpu_to_be32(sizeof(extra)); memset(&extra, 0, sizeof(extra)); extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size); extra.disk_size = cpu_to_be64(sn->disk_size); id_str_size = strlen(sn->id_str); name_size = strlen(sn->name); h.id_str_size = cpu_to_be16(id_str_size); h.name_size = cpu_to_be16(name_size); offset = align_offset(offset, 8); ret = bdrv_pwrite(bs->file, offset, &h, sizeof(h)); if (ret < 0) { goto fail; } offset += sizeof(h); ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra)); if (ret < 0) { goto fail; } offset += sizeof(extra); ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size); if (ret < 0) { goto fail; } offset += id_str_size; ret = bdrv_pwrite(bs->file, offset, sn->name, name_size); if (ret < 0) { goto fail; } offset += name_size; } /* * Update the header to point to the new snapshot table. This requires the * new table and its refcounts to be stable on disk. */ ret = bdrv_flush(bs); if (ret < 0) { goto fail; } QEMU_BUILD_BUG_ON(offsetof(QCowHeader, snapshots_offset) != offsetof(QCowHeader, nb_snapshots) + sizeof(header_data.nb_snapshots)); header_data.nb_snapshots = cpu_to_be32(s->nb_snapshots); header_data.snapshots_offset = cpu_to_be64(snapshots_offset); ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, nb_snapshots), &header_data, sizeof(header_data)); if (ret < 0) { goto fail; } /* free the old snapshot table */ qcow2_free_clusters(bs, s->snapshots_offset, s->snapshots_size); s->snapshots_offset = snapshots_offset; s->snapshots_size = snapshots_size; return 0; fail: return ret; }","Yes, it is vulnerable."896894,"void ff_put_h264_qpel4_mc21_msa(uint8_t *dst, const uint8_t *src, ptrdiff_t stride) { avc_luma_midv_qrt_4w_msa(src - (2 * stride) - 2, stride, dst, stride, 4, 0); }","No, it is non-vulnerable."897895,"static void mirror_start_job(const char *job_id, BlockDriverState *bs, BlockDriverState *target, const char *replaces, int64_t speed, uint32_t granularity, int64_t buf_size, BlockMirrorBackingMode backing_mode, BlockdevOnError on_source_error, BlockdevOnError on_target_error, bool unmap, BlockCompletionFunc *cb, void *opaque, Error **errp, const BlockJobDriver *driver, bool is_none_mode, BlockDriverState *base) { MirrorBlockJob *s; if (granularity == 0) { granularity = bdrv_get_default_bitmap_granularity(target); } assert ((granularity & (granularity - 1)) == 0); if (buf_size < 0) { error_setg(errp, ""Invalid parameter 'buf-size'""); return; } if (buf_size == 0) { buf_size = DEFAULT_MIRROR_BUF_SIZE; } s = block_job_create(job_id, driver, bs, speed, cb, opaque, errp); if (!s) { return; } s->target = blk_new(); blk_insert_bs(s->target, target); s->replaces = g_strdup(replaces); s->on_source_error = on_source_error; s->on_target_error = on_target_error; s->is_none_mode = is_none_mode; s->backing_mode = backing_mode; s->base = base; s->granularity = granularity; s->buf_size = ROUND_UP(buf_size, granularity); s->unmap = unmap; s->dirty_bitmap = bdrv_create_dirty_bitmap(bs, granularity, NULL, errp); if (!s->dirty_bitmap) { g_free(s->replaces); blk_unref(s->target); block_job_unref(&s->common); return; } bdrv_op_block_all(target, s->common.blocker); s->common.co = qemu_coroutine_create(mirror_run); trace_mirror_start(bs, s, s->common.co, opaque); qemu_coroutine_enter(s->common.co, s); }","Yes, it is vulnerable."898896,"static void vmgenid_realize(DeviceState *dev, Error **errp) { VmGenIdState *vms = VMGENID(dev); if (!vms->write_pointer_available) { error_setg(errp, ""%s requires DMA write support in fw_cfg, "" ""which this machine type does not provide"", VMGENID_DEVICE); return; } /* Given that this function is executing, there is at least one VMGENID * device. Check if there are several. */ if (!find_vmgenid_dev()) { error_setg(errp, ""at most one %s device is permitted"", VMGENID_DEVICE); return; } qemu_register_reset(vmgenid_handle_reset, vms); }","Yes, it is vulnerable."899897,"static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p, int *got_frame, uint8_t *data_start, unsigned int data_size) { WebPContext *s = avctx->priv_data; AVPacket pkt; int ret; if (!s->initialized) { ff_vp8_decode_init(avctx); s->initialized = 1; avctx->get_format = webp_get_format; } s->lossless = 0; if (data_size > INT_MAX) { av_log(avctx, AV_LOG_ERROR, ""unsupported chunk size\n""); return AVERROR_PATCHWELCOME; } av_init_packet(&pkt); pkt.data = data_start; pkt.size = data_size; ret = ff_vp8_decode_frame(avctx, p, got_frame, &pkt); if (s->has_alpha) { ret = vp8_lossy_decode_alpha(avctx, p, s->alpha_data, s->alpha_data_size); if (ret < 0) return ret; } return ret; }","No, it is non-vulnerable."900898,"static void gen_window_check1(DisasContext *dc, unsigned r1) { if (dc->tb->flags & XTENSA_TBFLAG_EXCM) { return; } if (option_enabled(dc, XTENSA_OPTION_WINDOWED_REGISTER) && r1 / 4 > dc->used_window) { int label = gen_new_label(); TCGv_i32 ws = tcg_temp_new_i32(); dc->used_window = r1 / 4; tcg_gen_deposit_i32(ws, cpu_SR[WINDOW_START], cpu_SR[WINDOW_START], dc->config->nareg / 4, dc->config->nareg / 4); tcg_gen_shr_i32(ws, ws, cpu_SR[WINDOW_BASE]); tcg_gen_andi_i32(ws, ws, (2 << (r1 / 4)) - 2); tcg_gen_brcondi_i32(TCG_COND_EQ, ws, 0, label); { TCGv_i32 pc = tcg_const_i32(dc->pc); TCGv_i32 w = tcg_const_i32(r1 / 4); gen_advance_ccount_cond(dc); gen_helper_window_check(cpu_env, pc, w); tcg_temp_free(w); tcg_temp_free(pc); } gen_set_label(label); tcg_temp_free(ws); } }","Yes, it is vulnerable."901899,"static void set_watchdog_timer(IPMIBmcSim *ibs, uint8_t *cmd, unsigned int cmd_len, uint8_t *rsp, unsigned int *rsp_len, unsigned int max_rsp_len) { IPMIInterface *s = ibs->parent.intf; IPMIInterfaceClass *k = IPMI_INTERFACE_GET_CLASS(s); unsigned int val; IPMI_CHECK_CMD_LEN(8); val = cmd[2] & 0x7; /* Validate use */ if (val == 0 || val > 5) { rsp[2] = IPMI_CC_INVALID_DATA_FIELD; return; } val = cmd[3] & 0x7; /* Validate action */ switch (val) { case IPMI_BMC_WATCHDOG_ACTION_NONE: break; case IPMI_BMC_WATCHDOG_ACTION_RESET: rsp[2] = k->do_hw_op(s, IPMI_RESET_CHASSIS, 1); break; case IPMI_BMC_WATCHDOG_ACTION_POWER_DOWN: rsp[2] = k->do_hw_op(s, IPMI_POWEROFF_CHASSIS, 1); break; case IPMI_BMC_WATCHDOG_ACTION_POWER_CYCLE: rsp[2] = k->do_hw_op(s, IPMI_POWERCYCLE_CHASSIS, 1); break; default: rsp[2] = IPMI_CC_INVALID_DATA_FIELD; } if (rsp[2]) { rsp[2] = IPMI_CC_INVALID_DATA_FIELD; return; } val = (cmd[3] >> 4) & 0x7; /* Validate preaction */ switch (val) { case IPMI_BMC_WATCHDOG_PRE_MSG_INT: case IPMI_BMC_WATCHDOG_PRE_NONE: break; case IPMI_BMC_WATCHDOG_PRE_NMI: if (!k->do_hw_op(s, IPMI_SEND_NMI, 1)) { /* NMI not supported. */ rsp[2] = IPMI_CC_INVALID_DATA_FIELD; return; } break; default: /* We don't support PRE_SMI */ rsp[2] = IPMI_CC_INVALID_DATA_FIELD; return; } ibs->watchdog_initialized = 1; ibs->watchdog_use = cmd[2] & IPMI_BMC_WATCHDOG_USE_MASK; ibs->watchdog_action = cmd[3] & IPMI_BMC_WATCHDOG_ACTION_MASK; ibs->watchdog_pretimeout = cmd[4]; ibs->watchdog_expired &= ~cmd[5]; ibs->watchdog_timeout = cmd[6] | (((uint16_t) cmd[7]) << 8); if (ibs->watchdog_running & IPMI_BMC_WATCHDOG_GET_DONT_STOP(ibs)) { do_watchdog_reset(ibs); } else { ibs->watchdog_running = 0; } }","Yes, it is vulnerable."902900,"static void sd_1d97_float(float *p, int i0, int i1) { int i; if (i1 <= i0 + 1) { if (i0 == 1) p[1] *= F_LFTG_X; else p[0] *= F_LFTG_K; return; } extend97_float(p, i0, i1); i0++; i1++; for (i = i0/2 - 2; i < i1/2 + 1; i++) p[2*i+1] -= 1.586134 * (p[2*i] + p[2*i+2]); for (i = i0/2 - 1; i < i1/2 + 1; i++) p[2*i] -= 0.052980 * (p[2*i-1] + p[2*i+1]); for (i = i0/2 - 1; i < i1/2; i++) p[2*i+1] += 0.882911 * (p[2*i] + p[2*i+2]); for (i = i0/2; i < i1/2; i++) p[2*i] += 0.443506 * (p[2*i-1] + p[2*i+1]); }","Yes, it is vulnerable."903901,"int ff_mpv_frame_start(MpegEncContext *s, AVCodecContext *avctx) { int i, ret; Picture *pic; s->mb_skipped = 0; if (!ff_thread_can_start_frame(avctx)) { av_log(avctx, AV_LOG_ERROR, ""Attempt to start a frame outside SETUP state\n""); return -1; } /* mark & release old frames */ if (s->pict_type != AV_PICTURE_TYPE_B && s->last_picture_ptr && s->last_picture_ptr != s->next_picture_ptr && s->last_picture_ptr->f->buf[0]) { ff_mpeg_unref_picture(s, s->last_picture_ptr); } /* release forgotten pictures */ /* if (mpeg124/h263) */ for (i = 0; i < MAX_PICTURE_COUNT; i++) { if (&s->picture[i] != s->last_picture_ptr && &s->picture[i] != s->next_picture_ptr && s->picture[i].reference && !s->picture[i].needs_realloc) { if (!(avctx->active_thread_type & FF_THREAD_FRAME)) av_log(avctx, AV_LOG_ERROR, ""releasing zombie picture\n""); ff_mpeg_unref_picture(s, &s->picture[i]); } } ff_mpeg_unref_picture(s, &s->current_picture); release_unused_pictures(s); if (s->current_picture_ptr && !s->current_picture_ptr->f->buf[0]) { // we already have a unused image // (maybe it was set before reading the header) pic = s->current_picture_ptr; } else { i = ff_find_unused_picture(s, 0); if (i < 0) { av_log(s->avctx, AV_LOG_ERROR, ""no frame buffer available\n""); return i; } pic = &s->picture[i]; } pic->reference = 0; if (!s->droppable) { if (s->pict_type != AV_PICTURE_TYPE_B) pic->reference = 3; } pic->f->coded_picture_number = s->coded_picture_number++; if (ff_alloc_picture(s, pic, 0) < 0) return -1; s->current_picture_ptr = pic; // FIXME use only the vars from current_pic s->current_picture_ptr->f->top_field_first = s->top_field_first; if (s->codec_id == AV_CODEC_ID_MPEG1VIDEO || s->codec_id == AV_CODEC_ID_MPEG2VIDEO) { if (s->picture_structure != PICT_FRAME) s->current_picture_ptr->f->top_field_first = (s->picture_structure == PICT_TOP_FIELD) == s->first_field; } s->current_picture_ptr->f->interlaced_frame = !s->progressive_frame && !s->progressive_sequence; s->current_picture_ptr->field_picture = s->picture_structure != PICT_FRAME; s->current_picture_ptr->f->pict_type = s->pict_type; // if (s->flags && CODEC_FLAG_QSCALE) // s->current_picture_ptr->quality = s->new_picture_ptr->quality; s->current_picture_ptr->f->key_frame = s->pict_type == AV_PICTURE_TYPE_I; if ((ret = ff_mpeg_ref_picture(s, &s->current_picture, s->current_picture_ptr)) < 0) return ret; if (s->pict_type != AV_PICTURE_TYPE_B) { s->last_picture_ptr = s->next_picture_ptr; if (!s->droppable) s->next_picture_ptr = s->current_picture_ptr; } ff_dlog(s->avctx, ""L%p N%p C%p L%p N%p C%p type:%d drop:%d\n"", s->last_picture_ptr, s->next_picture_ptr,s->current_picture_ptr, s->last_picture_ptr ? s->last_picture_ptr->f->data[0] : NULL, s->next_picture_ptr ? s->next_picture_ptr->f->data[0] : NULL, s->current_picture_ptr ? s->current_picture_ptr->f->data[0] : NULL, s->pict_type, s->droppable); if ((!s->last_picture_ptr || !s->last_picture_ptr->f->buf[0]) && (s->pict_type != AV_PICTURE_TYPE_I || s->picture_structure != PICT_FRAME)) { int h_chroma_shift, v_chroma_shift; av_pix_fmt_get_chroma_sub_sample(s->avctx->pix_fmt, &h_chroma_shift, &v_chroma_shift); if (s->pict_type == AV_PICTURE_TYPE_B && s->next_picture_ptr && s->next_picture_ptr->f->buf[0]) av_log(avctx, AV_LOG_DEBUG, ""allocating dummy last picture for B frame\n""); else if (s->pict_type != AV_PICTURE_TYPE_I) av_log(avctx, AV_LOG_ERROR, ""warning: first frame is no keyframe\n""); else if (s->picture_structure != PICT_FRAME) av_log(avctx, AV_LOG_DEBUG, ""allocate dummy last picture for field based first keyframe\n""); /* Allocate a dummy frame */ i = ff_find_unused_picture(s, 0); if (i < 0) { av_log(s->avctx, AV_LOG_ERROR, ""no frame buffer available\n""); return i; } s->last_picture_ptr = &s->picture[i]; s->last_picture_ptr->reference = 3; s->last_picture_ptr->f->key_frame = 0; s->last_picture_ptr->f->pict_type = AV_PICTURE_TYPE_P; if (ff_alloc_picture(s, s->last_picture_ptr, 0) < 0) { s->last_picture_ptr = NULL; return -1; } if (!avctx->hwaccel && !(avctx->codec->capabilities&CODEC_CAP_HWACCEL_VDPAU)) { for(i=0; i<avctx->height; i++) memset(s->last_picture_ptr->f->data[0] + s->last_picture_ptr->f->linesize[0]*i, 0x80, avctx->width); for(i=0; i<FF_CEIL_RSHIFT(avctx->height, v_chroma_shift); i++) { memset(s->last_picture_ptr->f->data[1] + s->last_picture_ptr->f->linesize[1]*i, 0x80, FF_CEIL_RSHIFT(avctx->width, h_chroma_shift)); memset(s->last_picture_ptr->f->data[2] + s->last_picture_ptr->f->linesize[2]*i, 0x80, FF_CEIL_RSHIFT(avctx->width, h_chroma_shift)); } if(s->codec_id == AV_CODEC_ID_FLV1 || s->codec_id == AV_CODEC_ID_H263){ for(i=0; i<avctx->height; i++) memset(s->last_picture_ptr->f->data[0] + s->last_picture_ptr->f->linesize[0]*i, 16, avctx->width); } } ff_thread_report_progress(&s->last_picture_ptr->tf, INT_MAX, 0); ff_thread_report_progress(&s->last_picture_ptr->tf, INT_MAX, 1); } if ((!s->next_picture_ptr || !s->next_picture_ptr->f->buf[0]) && s->pict_type == AV_PICTURE_TYPE_B) { /* Allocate a dummy frame */ i = ff_find_unused_picture(s, 0); if (i < 0) { av_log(s->avctx, AV_LOG_ERROR, ""no frame buffer available\n""); return i; } s->next_picture_ptr = &s->picture[i]; s->next_picture_ptr->reference = 3; s->next_picture_ptr->f->key_frame = 0; s->next_picture_ptr->f->pict_type = AV_PICTURE_TYPE_P; if (ff_alloc_picture(s, s->next_picture_ptr, 0) < 0) { s->next_picture_ptr = NULL; return -1; } ff_thread_report_progress(&s->next_picture_ptr->tf, INT_MAX, 0); ff_thread_report_progress(&s->next_picture_ptr->tf, INT_MAX, 1); } #if 0 // BUFREF-FIXME memset(s->last_picture.f->data, 0, sizeof(s->last_picture.f->data)); memset(s->next_picture.f->data, 0, sizeof(s->next_picture.f->data)); #endif if (s->last_picture_ptr) { ff_mpeg_unref_picture(s, &s->last_picture); if (s->last_picture_ptr->f->buf[0] && (ret = ff_mpeg_ref_picture(s, &s->last_picture, s->last_picture_ptr)) < 0) return ret; } if (s->next_picture_ptr) { ff_mpeg_unref_picture(s, &s->next_picture); if (s->next_picture_ptr->f->buf[0] && (ret = ff_mpeg_ref_picture(s, &s->next_picture, s->next_picture_ptr)) < 0) return ret; } av_assert0(s->pict_type == AV_PICTURE_TYPE_I || (s->last_picture_ptr && s->last_picture_ptr->f->buf[0])); if (s->picture_structure!= PICT_FRAME) { int i; for (i = 0; i < 4; i++) { if (s->picture_structure == PICT_BOTTOM_FIELD) { s->current_picture.f->data[i] += s->current_picture.f->linesize[i]; } s->current_picture.f->linesize[i] *= 2; s->last_picture.f->linesize[i] *= 2; s->next_picture.f->linesize[i] *= 2; } } s->err_recognition = avctx->err_recognition; /* set dequantizer, we can't do it during init as * it might change for mpeg4 and we can't do it in the header * decode as init is not called for mpeg4 there yet */ if (s->mpeg_quant || s->codec_id == AV_CODEC_ID_MPEG2VIDEO) { s->dct_unquantize_intra = s->dct_unquantize_mpeg2_intra; s->dct_unquantize_inter = s->dct_unquantize_mpeg2_inter; } else if (s->out_format == FMT_H263 || s->out_format == FMT_H261) { s->dct_unquantize_intra = s->dct_unquantize_h263_intra; s->dct_unquantize_inter = s->dct_unquantize_h263_inter; } else { s->dct_unquantize_intra = s->dct_unquantize_mpeg1_intra; s->dct_unquantize_inter = s->dct_unquantize_mpeg1_inter; } if (s->avctx->debug & FF_DEBUG_NOMC) { gray_frame(s->current_picture_ptr->f); } return 0; }","Yes, it is vulnerable."904902,"int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes) { NBDClientSession *client = nbd_get_client_session(bs); NBDRequest request = { .type = NBD_CMD_TRIM, .from = offset, .len = bytes, }; assert(!(client->info.flags & NBD_FLAG_READ_ONLY)); if (!(client->info.flags & NBD_FLAG_SEND_TRIM)) { return 0; } return nbd_co_request(bs, &request, NULL); }","No, it is non-vulnerable."905903,"static QEMUCursor *qxl_cursor(PCIQXLDevice *qxl, QXLCursor *cursor, uint32_t group_id) { QEMUCursor *c; size_t size; c = cursor_alloc(cursor->header.width, cursor->header.height); c->hot_x = cursor->header.hot_spot_x; c->hot_y = cursor->header.hot_spot_y; switch (cursor->header.type) { case SPICE_CURSOR_TYPE_ALPHA: size = sizeof(uint32_t) * cursor->header.width * cursor->header.height; qxl_unpack_chunks(c->data, size, qxl, &cursor->chunk, group_id); if (qxl->debug > 2) { cursor_print_ascii_art(c, ""qxl/alpha""); } break; default: fprintf(stderr, ""%s: not implemented: type %d\n"", __FUNCTION__, cursor->header.type); goto fail; } return c; fail: cursor_put(c); return NULL; }","No, it is non-vulnerable."906904,"QFloat *qfloat_from_double(double value) { QFloat *qf; qf = g_malloc(sizeof(*qf)); qf->value = value; QOBJECT_INIT(qf, &qfloat_type); return qf; }","No, it is non-vulnerable."907905,"void *qemu_blockalign(BlockDriverState *bs, size_t size) { return qemu_memalign(bdrv_opt_mem_align(bs), size); }","No, it is non-vulnerable."908906,"static void spapr_drc_release(sPAPRDRConnector *drc) { sPAPRDRConnectorClass *drck = SPAPR_DR_CONNECTOR_GET_CLASS(drc); drck->release(drc->dev); drc->awaiting_release = false; g_free(drc->fdt); drc->fdt = NULL; drc->fdt_start_offset = 0; object_property_del(OBJECT(drc), ""device"", &error_abort); drc->dev = NULL; }","No, it is non-vulnerable."909907,"static void jpeg_put_comments(MpegEncContext *s) { PutBitContext *p = &s->pb; int size; uint8_t *ptr; if (s->aspect_ratio_info /* && !lossless */) { /* JFIF header */ put_marker(p, APP0); put_bits(p, 16, 16); put_string(p, ""JFIF""); /* this puts the trailing zero-byte too */ put_bits(p, 16, 0x0201); /* v 1.02 */ put_bits(p, 8, 0); /* units type: 0 - aspect ratio */ put_bits(p, 16, s->avctx->sample_aspect_ratio.num); put_bits(p, 16, s->avctx->sample_aspect_ratio.den); put_bits(p, 8, 0); /* thumbnail width */ put_bits(p, 8, 0); /* thumbnail height */ } /* comment */ if(!(s->flags & CODEC_FLAG_BITEXACT)){ put_marker(p, COM); flush_put_bits(p); ptr = pbBufPtr(p); put_bits(p, 16, 0); /* patched later */ put_string(p, LIBAVCODEC_IDENT); size = strlen(LIBAVCODEC_IDENT)+3; ptr[0] = size >> 8; ptr[1] = size; } }","Yes, it is vulnerable."910908,"static av_always_inline int vorbis_residue_decode_internal(vorbis_context *vc, vorbis_residue *vr, unsigned ch, uint8_t *do_not_decode, float *vec, unsigned vlen, unsigned ch_left, int vr_type) { GetBitContext *gb = &vc->gb; unsigned c_p_c = vc->codebooks[vr->classbook].dimensions; uint8_t *classifs = vr->classifs; unsigned pass, ch_used, i, j, k, l; unsigned max_output = (ch - 1) * vlen; int ptns_to_read = vr->ptns_to_read; int libvorbis_bug = 0; if (vr_type == 2) { for (j = 1; j < ch; ++j) do_not_decode[0] &= do_not_decode[j]; // FIXME - clobbering input if (do_not_decode[0]) return 0; ch_used = 1; max_output += vr->end / ch; } else { ch_used = ch; max_output += vr->end; } if (max_output > ch_left * vlen) { if (max_output <= ch_left * vlen + vr->partition_size*ch_used/ch) { ptns_to_read--; libvorbis_bug = 1; } else { av_log(vc->avctx, AV_LOG_ERROR, ""Insufficient output buffer\n""); return AVERROR_INVALIDDATA; } } av_dlog(NULL, "" residue type 0/1/2 decode begin, ch: %d cpc %d \n"", ch, c_p_c); for (pass = 0; pass <= vr->maxpass; ++pass) { // FIXME OPTIMIZE? int voffset, partition_count, j_times_ptns_to_read; voffset = vr->begin; for (partition_count = 0; partition_count < ptns_to_read;) { // SPEC error if (!pass) { int ret; if ((ret = setup_classifs(vc, vr, do_not_decode, ch_used, partition_count)) < 0) return ret; } for (i = 0; (i < c_p_c) && (partition_count < ptns_to_read); ++i) { for (j_times_ptns_to_read = 0, j = 0; j < ch_used; ++j) { unsigned voffs; if (!do_not_decode[j]) { unsigned vqclass = classifs[j_times_ptns_to_read + partition_count]; int vqbook = vr->books[vqclass][pass]; if (vqbook >= 0 && vc->codebooks[vqbook].codevectors) { unsigned coffs; unsigned dim = vc->codebooks[vqbook].dimensions; unsigned step = FASTDIV(vr->partition_size << 1, dim << 1); vorbis_codebook codebook = vc->codebooks[vqbook]; if (vr_type == 0) { voffs = voffset+j*vlen; for (k = 0; k < step; ++k) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim; for (l = 0; l < dim; ++l) vec[voffs + k + l * step] += codebook.codevectors[coffs + l]; } } else if (vr_type == 1) { voffs = voffset + j * vlen; for (k = 0; k < step; ++k) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim; for (l = 0; l < dim; ++l, ++voffs) { vec[voffs]+=codebook.codevectors[coffs+l]; av_dlog(NULL, "" pass %d offs: %d curr: %f change: %f cv offs.: %d \n"", pass, voffs, vec[voffs], codebook.codevectors[coffs+l], coffs); } } } else if (vr_type == 2 && ch == 2 && (voffset & 1) == 0 && (dim & 1) == 0) { // most frequent case optimized voffs = voffset >> 1; if (dim == 2) { for (k = 0; k < step; ++k) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * 2; vec[voffs + k ] += codebook.codevectors[coffs ]; vec[voffs + k + vlen] += codebook.codevectors[coffs + 1]; } } else if (dim == 4) { for (k = 0; k < step; ++k, voffs += 2) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * 4; vec[voffs ] += codebook.codevectors[coffs ]; vec[voffs + 1 ] += codebook.codevectors[coffs + 2]; vec[voffs + vlen ] += codebook.codevectors[coffs + 1]; vec[voffs + vlen + 1] += codebook.codevectors[coffs + 3]; } } else for (k = 0; k < step; ++k) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim; for (l = 0; l < dim; l += 2, voffs++) { vec[voffs ] += codebook.codevectors[coffs + l ]; vec[voffs + vlen] += codebook.codevectors[coffs + l + 1]; av_dlog(NULL, "" pass %d offs: %d curr: %f change: %f cv offs.: %d+%d \n"", pass, voffset / ch + (voffs % ch) * vlen, vec[voffset / ch + (voffs % ch) * vlen], codebook.codevectors[coffs + l], coffs, l); } } } else if (vr_type == 2) { unsigned voffs_div = FASTDIV(voffset << 1, ch <<1); unsigned voffs_mod = voffset - voffs_div * ch; for (k = 0; k < step; ++k) { coffs = get_vlc2(gb, codebook.vlc.table, codebook.nb_bits, 3) * dim; for (l = 0; l < dim; ++l) { vec[voffs_div + voffs_mod * vlen] += codebook.codevectors[coffs + l]; av_dlog(NULL, "" pass %d offs: %d curr: %f change: %f cv offs.: %d+%d \n"", pass, voffs_div + voffs_mod * vlen, vec[voffs_div + voffs_mod * vlen], codebook.codevectors[coffs + l], coffs, l); if (++voffs_mod == ch) { voffs_div++; voffs_mod = 0; } } } } } } j_times_ptns_to_read += ptns_to_read; } ++partition_count; voffset += vr->partition_size; } } if (libvorbis_bug && !pass) { for (j = 0; j < ch_used; ++j) { if (!do_not_decode[j]) { get_vlc2(&vc->gb, vc->codebooks[vr->classbook].vlc.table, vc->codebooks[vr->classbook].nb_bits, 3); } } } } return 0; }","Yes, it is vulnerable."911909,"static int asf_read_header(AVFormatContext *s, AVFormatParameters *ap) { ASFContext *asf = s->priv_data; GUID g; ByteIOContext *pb = &s->pb; AVStream *st; ASFStream *asf_st; int size, i, bps; INT64 gsize; get_guid(pb, &g); if (memcmp(&g, &asf_header, sizeof(GUID))) goto fail; get_le64(pb); get_le32(pb); get_byte(pb); get_byte(pb); memset(&asf->asfid2avid, -1, sizeof(asf->asfid2avid)); for(;;) { get_guid(pb, &g); gsize = get_le64(pb); #ifdef DEBUG printf(""%08Lx: "", url_ftell(pb) - 24); print_guid(&g); printf("" size=0x%Lx\n"", gsize); #endif if (gsize < 24) goto fail; if (!memcmp(&g, &file_header, sizeof(GUID))) { get_guid(pb, &asf->hdr.guid); asf->hdr.file_size = get_le64(pb); asf->hdr.create_time = get_le64(pb); asf->hdr.packets_count = get_le64(pb); asf->hdr.play_time = get_le64(pb); asf->hdr.send_time = get_le64(pb); asf->hdr.preroll = get_le32(pb); asf->hdr.ignore = get_le32(pb); asf->hdr.flags = get_le32(pb); asf->hdr.min_pktsize = get_le32(pb); asf->hdr.max_pktsize = get_le32(pb); asf->hdr.max_bitrate = get_le32(pb); asf->packet_size = asf->hdr.max_pktsize; asf->nb_packets = asf->hdr.packets_count; } else if (!memcmp(&g, &stream_header, sizeof(GUID))) { int type, id, total_size; unsigned int tag1; INT64 pos1, pos2; pos1 = url_ftell(pb); st = av_mallocz(sizeof(AVStream)); if (!st) goto fail; s->streams[s->nb_streams] = st; asf_st = av_mallocz(sizeof(ASFStream)); if (!asf_st) goto fail; st->priv_data = asf_st; st->time_length = (asf->hdr.send_time - asf->hdr.preroll) / 10000; get_guid(pb, &g); if (!memcmp(&g, &audio_stream, sizeof(GUID))) { type = CODEC_TYPE_AUDIO; } else if (!memcmp(&g, &video_stream, sizeof(GUID))) { type = CODEC_TYPE_VIDEO; } else { goto fail; } get_guid(pb, &g); total_size = get_le64(pb); get_le32(pb); get_le32(pb); st->id = get_le16(pb) & 0x7f; /* stream id */ // mapping of asf ID to AV stream ID; asf->asfid2avid[st->id] = s->nb_streams++; get_le32(pb); st->codec.codec_type = type; st->codec.frame_rate = 1000; // in packet ticks if (type == CODEC_TYPE_AUDIO) { id = get_le16(pb); st->codec.codec_tag = id; st->codec.channels = get_le16(pb); st->codec.sample_rate = get_le32(pb); st->codec.bit_rate = get_le32(pb) * 8; st->codec.block_align = get_le16(pb); /* block align */ bps = get_le16(pb); /* bits per sample */ st->codec.codec_id = wav_codec_get_id(id, bps); size = get_le16(pb); if (size > 0) { st->extra_data = av_mallocz(size); get_buffer(pb, st->extra_data, size); st->extra_data_size = size; } /* We have to init the frame size at some point .... */ pos2 = url_ftell(pb); if (gsize > (pos2 + 8 - pos1 + 24)) { asf_st->ds_span = get_byte(pb); asf_st->ds_packet_size = get_le16(pb); asf_st->ds_chunk_size = get_le16(pb); asf_st->ds_data_size = get_le16(pb); asf_st->ds_silence_data = get_byte(pb); } //printf(""Descrambling: ps:%d cs:%d ds:%d s:%d sd:%d\n"", // asf_st->ds_packet_size, asf_st->ds_chunk_size, // asf_st->ds_data_size, asf_st->ds_span, asf_st->ds_silence_data); if (asf_st->ds_span > 1) { if (!asf_st->ds_chunk_size || (asf_st->ds_packet_size/asf_st->ds_chunk_size <= 1)) asf_st->ds_span = 0; // disable descrambling } switch (st->codec.codec_id) { case CODEC_ID_MP3LAME: st->codec.frame_size = MPA_FRAME_SIZE; break; case CODEC_ID_PCM_S16LE: case CODEC_ID_PCM_S16BE: case CODEC_ID_PCM_U16LE: case CODEC_ID_PCM_U16BE: case CODEC_ID_PCM_S8: case CODEC_ID_PCM_U8: case CODEC_ID_PCM_ALAW: case CODEC_ID_PCM_MULAW: st->codec.frame_size = 1; break; default: /* This is probably wrong, but it prevents a crash later */ st->codec.frame_size = 1; break; } } else { get_le32(pb); get_le32(pb); get_byte(pb); size = get_le16(pb); /* size */ get_le32(pb); /* size */ st->codec.width = get_le32(pb); st->codec.height = get_le32(pb); /* not available for asf */ get_le16(pb); /* panes */ get_le16(pb); /* depth */ tag1 = get_le32(pb); url_fskip(pb, 20); if (size > 40) { st->extra_data_size = size - 40; st->extra_data = av_mallocz(st->extra_data_size); get_buffer(pb, st->extra_data, st->extra_data_size); } st->codec.codec_tag = tag1; st->codec.codec_id = codec_get_id(codec_asf_bmp_tags, tag1); } pos2 = url_ftell(pb); url_fskip(pb, gsize - (pos2 - pos1 + 24)); } else if (!memcmp(&g, &data_header, sizeof(GUID))) { break; } else if (!memcmp(&g, &comment_header, sizeof(GUID))) { int len1, len2, len3, len4, len5; len1 = get_le16(pb); len2 = get_le16(pb); len3 = get_le16(pb); len4 = get_le16(pb); len5 = get_le16(pb); get_str16_nolen(pb, len1, s->title, sizeof(s->title)); get_str16_nolen(pb, len2, s->author, sizeof(s->author)); get_str16_nolen(pb, len3, s->copyright, sizeof(s->copyright)); get_str16_nolen(pb, len4, s->comment, sizeof(s->comment)); url_fskip(pb, len5); #if 0 } else if (!memcmp(&g, &head1_guid, sizeof(GUID))) { int v1, v2; get_guid(pb, &g); v1 = get_le32(pb); v2 = get_le16(pb); } else if (!memcmp(&g, &codec_comment_header, sizeof(GUID))) { int len, v1, n, num; char str[256], *q; char tag[16]; get_guid(pb, &g); print_guid(&g); n = get_le32(pb); for(i=0;i<n;i++) { num = get_le16(pb); /* stream number */ get_str16(pb, str, sizeof(str)); get_str16(pb, str, sizeof(str)); len = get_le16(pb); q = tag; while (len > 0) { v1 = get_byte(pb); if ((q - tag) < sizeof(tag) - 1) *q++ = v1; len--; } *q = '\0'; } #endif } else if (url_feof(pb)) { goto fail; } else { url_fseek(pb, gsize - 24, SEEK_CUR); } } get_guid(pb, &g); get_le64(pb); get_byte(pb); get_byte(pb); if (url_feof(pb)) goto fail; asf->data_offset = url_ftell(pb); asf->packet_size_left = 0; return 0; fail: for(i=0;i<s->nb_streams;i++) { AVStream *st = s->streams[i]; if (st) { av_free(st->priv_data); av_free(st->extra_data); } av_free(st); } //av_free(asf); return -1; }","No, it is non-vulnerable."912910,"static void guess_mv(ERContext *s) { uint8_t *fixed = s->er_temp_buffer; #define MV_FROZEN 3 #define MV_CHANGED 2 #define MV_UNCHANGED 1 const int mb_stride = s->mb_stride; const int mb_width = s->mb_width; int mb_height = s->mb_height; int i, depth, num_avail; int mb_x, mb_y, mot_step, mot_stride; if (s->last_pic.f && s->last_pic.f->data[0]) mb_height = FFMIN(mb_height, (s->last_pic.f->height+15)>>4); if (s->next_pic.f && s->next_pic.f->data[0]) mb_height = FFMIN(mb_height, (s->next_pic.f->height+15)>>4); set_mv_strides(s, &mot_step, &mot_stride); num_avail = 0; if (s->last_pic.motion_val[0]) ff_thread_await_progress(s->last_pic.tf, mb_height-1, 0); for (i = 0; i < mb_width * mb_height; i++) { const int mb_xy = s->mb_index2xy[i]; int f = 0; int error = s->error_status_table[mb_xy]; if (IS_INTRA(s->cur_pic.mb_type[mb_xy])) f = MV_FROZEN; // intra // FIXME check if (!(error & ER_MV_ERROR)) f = MV_FROZEN; // inter with undamaged MV fixed[mb_xy] = f; if (f == MV_FROZEN) num_avail++; else if(s->last_pic.f->data[0] && s->last_pic.motion_val[0]){ const int mb_y= mb_xy / s->mb_stride; const int mb_x= mb_xy % s->mb_stride; const int mot_index= (mb_x + mb_y*mot_stride) * mot_step; s->cur_pic.motion_val[0][mot_index][0]= s->last_pic.motion_val[0][mot_index][0]; s->cur_pic.motion_val[0][mot_index][1]= s->last_pic.motion_val[0][mot_index][1]; s->cur_pic.ref_index[0][4*mb_xy] = s->last_pic.ref_index[0][4*mb_xy]; } } if ((!(s->avctx->error_concealment&FF_EC_GUESS_MVS)) || num_avail <= mb_width / 2) { for (mb_y = 0; mb_y < mb_height; mb_y++) { for (mb_x = 0; mb_x < s->mb_width; mb_x++) { const int mb_xy = mb_x + mb_y * s->mb_stride; int mv_dir = (s->last_pic.f && s->last_pic.f->data[0]) ? MV_DIR_FORWARD : MV_DIR_BACKWARD; if (IS_INTRA(s->cur_pic.mb_type[mb_xy])) continue; if (!(s->error_status_table[mb_xy] & ER_MV_ERROR)) continue; s->mv[0][0][0] = 0; s->mv[0][0][1] = 0; s->decode_mb(s->opaque, 0, mv_dir, MV_TYPE_16X16, &s->mv, mb_x, mb_y, 0, 0); } } return; } for (depth = 0; ; depth++) { int changed, pass, none_left; none_left = 1; changed = 1; for (pass = 0; (changed || pass < 2) && pass < 10; pass++) { int mb_x, mb_y; int score_sum = 0; changed = 0; for (mb_y = 0; mb_y < mb_height; mb_y++) { for (mb_x = (mb_y ^ pass) & 1; mb_x < s->mb_width; mb_x+=2) { const int mb_xy = mb_x + mb_y * s->mb_stride; int mv_predictor[8][2] = { { 0 } }; int ref[8] = { 0 }; int pred_count = 0; int j; int best_score = 256 * 256 * 256 * 64; int best_pred = 0; const int mot_index = (mb_x + mb_y * mot_stride) * mot_step; int prev_x = 0, prev_y = 0, prev_ref = 0; if (fixed[mb_xy] == MV_FROZEN) continue; av_assert1(!IS_INTRA(s->cur_pic.mb_type[mb_xy])); av_assert1(s->last_pic.f && s->last_pic.f->data[0]); j = 0; if (mb_x > 0 && fixed[mb_xy - 1] == MV_FROZEN) j = 1; if (mb_x + 1 < mb_width && fixed[mb_xy + 1] == MV_FROZEN) j = 1; if (mb_y > 0 && fixed[mb_xy - mb_stride] == MV_FROZEN) j = 1; if (mb_y + 1 < mb_height && fixed[mb_xy + mb_stride] == MV_FROZEN) j = 1; if (j == 0) continue; j = 0; if (mb_x > 0 && fixed[mb_xy - 1 ] == MV_CHANGED) j = 1; if (mb_x + 1 < mb_width && fixed[mb_xy + 1 ] == MV_CHANGED) j = 1; if (mb_y > 0 && fixed[mb_xy - mb_stride] == MV_CHANGED) j = 1; if (mb_y + 1 < mb_height && fixed[mb_xy + mb_stride] == MV_CHANGED) j = 1; if (j == 0 && pass > 1) continue; none_left = 0; if (mb_x > 0 && fixed[mb_xy - 1]) { mv_predictor[pred_count][0] = s->cur_pic.motion_val[0][mot_index - mot_step][0]; mv_predictor[pred_count][1] = s->cur_pic.motion_val[0][mot_index - mot_step][1]; ref[pred_count] = s->cur_pic.ref_index[0][4 * (mb_xy - 1)]; pred_count++; } if (mb_x + 1 < mb_width && fixed[mb_xy + 1]) { mv_predictor[pred_count][0] = s->cur_pic.motion_val[0][mot_index + mot_step][0]; mv_predictor[pred_count][1] = s->cur_pic.motion_val[0][mot_index + mot_step][1]; ref[pred_count] = s->cur_pic.ref_index[0][4 * (mb_xy + 1)]; pred_count++; } if (mb_y > 0 && fixed[mb_xy - mb_stride]) { mv_predictor[pred_count][0] = s->cur_pic.motion_val[0][mot_index - mot_stride * mot_step][0]; mv_predictor[pred_count][1] = s->cur_pic.motion_val[0][mot_index - mot_stride * mot_step][1]; ref[pred_count] = s->cur_pic.ref_index[0][4 * (mb_xy - s->mb_stride)]; pred_count++; } if (mb_y + 1<mb_height && fixed[mb_xy + mb_stride]) { mv_predictor[pred_count][0] = s->cur_pic.motion_val[0][mot_index + mot_stride * mot_step][0]; mv_predictor[pred_count][1] = s->cur_pic.motion_val[0][mot_index + mot_stride * mot_step][1]; ref[pred_count] = s->cur_pic.ref_index[0][4 * (mb_xy + s->mb_stride)]; pred_count++; } if (pred_count == 0) continue; if (pred_count > 1) { int sum_x = 0, sum_y = 0, sum_r = 0; int max_x, max_y, min_x, min_y, max_r, min_r; for (j = 0; j < pred_count; j++) { sum_x += mv_predictor[j][0]; sum_y += mv_predictor[j][1]; sum_r += ref[j]; if (j && ref[j] != ref[j - 1]) goto skip_mean_and_median; } /* mean */ mv_predictor[pred_count][0] = sum_x / j; mv_predictor[pred_count][1] = sum_y / j; ref[pred_count] = sum_r / j; /* median */ if (pred_count >= 3) { min_y = min_x = min_r = 99999; max_y = max_x = max_r = -99999; } else { min_x = min_y = max_x = max_y = min_r = max_r = 0; } for (j = 0; j < pred_count; j++) { max_x = FFMAX(max_x, mv_predictor[j][0]); max_y = FFMAX(max_y, mv_predictor[j][1]); max_r = FFMAX(max_r, ref[j]); min_x = FFMIN(min_x, mv_predictor[j][0]); min_y = FFMIN(min_y, mv_predictor[j][1]); min_r = FFMIN(min_r, ref[j]); } mv_predictor[pred_count + 1][0] = sum_x - max_x - min_x; mv_predictor[pred_count + 1][1] = sum_y - max_y - min_y; ref[pred_count + 1] = sum_r - max_r - min_r; if (pred_count == 4) { mv_predictor[pred_count + 1][0] /= 2; mv_predictor[pred_count + 1][1] /= 2; ref[pred_count + 1] /= 2; } pred_count += 2; } skip_mean_and_median: /* zero MV */ pred_count++; prev_x = s->cur_pic.motion_val[0][mot_index][0]; prev_y = s->cur_pic.motion_val[0][mot_index][1]; prev_ref = s->cur_pic.ref_index[0][4 * mb_xy]; /* last MV */ mv_predictor[pred_count][0] = prev_x; mv_predictor[pred_count][1] = prev_y; ref[pred_count] = prev_ref; pred_count++; for (j = 0; j < pred_count; j++) { int *linesize = s->cur_pic.f->linesize; int score = 0; uint8_t *src = s->cur_pic.f->data[0] + mb_x * 16 + mb_y * 16 * linesize[0]; s->cur_pic.motion_val[0][mot_index][0] = s->mv[0][0][0] = mv_predictor[j][0]; s->cur_pic.motion_val[0][mot_index][1] = s->mv[0][0][1] = mv_predictor[j][1]; // predictor intra or otherwise not available if (ref[j] < 0) continue; s->decode_mb(s->opaque, ref[j], MV_DIR_FORWARD, MV_TYPE_16X16, &s->mv, mb_x, mb_y, 0, 0); if (mb_x > 0 && fixed[mb_xy - 1]) { int k; for (k = 0; k < 16; k++) score += FFABS(src[k * linesize[0] - 1] - src[k * linesize[0]]); } if (mb_x + 1 < mb_width && fixed[mb_xy + 1]) { int k; for (k = 0; k < 16; k++) score += FFABS(src[k * linesize[0] + 15] - src[k * linesize[0] + 16]); } if (mb_y > 0 && fixed[mb_xy - mb_stride]) { int k; for (k = 0; k < 16; k++) score += FFABS(src[k - linesize[0]] - src[k]); } if (mb_y + 1 < mb_height && fixed[mb_xy + mb_stride]) { int k; for (k = 0; k < 16; k++) score += FFABS(src[k + linesize[0] * 15] - src[k + linesize[0] * 16]); } if (score <= best_score) { // <= will favor the last MV best_score = score; best_pred = j; } } score_sum += best_score; s->mv[0][0][0] = mv_predictor[best_pred][0]; s->mv[0][0][1] = mv_predictor[best_pred][1]; for (i = 0; i < mot_step; i++) for (j = 0; j < mot_step; j++) { s->cur_pic.motion_val[0][mot_index + i + j * mot_stride][0] = s->mv[0][0][0]; s->cur_pic.motion_val[0][mot_index + i + j * mot_stride][1] = s->mv[0][0][1]; } s->decode_mb(s->opaque, ref[best_pred], MV_DIR_FORWARD, MV_TYPE_16X16, &s->mv, mb_x, mb_y, 0, 0); if (s->mv[0][0][0] != prev_x || s->mv[0][0][1] != prev_y) { fixed[mb_xy] = MV_CHANGED; changed++; } else fixed[mb_xy] = MV_UNCHANGED; } } } if (none_left) return; for (i = 0; i < mb_width * mb_height; i++) { int mb_xy = s->mb_index2xy[i]; if (fixed[mb_xy]) fixed[mb_xy] = MV_FROZEN; } } }","No, it is non-vulnerable."913911,"static inline void gen_neon_narrow(int size, TCGv dest, TCGv src) { switch (size) { case 0: gen_helper_neon_narrow_u8(dest, src); break; case 1: gen_helper_neon_narrow_u16(dest, src); break; case 2: tcg_gen_trunc_i64_i32(dest, src); break; default: abort(); } }","No, it is non-vulnerable."914912,"int spapr_populate_pci_dt(sPAPRPHBState *phb, uint32_t xics_phandle, void *fdt) { int bus_off, i, j, ret; char nodename[FDT_NAME_MAX]; uint32_t bus_range[] = { cpu_to_be32(0), cpu_to_be32(0xff) }; const uint64_t mmiosize = memory_region_size(&phb->memwindow); const uint64_t w32max = (1ULL << 32) - SPAPR_PCI_MEM_WIN_BUS_OFFSET; const uint64_t w32size = MIN(w32max, mmiosize); const uint64_t w64size = (mmiosize > w32size) ? (mmiosize - w32size) : 0; struct { uint32_t hi; uint64_t child; uint64_t parent; uint64_t size; } QEMU_PACKED ranges[] = { { cpu_to_be32(b_ss(1)), cpu_to_be64(0), cpu_to_be64(phb->io_win_addr), cpu_to_be64(memory_region_size(&phb->iospace)), }, { cpu_to_be32(b_ss(2)), cpu_to_be64(SPAPR_PCI_MEM_WIN_BUS_OFFSET), cpu_to_be64(phb->mem_win_addr), cpu_to_be64(w32size), }, { cpu_to_be32(b_ss(3)), cpu_to_be64(1ULL << 32), cpu_to_be64(phb->mem_win_addr + w32size), cpu_to_be64(w64size) }, }; const unsigned sizeof_ranges = (w64size ? 3 : 2) * sizeof(ranges[0]); uint64_t bus_reg[] = { cpu_to_be64(phb->buid), 0 }; uint32_t interrupt_map_mask[] = { cpu_to_be32(b_ddddd(-1)|b_fff(0)), 0x0, 0x0, cpu_to_be32(-1)}; uint32_t interrupt_map[PCI_SLOT_MAX * PCI_NUM_PINS][7]; uint32_t ddw_applicable[] = { cpu_to_be32(RTAS_IBM_QUERY_PE_DMA_WINDOW), cpu_to_be32(RTAS_IBM_CREATE_PE_DMA_WINDOW), cpu_to_be32(RTAS_IBM_REMOVE_PE_DMA_WINDOW) }; uint32_t ddw_extensions[] = { cpu_to_be32(1), cpu_to_be32(RTAS_IBM_RESET_PE_DMA_WINDOW) }; uint32_t associativity[] = {cpu_to_be32(0x4), cpu_to_be32(0x0), cpu_to_be32(0x0), cpu_to_be32(0x0), cpu_to_be32(phb->numa_node)}; sPAPRTCETable *tcet; PCIBus *bus = PCI_HOST_BRIDGE(phb)->bus; sPAPRFDT s_fdt; /* Start populating the FDT */ snprintf(nodename, FDT_NAME_MAX, ""pci@%"" PRIx64, phb->buid); bus_off = fdt_add_subnode(fdt, 0, nodename); if (bus_off < 0) { return bus_off; } /* Write PHB properties */ _FDT(fdt_setprop_string(fdt, bus_off, ""device_type"", ""pci"")); _FDT(fdt_setprop_string(fdt, bus_off, ""compatible"", ""IBM,Logical_PHB"")); _FDT(fdt_setprop_cell(fdt, bus_off, ""#address-cells"", 0x3)); _FDT(fdt_setprop_cell(fdt, bus_off, ""#size-cells"", 0x2)); _FDT(fdt_setprop_cell(fdt, bus_off, ""#interrupt-cells"", 0x1)); _FDT(fdt_setprop(fdt, bus_off, ""used-by-rtas"", NULL, 0)); _FDT(fdt_setprop(fdt, bus_off, ""bus-range"", &bus_range, sizeof(bus_range))); _FDT(fdt_setprop(fdt, bus_off, ""ranges"", &ranges, sizeof_ranges)); _FDT(fdt_setprop(fdt, bus_off, ""reg"", &bus_reg, sizeof(bus_reg))); _FDT(fdt_setprop_cell(fdt, bus_off, ""ibm,pci-config-space-type"", 0x1)); _FDT(fdt_setprop_cell(fdt, bus_off, ""ibm,pe-total-#msi"", XICS_IRQS_SPAPR)); /* Dynamic DMA window */ if (phb->ddw_enabled) { _FDT(fdt_setprop(fdt, bus_off, ""ibm,ddw-applicable"", &ddw_applicable, sizeof(ddw_applicable))); _FDT(fdt_setprop(fdt, bus_off, ""ibm,ddw-extensions"", &ddw_extensions, sizeof(ddw_extensions))); } /* Advertise NUMA via ibm,associativity */ if (nb_numa_nodes > 1) { _FDT(fdt_setprop(fdt, bus_off, ""ibm,associativity"", associativity, sizeof(associativity))); } /* Build the interrupt-map, this must matches what is done * in pci_spapr_map_irq */ _FDT(fdt_setprop(fdt, bus_off, ""interrupt-map-mask"", &interrupt_map_mask, sizeof(interrupt_map_mask))); for (i = 0; i < PCI_SLOT_MAX; i++) { for (j = 0; j < PCI_NUM_PINS; j++) { uint32_t *irqmap = interrupt_map[i*PCI_NUM_PINS + j]; int lsi_num = pci_spapr_swizzle(i, j); irqmap[0] = cpu_to_be32(b_ddddd(i)|b_fff(0)); irqmap[1] = 0; irqmap[2] = 0; irqmap[3] = cpu_to_be32(j+1); irqmap[4] = cpu_to_be32(xics_phandle); irqmap[5] = cpu_to_be32(phb->lsi_table[lsi_num].irq); irqmap[6] = cpu_to_be32(0x8); } } /* Write interrupt map */ _FDT(fdt_setprop(fdt, bus_off, ""interrupt-map"", &interrupt_map, sizeof(interrupt_map))); tcet = spapr_tce_find_by_liobn(phb->dma_liobn[0]); if (!tcet) { return -1; } spapr_dma_dt(fdt, bus_off, ""ibm,dma-window"", tcet->liobn, tcet->bus_offset, tcet->nb_table << tcet->page_shift); /* Walk the bridges and program the bus numbers*/ spapr_phb_pci_enumerate(phb); _FDT(fdt_setprop_cell(fdt, bus_off, ""qemu,phb-enumerated"", 0x1)); /* Populate tree nodes with PCI devices attached */ s_fdt.fdt = fdt; s_fdt.node_off = bus_off; s_fdt.sphb = phb; pci_for_each_device(bus, pci_bus_num(bus), spapr_populate_pci_devices_dt, &s_fdt); ret = spapr_drc_populate_dt(fdt, bus_off, OBJECT(phb), SPAPR_DR_CONNECTOR_TYPE_PCI); if (ret) { return ret; } return 0; }","No, it is non-vulnerable."915913,"void spapr_dt_events(void *fdt, uint32_t check_exception_irq) { int event_sources, epow_events; uint32_t irq_ranges[] = {cpu_to_be32(check_exception_irq), cpu_to_be32(1)}; uint32_t interrupts[] = {cpu_to_be32(check_exception_irq), 0}; _FDT(event_sources = fdt_add_subnode(fdt, 0, ""event-sources"")); _FDT(fdt_setprop(fdt, event_sources, ""interrupt-controller"", NULL, 0)); _FDT(fdt_setprop_cell(fdt, event_sources, ""#interrupt-cells"", 2)); _FDT(fdt_setprop(fdt, event_sources, ""interrupt-ranges"", irq_ranges, sizeof(irq_ranges))); _FDT(epow_events = fdt_add_subnode(fdt, event_sources, ""epow-events"")); _FDT(fdt_setprop(fdt, epow_events, ""interrupts"", interrupts, sizeof(interrupts))); }","No, it is non-vulnerable."916914,"static void ff_dlog_link(void *ctx, AVFilterLink *link, int end) { if (link->type == AVMEDIA_TYPE_VIDEO) { av_dlog(ctx, ""link[%p s:%dx%d fmt:%-16s %-16s->%-16s]%s"", link, link->w, link->h, av_pix_fmt_descriptors[link->format].name, link->src ? link->src->filter->name : """", link->dst ? link->dst->filter->name : """", end ? ""\n"" : """"); } else { char buf[128]; av_get_channel_layout_string(buf, sizeof(buf), -1, link->channel_layout); av_dlog(ctx, ""link[%p r:%""PRId64"" cl:%s fmt:%-16s %-16s->%-16s]%s"", link, link->sample_rate, buf, av_get_sample_fmt_name(link->format), link->src ? link->src->filter->name : """", link->dst ? link->dst->filter->name : """", end ? ""\n"" : """"); } }","No, it is non-vulnerable."917915,"static int vmdk_write(BlockDriverState *bs, int64_t sector_num, const uint8_t *buf, int nb_sectors, bool zeroed, bool zero_dry_run) { BDRVVmdkState *s = bs->opaque; VmdkExtent *extent = NULL; int n, ret; int64_t index_in_cluster; uint64_t extent_begin_sector, extent_relative_sector_num; uint64_t cluster_offset; VmdkMetaData m_data; if (sector_num > bs->total_sectors) { error_report(""Wrong offset: sector_num=0x%"" PRIx64 "" total_sectors=0x%"" PRIx64 ""\n"", sector_num, bs->total_sectors); return -EIO; } while (nb_sectors > 0) { extent = find_extent(s, sector_num, extent); if (!extent) { return -EIO; } ret = get_cluster_offset( bs, extent, &m_data, sector_num << 9, !extent->compressed, &cluster_offset); if (extent->compressed) { if (ret == VMDK_OK) { /* Refuse write to allocated cluster for streamOptimized */ error_report(""Could not write to allocated cluster"" "" for streamOptimized""); return -EIO; } else { /* allocate */ ret = get_cluster_offset( bs, extent, &m_data, sector_num << 9, 1, &cluster_offset); } } if (ret == VMDK_ERROR) { return -EINVAL; } extent_begin_sector = extent->end_sector - extent->sectors; extent_relative_sector_num = sector_num - extent_begin_sector; index_in_cluster = extent_relative_sector_num % extent->cluster_sectors; n = extent->cluster_sectors - index_in_cluster; if (n > nb_sectors) { n = nb_sectors; } if (zeroed) { /* Do zeroed write, buf is ignored */ if (extent->has_zero_grain && index_in_cluster == 0 && n >= extent->cluster_sectors) { n = extent->cluster_sectors; if (!zero_dry_run) { m_data.offset = VMDK_GTE_ZEROED; /* update L2 tables */ if (vmdk_L2update(extent, &m_data) != VMDK_OK) { return -EIO; } } } else { return -ENOTSUP; } } else { ret = vmdk_write_extent(extent, cluster_offset, index_in_cluster * 512, buf, n, sector_num); if (ret) { return ret; } if (m_data.valid) { /* update L2 tables */ if (vmdk_L2update(extent, &m_data) != VMDK_OK) { return -EIO; } } } nb_sectors -= n; sector_num += n; buf += n * 512; /* update CID on the first write every time the virtual disk is * opened */ if (!s->cid_updated) { ret = vmdk_write_cid(bs, time(NULL)); if (ret < 0) { return ret; } s->cid_updated = true; } } return 0; }","Yes, it is vulnerable."918916,"void qmp_migrate_set_capabilities(MigrationCapabilityStatusList *params, Error **errp) { MigrationState *s = migrate_get_current(); MigrationCapabilityStatusList *cap; if (s->state == MIG_STATE_ACTIVE || s->state == MIG_STATE_SETUP) { error_set(errp, QERR_MIGRATION_ACTIVE); return; } for (cap = params; cap; cap = cap->next) { s->enabled_capabilities[cap->value->capability] = cap->value->state; } }","Yes, it is vulnerable."919917,void qmp_qmp_capabilities(Error **errp) { cur_mon->qmp.in_command_mode = true; },"Yes, it is vulnerable."920918,"static int http_connect(URLContext *h, const char *path, const char *hoststr, const char *auth, int *new_location) { HTTPContext *s = h->priv_data; int post, err; char line[1024]; char headers[1024] = """"; char *authstr = NULL; int64_t off = s->off; int len = 0; /* send http header */ post = h->flags & URL_WRONLY; authstr = ff_http_auth_create_response(&s->auth_state, auth, path, post ? ""POST"" : ""GET""); /* set default headers if needed */ if (!has_header(s->headers, ""\r\nUser-Agent: "")) len += av_strlcatf(headers + len, sizeof(headers) - len, ""User-Agent: %s\r\n"", LIBAVFORMAT_IDENT); if (!has_header(s->headers, ""\r\nAccept: "")) len += av_strlcpy(headers + len, ""Accept: */*\r\n"", sizeof(headers) - len); if (!has_header(s->headers, ""\r\nRange: "")) len += av_strlcatf(headers + len, sizeof(headers) - len, ""Range: bytes=%""PRId64""-\r\n"", s->off); if (!has_header(s->headers, ""\r\nConnection: "")) len += av_strlcpy(headers + len, ""Connection: close\r\n"", sizeof(headers)-len); if (!has_header(s->headers, ""\r\nHost: "")) len += av_strlcatf(headers + len, sizeof(headers) - len, ""Host: %s\r\n"", hoststr); /* now add in custom headers */ av_strlcpy(headers+len, s->headers, sizeof(headers)-len); snprintf(s->buffer, sizeof(s->buffer), ""%s %s HTTP/1.1\r\n"" ""%s"" ""%s"" ""%s"" ""\r\n"", post ? ""POST"" : ""GET"", path, post && s->is_chunked ? ""Transfer-Encoding: chunked\r\n"" : """", headers, authstr ? authstr : """"); av_freep(&authstr); if (http_write(h, s->buffer, strlen(s->buffer)) < 0) return AVERROR(EIO); /* init input buffer */ s->buf_ptr = s->buffer; s->buf_end = s->buffer; s->line_count = 0; s->off = 0; s->filesize = -1; if (post) { /* always use chunked encoding for upload data */ s->chunksize = 0; /* Pretend that it did work. We didn't read any header yet, since * we've still to send the POST data, but the code calling this * function will check http_code after we return. */ s->http_code = 200; return 0; } /* wait for header */ for(;;) { if (http_get_line(s, line, sizeof(line)) < 0) return AVERROR(EIO); dprintf(NULL, ""header='%s'\n"", line); err = process_line(h, line, s->line_count, new_location); if (err < 0) return err; if (err == 0) break; s->line_count++; } return (off == s->off) ? 0 : -1; }","No, it is non-vulnerable."921919,"static int dxtory_decode_v2_rgb(AVCodecContext *avctx, AVFrame *pic, const uint8_t *src, int src_size) { GetByteContext gb; GetBitContext gb2; int nslices, slice, slice_height; uint32_t off, slice_size; uint8_t *dst; int ret; bytestream2_init(&gb, src, src_size); nslices = bytestream2_get_le16(&gb); off = FFALIGN(nslices * 4 + 2, 16); if (src_size < off) { av_log(avctx, AV_LOG_ERROR, ""no slice data\n""); return AVERROR_INVALIDDATA; } if (!nslices || avctx->height % nslices) { avpriv_request_sample(avctx, ""%d slices for %dx%d"", nslices, avctx->width, avctx->height); return AVERROR_PATCHWELCOME; } slice_height = avctx->height / nslices; avctx->pix_fmt = AV_PIX_FMT_BGR24; if ((ret = ff_get_buffer(avctx, pic, 0)) < 0) return ret; dst = pic->data[0]; for (slice = 0; slice < nslices; slice++) { slice_size = bytestream2_get_le32(&gb); if (slice_size > src_size - off) { av_log(avctx, AV_LOG_ERROR, ""invalid slice size %""PRIu32"" (only %""PRIu32"" bytes left)\n"", slice_size, src_size - off); return AVERROR_INVALIDDATA; } if (slice_size <= 16) { av_log(avctx, AV_LOG_ERROR, ""invalid slice size %""PRIu32""\n"", slice_size); return AVERROR_INVALIDDATA; } if (AV_RL32(src + off) != slice_size - 16) { av_log(avctx, AV_LOG_ERROR, ""Slice sizes mismatch: got %""PRIu32"" instead of %""PRIu32""\n"", AV_RL32(src + off), slice_size - 16); } init_get_bits(&gb2, src + off + 16, (slice_size - 16) * 8); dx2_decode_slice_rgb(&gb2, avctx->width, slice_height, dst, pic->linesize[0]); dst += pic->linesize[0] * slice_height; off += slice_size; } return 0; }","No, it is non-vulnerable."922920,void dsputil_init_mlib(void) { put_pixels_tab[0][0] = put_pixels16_mlib; put_pixels_tab[0][1] = put_pixels16_x2_mlib; put_pixels_tab[0][2] = put_pixels16_y2_mlib; put_pixels_tab[0][3] = put_pixels16_xy2_mlib; put_pixels_tab[1][0] = put_pixels8_mlib; put_pixels_tab[1][1] = put_pixels8_x2_mlib; put_pixels_tab[1][2] = put_pixels8_y2_mlib; put_pixels_tab[1][3] = put_pixels8_xy2_mlib; avg_pixels_tab[0][0] = avg_pixels16_mlib; avg_pixels_tab[0][1] = avg_pixels16_x2_mlib; avg_pixels_tab[0][2] = avg_pixels16_y2_mlib; avg_pixels_tab[0][3] = avg_pixels16_xy2_mlib; avg_pixels_tab[1][0] = avg_pixels8_mlib; avg_pixels_tab[1][1] = avg_pixels8_x2_mlib; avg_pixels_tab[1][2] = avg_pixels8_y2_mlib; avg_pixels_tab[1][3] = avg_pixels8_xy2_mlib; put_no_rnd_pixels_tab[0][0] = put_pixels16_mlib; put_no_rnd_pixels_tab[1][0] = put_pixels8_mlib; add_pixels_clamped = add_pixels_clamped_mlib; },"No, it is non-vulnerable."923921,"static inline int handle_cpu_signal(uintptr_t pc, unsigned long address, int is_write, sigset_t *old_set) { CPUState *cpu = current_cpu; CPUClass *cc; int ret; /* We must handle PC addresses from two different sources: * a call return address and a signal frame address. * * Within cpu_restore_state_from_tb we assume the former and adjust * the address by -GETPC_ADJ so that the address is within the call * insn so that addr does not accidentally match the beginning of the * next guest insn. * * However, when the PC comes from the signal frame, it points to * the actual faulting host insn and not a call insn. Subtracting * GETPC_ADJ in that case may accidentally match the previous guest insn. * * So for the later case, adjust forward to compensate for what * will be done later by cpu_restore_state_from_tb. */ if (helper_retaddr) { pc = helper_retaddr; } else { pc += GETPC_ADJ; } /* For synchronous signals we expect to be coming from the vCPU * thread (so current_cpu should be valid) and either from running * code or during translation which can fault as we cross pages. * * If neither is true then something has gone wrong and we should * abort rather than try and restart the vCPU execution. */ if (!cpu || !cpu->running) { printf(""qemu:%s received signal outside vCPU context @ pc=0x%"" PRIxPTR ""\n"", __func__, pc); abort(); } #if defined(DEBUG_SIGNAL) printf(""qemu: SIGSEGV pc=0x%08lx address=%08lx w=%d oldset=0x%08lx\n"", pc, address, is_write, *(unsigned long *)old_set); #endif /* XXX: locking issue */ if (is_write && h2g_valid(address)) { switch (page_unprotect(h2g(address), pc)) { case 0: /* Fault not caused by a page marked unwritable to protect * cached translations, must be the guest binary's problem. */ break; case 1: /* Fault caused by protection of cached translation; TBs * invalidated, so resume execution. Retain helper_retaddr * for a possible second fault. */ return 1; case 2: /* Fault caused by protection of cached translation, and the * currently executing TB was modified and must be exited * immediately. Clear helper_retaddr for next execution. */ helper_retaddr = 0; cpu_exit_tb_from_sighandler(cpu, old_set); /* NORETURN */ default: g_assert_not_reached(); } } /* Convert forcefully to guest address space, invalid addresses are still valid segv ones */ address = h2g_nocheck(address); cc = CPU_GET_CLASS(cpu); /* see if it is an MMU fault */ g_assert(cc->handle_mmu_fault); ret = cc->handle_mmu_fault(cpu, address, is_write, MMU_USER_IDX); if (ret == 0) { /* The MMU fault was handled without causing real CPU fault. * Retain helper_retaddr for a possible second fault. */ return 1; } /* All other paths lead to cpu_exit; clear helper_retaddr * for next execution. */ helper_retaddr = 0; if (ret < 0) { return 0; /* not an MMU fault */ } /* Now we have a real cpu fault. */ cpu_restore_state(cpu, pc); sigprocmask(SIG_SETMASK, old_set, NULL); cpu_loop_exit(cpu); /* never comes here */ return 1; }","No, it is non-vulnerable."924922,"static inline bool media_is_cd(SCSIDiskState *s) { uint64_t nb_sectors; if (s->qdev.type != TYPE_ROM) { return false; } if (!bdrv_is_inserted(s->qdev.conf.bs)) { return false; } bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors); return nb_sectors <= CD_MAX_SECTORS; }","No, it is non-vulnerable."925923,"static void lm32_uclinux_init(QEMUMachineInitArgs *args) { const char *cpu_model = args->cpu_model; const char *kernel_filename = args->kernel_filename; const char *kernel_cmdline = args->kernel_cmdline; const char *initrd_filename = args->initrd_filename; LM32CPU *cpu; CPULM32State *env; DriveInfo *dinfo; MemoryRegion *address_space_mem = get_system_memory(); MemoryRegion *phys_ram = g_new(MemoryRegion, 1); qemu_irq *cpu_irq, irq[32]; HWSetup *hw; ResetInfo *reset_info; int i; /* memory map */ hwaddr flash_base = 0x04000000; size_t flash_sector_size = 256 * 1024; size_t flash_size = 32 * 1024 * 1024; hwaddr ram_base = 0x08000000; size_t ram_size = 64 * 1024 * 1024; hwaddr uart0_base = 0x80000000; hwaddr timer0_base = 0x80002000; hwaddr timer1_base = 0x80010000; hwaddr timer2_base = 0x80012000; int uart0_irq = 0; int timer0_irq = 1; int timer1_irq = 20; int timer2_irq = 21; hwaddr hwsetup_base = 0x0bffe000; hwaddr cmdline_base = 0x0bfff000; hwaddr initrd_base = 0x08400000; size_t initrd_max = 0x01000000; reset_info = g_malloc0(sizeof(ResetInfo)); if (cpu_model == NULL) { cpu_model = ""lm32-full""; cpu = cpu_lm32_init(cpu_model); env = &cpu->env; reset_info->cpu = cpu; reset_info->flash_base = flash_base; memory_region_init_ram(phys_ram, NULL, ""lm32_uclinux.sdram"", ram_size); vmstate_register_ram_global(phys_ram); memory_region_add_subregion(address_space_mem, ram_base, phys_ram); dinfo = drive_get(IF_PFLASH, 0, 0); /* Spansion S29NS128P */ pflash_cfi02_register(flash_base, NULL, ""lm32_uclinux.flash"", flash_size, dinfo ? dinfo->bdrv : NULL, flash_sector_size, flash_size / flash_sector_size, 1, 2, 0x01, 0x7e, 0x43, 0x00, 0x555, 0x2aa, 1); /* create irq lines */ cpu_irq = qemu_allocate_irqs(cpu_irq_handler, env, 1); env->pic_state = lm32_pic_init(*cpu_irq); for (i = 0; i < 32; i++) { irq[i] = qdev_get_gpio_in(env->pic_state, i); sysbus_create_simple(""lm32-uart"", uart0_base, irq[uart0_irq]); sysbus_create_simple(""lm32-timer"", timer0_base, irq[timer0_irq]); sysbus_create_simple(""lm32-timer"", timer1_base, irq[timer1_irq]); sysbus_create_simple(""lm32-timer"", timer2_base, irq[timer2_irq]); /* make sure juart isn't the first chardev */ env->juart_state = lm32_juart_init(); reset_info->bootstrap_pc = flash_base; if (kernel_filename) { uint64_t entry; int kernel_size; kernel_size = load_elf(kernel_filename, NULL, NULL, &entry, NULL, NULL, 1, ELF_MACHINE, 0); reset_info->bootstrap_pc = entry; if (kernel_size < 0) { kernel_size = load_image_targphys(kernel_filename, ram_base, ram_size); reset_info->bootstrap_pc = ram_base; if (kernel_size < 0) { fprintf(stderr, ""qemu: could not load kernel '%s'\n"", kernel_filename); /* generate a rom with the hardware description */ hw = hwsetup_init(); hwsetup_add_cpu(hw, ""LM32"", 75000000); hwsetup_add_flash(hw, ""flash"", flash_base, flash_size); hwsetup_add_ddr_sdram(hw, ""ddr_sdram"", ram_base, ram_size); hwsetup_add_timer(hw, ""timer0"", timer0_base, timer0_irq); hwsetup_add_timer(hw, ""timer1_dev_only"", timer1_base, timer1_irq); hwsetup_add_timer(hw, ""timer2_dev_only"", timer2_base, timer2_irq); hwsetup_add_uart(hw, ""uart"", uart0_base, uart0_irq); hwsetup_add_trailer(hw); hwsetup_create_rom(hw, hwsetup_base); hwsetup_free(hw); reset_info->hwsetup_base = hwsetup_base; if (kernel_cmdline && strlen(kernel_cmdline)) { pstrcpy_targphys(""cmdline"", cmdline_base, TARGET_PAGE_SIZE, kernel_cmdline); reset_info->cmdline_base = cmdline_base; if (initrd_filename) { size_t initrd_size; initrd_size = load_image_targphys(initrd_filename, initrd_base, initrd_max); reset_info->initrd_base = initrd_base; reset_info->initrd_size = initrd_size; qemu_register_reset(main_cpu_reset, reset_info);","Yes, it is vulnerable."926924,static av_cold int m101_decode_init(AVCodecContext *avctx) { if (avctx->extradata_size < 6*4) return AVERROR_INVALIDDATA; if (avctx->extradata[2*4] == 10) avctx->pix_fmt = AV_PIX_FMT_YUV422P10; else avctx->pix_fmt = AV_PIX_FMT_YUYV422; return 0; },"Yes, it is vulnerable."927925,"static int mpeg4_decode_mb(MpegEncContext *s, int16_t block[6][64]) { Mpeg4DecContext *ctx = (Mpeg4DecContext *)s; int cbpc, cbpy, i, cbp, pred_x, pred_y, mx, my, dquant; int16_t *mot_val; static const int8_t quant_tab[4] = { -1, -2, 1, 2 }; const int xy = s->mb_x + s->mb_y * s->mb_stride; av_assert2(s->h263_pred); if (s->pict_type == AV_PICTURE_TYPE_P || s->pict_type == AV_PICTURE_TYPE_S) { do { if (get_bits1(&s->gb)) { /* skip mb */ s->mb_intra = 0; for (i = 0; i < 6; i++) s->block_last_index[i] = -1; s->mv_dir = MV_DIR_FORWARD; s->mv_type = MV_TYPE_16X16; if (s->pict_type == AV_PICTURE_TYPE_S && ctx->vol_sprite_usage == GMC_SPRITE) { s->current_picture.mb_type[xy] = MB_TYPE_SKIP | MB_TYPE_GMC | MB_TYPE_16x16 | MB_TYPE_L0; s->mcsel = 1; s->mv[0][0][0] = get_amv(ctx, 0); s->mv[0][0][1] = get_amv(ctx, 1); s->mb_skipped = 0; } else { s->current_picture.mb_type[xy] = MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_L0; s->mcsel = 0; s->mv[0][0][0] = 0; s->mv[0][0][1] = 0; s->mb_skipped = 1; goto end; cbpc = get_vlc2(&s->gb, ff_h263_inter_MCBPC_vlc.table, INTER_MCBPC_VLC_BITS, 2); if (cbpc < 0) { ""mcbpc damaged at %d %d\n"", s->mb_x, s->mb_y); return -1; } while (cbpc == 20); s->bdsp.clear_blocks(s->block[0]); dquant = cbpc & 8; s->mb_intra = ((cbpc & 4) != 0); if (s->mb_intra) goto intra; if (s->pict_type == AV_PICTURE_TYPE_S && ctx->vol_sprite_usage == GMC_SPRITE && (cbpc & 16) == 0) s->mcsel = get_bits1(&s->gb); else s->mcsel = 0; cbpy = get_vlc2(&s->gb, ff_h263_cbpy_vlc.table, CBPY_VLC_BITS, 1) ^ 0x0F; cbp = (cbpc & 3) | (cbpy << 2); if (dquant) ff_set_qscale(s, s->qscale + quant_tab[get_bits(&s->gb, 2)]); if ((!s->progressive_sequence) && (cbp || (s->workaround_bugs & FF_BUG_XVID_ILACE))) s->interlaced_dct = get_bits1(&s->gb); s->mv_dir = MV_DIR_FORWARD; if ((cbpc & 16) == 0) { if (s->mcsel) { s->current_picture.mb_type[xy] = MB_TYPE_GMC | MB_TYPE_16x16 | MB_TYPE_L0; /* 16x16 global motion prediction */ s->mv_type = MV_TYPE_16X16; mx = get_amv(ctx, 0); my = get_amv(ctx, 1); s->mv[0][0][0] = mx; s->mv[0][0][1] = my; } else if ((!s->progressive_sequence) && get_bits1(&s->gb)) { s->current_picture.mb_type[xy] = MB_TYPE_16x8 | MB_TYPE_L0 | MB_TYPE_INTERLACED; /* 16x8 field motion prediction */ s->mv_type = MV_TYPE_FIELD; s->field_select[0][0] = get_bits1(&s->gb); s->field_select[0][1] = get_bits1(&s->gb); ff_h263_pred_motion(s, 0, 0, &pred_x, &pred_y); for (i = 0; i < 2; i++) { mx = ff_h263_decode_motion(s, pred_x, s->f_code); if (mx >= 0xffff) return -1; my = ff_h263_decode_motion(s, pred_y / 2, s->f_code); if (my >= 0xffff) return -1; s->mv[0][i][0] = mx; s->mv[0][i][1] = my; } else { s->current_picture.mb_type[xy] = MB_TYPE_16x16 | MB_TYPE_L0; /* 16x16 motion prediction */ s->mv_type = MV_TYPE_16X16; ff_h263_pred_motion(s, 0, 0, &pred_x, &pred_y); mx = ff_h263_decode_motion(s, pred_x, s->f_code); if (mx >= 0xffff) return -1; my = ff_h263_decode_motion(s, pred_y, s->f_code); if (my >= 0xffff) return -1; s->mv[0][0][0] = mx; s->mv[0][0][1] = my; } else { s->current_picture.mb_type[xy] = MB_TYPE_8x8 | MB_TYPE_L0; s->mv_type = MV_TYPE_8X8; for (i = 0; i < 4; i++) { mot_val = ff_h263_pred_motion(s, i, 0, &pred_x, &pred_y); mx = ff_h263_decode_motion(s, pred_x, s->f_code); if (mx >= 0xffff) return -1; my = ff_h263_decode_motion(s, pred_y, s->f_code); if (my >= 0xffff) return -1; s->mv[0][i][0] = mx; s->mv[0][i][1] = my; mot_val[0] = mx; mot_val[1] = my; } else if (s->pict_type == AV_PICTURE_TYPE_B) { int modb1; // first bit of modb int modb2; // second bit of modb int mb_type; s->mb_intra = 0; // B-frames never contain intra blocks s->mcsel = 0; // ... true gmc blocks if (s->mb_x == 0) { for (i = 0; i < 2; i++) { s->last_mv[i][0][0] = s->last_mv[i][0][1] = s->last_mv[i][1][0] = s->last_mv[i][1][1] = 0; ff_thread_await_progress(&s->next_picture_ptr->tf, s->mb_y, 0); /* if we skipped it in the future P Frame than skip it now too */ s->mb_skipped = s->next_picture.mbskip_table[s->mb_y * s->mb_stride + s->mb_x]; // Note, skiptab=0 if last was GMC if (s->mb_skipped) { /* skip mb */ for (i = 0; i < 6; i++) s->block_last_index[i] = -1; s->mv_dir = MV_DIR_FORWARD; s->mv_type = MV_TYPE_16X16; s->mv[0][0][0] = s->mv[0][0][1] = s->mv[1][0][0] = s->mv[1][0][1] = 0; s->current_picture.mb_type[xy] = MB_TYPE_SKIP | MB_TYPE_16x16 | MB_TYPE_L0; goto end; modb1 = get_bits1(&s->gb); if (modb1) { // like MB_TYPE_B_DIRECT but no vectors coded mb_type = MB_TYPE_DIRECT2 | MB_TYPE_SKIP | MB_TYPE_L0L1; cbp = 0; } else { modb2 = get_bits1(&s->gb); mb_type = get_vlc2(&s->gb, mb_type_b_vlc.table, MB_TYPE_B_VLC_BITS, 1); if (mb_type < 0) { av_log(s->avctx, AV_LOG_ERROR, ""illegal MB_type\n""); return -1; mb_type = mb_type_b_map[mb_type]; if (modb2) { cbp = 0; } else { s->bdsp.clear_blocks(s->block[0]); cbp = get_bits(&s->gb, 6); if ((!IS_DIRECT(mb_type)) && cbp) { if (get_bits1(&s->gb)) ff_set_qscale(s, s->qscale + get_bits1(&s->gb) * 4 - 2); if (!s->progressive_sequence) { if (cbp) s->interlaced_dct = get_bits1(&s->gb); if (!IS_DIRECT(mb_type) && get_bits1(&s->gb)) { mb_type |= MB_TYPE_16x8 | MB_TYPE_INTERLACED; mb_type &= ~MB_TYPE_16x16; if (USES_LIST(mb_type, 0)) { s->field_select[0][0] = get_bits1(&s->gb); s->field_select[0][1] = get_bits1(&s->gb); if (USES_LIST(mb_type, 1)) { s->field_select[1][0] = get_bits1(&s->gb); s->field_select[1][1] = get_bits1(&s->gb); s->mv_dir = 0; if ((mb_type & (MB_TYPE_DIRECT2 | MB_TYPE_INTERLACED)) == 0) { s->mv_type = MV_TYPE_16X16; if (USES_LIST(mb_type, 0)) { s->mv_dir = MV_DIR_FORWARD; mx = ff_h263_decode_motion(s, s->last_mv[0][0][0], s->f_code); my = ff_h263_decode_motion(s, s->last_mv[0][0][1], s->f_code); s->last_mv[0][1][0] = s->last_mv[0][0][0] = s->mv[0][0][0] = mx; s->last_mv[0][1][1] = s->last_mv[0][0][1] = s->mv[0][0][1] = my; if (USES_LIST(mb_type, 1)) { s->mv_dir |= MV_DIR_BACKWARD; mx = ff_h263_decode_motion(s, s->last_mv[1][0][0], s->b_code); my = ff_h263_decode_motion(s, s->last_mv[1][0][1], s->b_code); s->last_mv[1][1][0] = s->last_mv[1][0][0] = s->mv[1][0][0] = mx; s->last_mv[1][1][1] = s->last_mv[1][0][1] = s->mv[1][0][1] = my; } else if (!IS_DIRECT(mb_type)) { s->mv_type = MV_TYPE_FIELD; if (USES_LIST(mb_type, 0)) { s->mv_dir = MV_DIR_FORWARD; for (i = 0; i < 2; i++) { mx = ff_h263_decode_motion(s, s->last_mv[0][i][0], s->f_code); my = ff_h263_decode_motion(s, s->last_mv[0][i][1] / 2, s->f_code); s->last_mv[0][i][0] = s->mv[0][i][0] = mx; s->last_mv[0][i][1] = (s->mv[0][i][1] = my) * 2; if (USES_LIST(mb_type, 1)) { s->mv_dir |= MV_DIR_BACKWARD; for (i = 0; i < 2; i++) { mx = ff_h263_decode_motion(s, s->last_mv[1][i][0], s->b_code); my = ff_h263_decode_motion(s, s->last_mv[1][i][1] / 2, s->b_code); s->last_mv[1][i][0] = s->mv[1][i][0] = mx; s->last_mv[1][i][1] = (s->mv[1][i][1] = my) * 2; if (IS_DIRECT(mb_type)) { if (IS_SKIP(mb_type)) { mx = my = 0; } else { mx = ff_h263_decode_motion(s, 0, 1); my = ff_h263_decode_motion(s, 0, 1); s->mv_dir = MV_DIR_FORWARD | MV_DIR_BACKWARD | MV_DIRECT; mb_type |= ff_mpeg4_set_direct_mv(s, mx, my); s->current_picture.mb_type[xy] = mb_type; } else { /* I-Frame */ do { cbpc = get_vlc2(&s->gb, ff_h263_intra_MCBPC_vlc.table, INTRA_MCBPC_VLC_BITS, 2); if (cbpc < 0) { ""I cbpc damaged at %d %d\n"", s->mb_x, s->mb_y); return -1; } while (cbpc == 8); dquant = cbpc & 4; s->mb_intra = 1; intra: s->ac_pred = get_bits1(&s->gb); if (s->ac_pred) s->current_picture.mb_type[xy] = MB_TYPE_INTRA | MB_TYPE_ACPRED; else s->current_picture.mb_type[xy] = MB_TYPE_INTRA; cbpy = get_vlc2(&s->gb, ff_h263_cbpy_vlc.table, CBPY_VLC_BITS, 1); ""I cbpy damaged at %d %d\n"", s->mb_x, s->mb_y); return -1; cbp = (cbpc & 3) | (cbpy << 2); ctx->use_intra_dc_vlc = s->qscale < ctx->intra_dc_threshold; if (dquant) ff_set_qscale(s, s->qscale + quant_tab[get_bits(&s->gb, 2)]); if (!s->progressive_sequence) s->interlaced_dct = get_bits1(&s->gb); s->bdsp.clear_blocks(s->block[0]); /* decode each block */ for (i = 0; i < 6; i++) { if (mpeg4_decode_block(ctx, block[i], i, cbp & 32, 1, 0) < 0) return -1; cbp += cbp; goto end; /* decode each block */ for (i = 0; i < 6; i++) { if (mpeg4_decode_block(ctx, block[i], i, cbp & 32, 0, 0) < 0) return -1; cbp += cbp; end: /* per-MB end of slice check */ if (s->codec_id == AV_CODEC_ID_MPEG4) { int next = mpeg4_is_resync(ctx); if (next) { if (s->mb_x + s->mb_y*s->mb_width + 1 > next && (s->avctx->err_recognition & AV_EF_AGGRESSIVE)) { return -1; } else if (s->mb_x + s->mb_y*s->mb_width + 1 >= next) return SLICE_END; if (s->pict_type == AV_PICTURE_TYPE_B) { const int delta= s->mb_x + 1 == s->mb_width ? 2 : 1; ff_thread_await_progress(&s->next_picture_ptr->tf, (s->mb_x + delta >= s->mb_width) ? FFMIN(s->mb_y + 1, s->mb_height - 1) : s->mb_y, 0); if (s->next_picture.mbskip_table[xy + delta]) return SLICE_OK; return SLICE_END; return SLICE_OK;","Yes, it is vulnerable."928926,"static void arm_cpu_realizefn(DeviceState *dev, Error **errp) { CPUState *cs = CPU(dev); ARMCPU *cpu = ARM_CPU(dev); ARMCPUClass *acc = ARM_CPU_GET_CLASS(dev); CPUARMState *env = &cpu->env; int pagebits; Error *local_err = NULL; cpu_exec_realizefn(cs, &local_err); if (local_err != NULL) { error_propagate(errp, local_err); return; } /* Some features automatically imply others: */ if (arm_feature(env, ARM_FEATURE_V8)) { set_feature(env, ARM_FEATURE_V7); set_feature(env, ARM_FEATURE_ARM_DIV); set_feature(env, ARM_FEATURE_LPAE); } if (arm_feature(env, ARM_FEATURE_V7)) { set_feature(env, ARM_FEATURE_VAPA); set_feature(env, ARM_FEATURE_THUMB2); set_feature(env, ARM_FEATURE_MPIDR); if (!arm_feature(env, ARM_FEATURE_M)) { set_feature(env, ARM_FEATURE_V6K); } else { set_feature(env, ARM_FEATURE_V6); } /* Always define VBAR for V7 CPUs even if it doesn't exist in * non-EL3 configs. This is needed by some legacy boards. */ set_feature(env, ARM_FEATURE_VBAR); } if (arm_feature(env, ARM_FEATURE_V6K)) { set_feature(env, ARM_FEATURE_V6); set_feature(env, ARM_FEATURE_MVFR); } if (arm_feature(env, ARM_FEATURE_V6)) { set_feature(env, ARM_FEATURE_V5); if (!arm_feature(env, ARM_FEATURE_M)) { set_feature(env, ARM_FEATURE_AUXCR); } } if (arm_feature(env, ARM_FEATURE_V5)) { set_feature(env, ARM_FEATURE_V4T); } if (arm_feature(env, ARM_FEATURE_M)) { set_feature(env, ARM_FEATURE_THUMB_DIV); } if (arm_feature(env, ARM_FEATURE_ARM_DIV)) { set_feature(env, ARM_FEATURE_THUMB_DIV); } if (arm_feature(env, ARM_FEATURE_VFP4)) { set_feature(env, ARM_FEATURE_VFP3); set_feature(env, ARM_FEATURE_VFP_FP16); } if (arm_feature(env, ARM_FEATURE_VFP3)) { set_feature(env, ARM_FEATURE_VFP); } if (arm_feature(env, ARM_FEATURE_LPAE)) { set_feature(env, ARM_FEATURE_V7MP); set_feature(env, ARM_FEATURE_PXN); } if (arm_feature(env, ARM_FEATURE_CBAR_RO)) { set_feature(env, ARM_FEATURE_CBAR); } if (arm_feature(env, ARM_FEATURE_THUMB2) && !arm_feature(env, ARM_FEATURE_M)) { set_feature(env, ARM_FEATURE_THUMB_DSP); } if (arm_feature(env, ARM_FEATURE_V7) && !arm_feature(env, ARM_FEATURE_M) && !arm_feature(env, ARM_FEATURE_PMSA)) { /* v7VMSA drops support for the old ARMv5 tiny pages, so we * can use 4K pages. */ pagebits = 12; } else { /* For CPUs which might have tiny 1K pages, or which have an * MPU and might have small region sizes, stick with 1K pages. */ pagebits = 10; } if (!set_preferred_target_page_bits(pagebits)) { /* This can only ever happen for hotplugging a CPU, or if * the board code incorrectly creates a CPU which it has * promised via minimum_page_size that it will not. */ error_setg(errp, ""This CPU requires a smaller page size than the "" ""system is using""); return; } /* This cpu-id-to-MPIDR affinity is used only for TCG; KVM will override it. * We don't support setting cluster ID ([16..23]) (known as Aff2 * in later ARM ARM versions), or any of the higher affinity level fields, * so these bits always RAZ. */ if (cpu->mp_affinity == ARM64_AFFINITY_INVALID) { cpu->mp_affinity = arm_cpu_mp_affinity(cs->cpu_index, ARM_DEFAULT_CPUS_PER_CLUSTER); } if (cpu->reset_hivecs) { cpu->reset_sctlr |= (1 << 13); } if (cpu->cfgend) { if (arm_feature(&cpu->env, ARM_FEATURE_V7)) { cpu->reset_sctlr |= SCTLR_EE; } else { cpu->reset_sctlr |= SCTLR_B; } } if (!cpu->has_el3) { /* If the has_el3 CPU property is disabled then we need to disable the * feature. */ unset_feature(env, ARM_FEATURE_EL3); /* Disable the security extension feature bits in the processor feature * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12]. */ cpu->id_pfr1 &= ~0xf0; cpu->id_aa64pfr0 &= ~0xf000; } if (!cpu->has_el2) { unset_feature(env, ARM_FEATURE_EL2); } if (!cpu->has_pmu) { unset_feature(env, ARM_FEATURE_PMU); cpu->id_aa64dfr0 &= ~0xf00; } if (!arm_feature(env, ARM_FEATURE_EL2)) { /* Disable the hypervisor feature bits in the processor feature * registers if we don't have EL2. These are id_pfr1[15:12] and * id_aa64pfr0_el1[11:8]. */ cpu->id_aa64pfr0 &= ~0xf00; cpu->id_pfr1 &= ~0xf000; } /* MPU can be configured out of a PMSA CPU either by setting has-mpu * to false or by setting pmsav7-dregion to 0. */ if (!cpu->has_mpu) { cpu->pmsav7_dregion = 0; } if (cpu->pmsav7_dregion == 0) { cpu->has_mpu = false; } if (arm_feature(env, ARM_FEATURE_PMSA) && arm_feature(env, ARM_FEATURE_V7)) { uint32_t nr = cpu->pmsav7_dregion; if (nr > 0xff) { error_setg(errp, ""PMSAv7 MPU #regions invalid %"" PRIu32, nr); return; } if (nr) { if (arm_feature(env, ARM_FEATURE_V8)) { /* PMSAv8 */ env->pmsav8.rbar[M_REG_NS] = g_new0(uint32_t, nr); env->pmsav8.rlar[M_REG_NS] = g_new0(uint32_t, nr); if (arm_feature(env, ARM_FEATURE_M_SECURITY)) { env->pmsav8.rbar[M_REG_S] = g_new0(uint32_t, nr); env->pmsav8.rlar[M_REG_S] = g_new0(uint32_t, nr); } } else { env->pmsav7.drbar = g_new0(uint32_t, nr); env->pmsav7.drsr = g_new0(uint32_t, nr); env->pmsav7.dracr = g_new0(uint32_t, nr); } } } if (arm_feature(env, ARM_FEATURE_EL3)) { set_feature(env, ARM_FEATURE_VBAR); } register_cp_regs_for_features(cpu); arm_cpu_register_gdb_regs_for_features(cpu); init_cpreg_list(cpu); #ifndef CONFIG_USER_ONLY if (cpu->has_el3 || arm_feature(env, ARM_FEATURE_M_SECURITY)) { AddressSpace *as; cs->num_ases = 2; if (!cpu->secure_memory) { cpu->secure_memory = cs->memory; } as = address_space_init_shareable(cpu->secure_memory, ""cpu-secure-memory""); cpu_address_space_init(cs, as, ARMASIdx_S); } else { cs->num_ases = 1; } cpu_address_space_init(cs, address_space_init_shareable(cs->memory, ""cpu-memory""), ARMASIdx_NS); #endif qemu_init_vcpu(cs); cpu_reset(cs); acc->parent_realize(dev, errp); }","Yes, it is vulnerable."929927,"static void wait_for_serial(const char *side) { char *serialpath = g_strdup_printf(""%s/%s"", tmpfs, side); FILE *serialfile = fopen(serialpath, ""r""); const char *arch = qtest_get_arch(); int started = (strcmp(side, ""src_serial"") == 0 && strcmp(arch, ""ppc64"") == 0) ? 0 : 1; do { int readvalue = fgetc(serialfile); if (!started) { /* SLOF prints its banner before starting test, * to ignore it, mark the start of the test with '_', * ignore all characters until this marker */ switch (readvalue) { case '_': started = 1; break; case EOF: fseek(serialfile, 0, SEEK_SET); usleep(1000); break; } continue; } switch (readvalue) { case 'A': /* Fine */ break; case 'B': /* It's alive! */ fclose(serialfile); g_free(serialpath); return; case EOF: started = (strcmp(side, ""src_serial"") == 0 && strcmp(arch, ""ppc64"") == 0) ? 0 : 1; fseek(serialfile, 0, SEEK_SET); usleep(1000); break; default: fprintf(stderr, ""Unexpected %d on %s serial\n"", readvalue, side); g_assert_not_reached(); } } while (true); }","Yes, it is vulnerable."930928,"static void disas_thumb_insn(CPUARMState *env, DisasContext *s) { uint32_t val, insn, op, rm, rn, rd, shift, cond; int32_t offset; int i; TCGv_i32 tmp; TCGv_i32 tmp2; TCGv_i32 addr; if (s->condexec_mask) { cond = s->condexec_cond; if (cond != 0x0e) { /* Skip conditional when condition is AL. */ s->condlabel = gen_new_label(); arm_gen_test_cc(cond ^ 1, s->condlabel); s->condjmp = 1; } } insn = arm_lduw_code(env, s->pc, s->sctlr_b); s->pc += 2; switch (insn >> 12) { case 0: case 1: rd = insn & 7; op = (insn >> 11) & 3; if (op == 3) { /* add/subtract */ rn = (insn >> 3) & 7; tmp = load_reg(s, rn); if (insn & (1 << 10)) { /* immediate */ tmp2 = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp2, (insn >> 6) & 7); } else { /* reg */ rm = (insn >> 6) & 7; tmp2 = load_reg(s, rm); } if (insn & (1 << 9)) { if (s->condexec_mask) tcg_gen_sub_i32(tmp, tmp, tmp2); else gen_sub_CC(tmp, tmp, tmp2); } else { if (s->condexec_mask) tcg_gen_add_i32(tmp, tmp, tmp2); else gen_add_CC(tmp, tmp, tmp2); } tcg_temp_free_i32(tmp2); store_reg(s, rd, tmp); } else { /* shift immediate */ rm = (insn >> 3) & 7; shift = (insn >> 6) & 0x1f; tmp = load_reg(s, rm); gen_arm_shift_im(tmp, op, shift, s->condexec_mask == 0); if (!s->condexec_mask) gen_logic_CC(tmp); store_reg(s, rd, tmp); } break; case 2: case 3: /* arithmetic large immediate */ op = (insn >> 11) & 3; rd = (insn >> 8) & 0x7; if (op == 0) { /* mov */ tmp = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp, insn & 0xff); if (!s->condexec_mask) gen_logic_CC(tmp); store_reg(s, rd, tmp); } else { tmp = load_reg(s, rd); tmp2 = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp2, insn & 0xff); switch (op) { case 1: /* cmp */ gen_sub_CC(tmp, tmp, tmp2); tcg_temp_free_i32(tmp); tcg_temp_free_i32(tmp2); break; case 2: /* add */ if (s->condexec_mask) tcg_gen_add_i32(tmp, tmp, tmp2); else gen_add_CC(tmp, tmp, tmp2); tcg_temp_free_i32(tmp2); store_reg(s, rd, tmp); break; case 3: /* sub */ if (s->condexec_mask) tcg_gen_sub_i32(tmp, tmp, tmp2); else gen_sub_CC(tmp, tmp, tmp2); tcg_temp_free_i32(tmp2); store_reg(s, rd, tmp); break; } } break; case 4: if (insn & (1 << 11)) { rd = (insn >> 8) & 7; /* load pc-relative. Bit 1 of PC is ignored. */ val = s->pc + 2 + ((insn & 0xff) * 4); val &= ~(uint32_t)2; addr = tcg_temp_new_i32(); tcg_gen_movi_i32(addr, val); tmp = tcg_temp_new_i32(); gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); tcg_temp_free_i32(addr); store_reg(s, rd, tmp); break; } if (insn & (1 << 10)) { /* data processing extended or blx */ rd = (insn & 7) | ((insn >> 4) & 8); rm = (insn >> 3) & 0xf; op = (insn >> 8) & 3; switch (op) { case 0: /* add */ tmp = load_reg(s, rd); tmp2 = load_reg(s, rm); tcg_gen_add_i32(tmp, tmp, tmp2); tcg_temp_free_i32(tmp2); store_reg(s, rd, tmp); break; case 1: /* cmp */ tmp = load_reg(s, rd); tmp2 = load_reg(s, rm); gen_sub_CC(tmp, tmp, tmp2); tcg_temp_free_i32(tmp2); tcg_temp_free_i32(tmp); break; case 2: /* mov/cpy */ tmp = load_reg(s, rm); store_reg(s, rd, tmp); break; case 3:/* branch [and link] exchange thumb register */ tmp = load_reg(s, rm); if (insn & (1 << 7)) { ARCH(5); val = (uint32_t)s->pc | 1; tmp2 = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp2, val); store_reg(s, 14, tmp2); gen_bx(s, tmp); } else { /* Only BX works as exception-return, not BLX */ gen_bx_excret(s, tmp); } break; } break; } /* data processing register */ rd = insn & 7; rm = (insn >> 3) & 7; op = (insn >> 6) & 0xf; if (op == 2 || op == 3 || op == 4 || op == 7) { /* the shift/rotate ops want the operands backwards */ val = rm; rm = rd; rd = val; val = 1; } else { val = 0; } if (op == 9) { /* neg */ tmp = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp, 0); } else if (op != 0xf) { /* mvn doesn't read its first operand */ tmp = load_reg(s, rd); } else { TCGV_UNUSED_I32(tmp); } tmp2 = load_reg(s, rm); switch (op) { case 0x0: /* and */ tcg_gen_and_i32(tmp, tmp, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp); break; case 0x1: /* eor */ tcg_gen_xor_i32(tmp, tmp, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp); break; case 0x2: /* lsl */ if (s->condexec_mask) { gen_shl(tmp2, tmp2, tmp); } else { gen_helper_shl_cc(tmp2, cpu_env, tmp2, tmp); gen_logic_CC(tmp2); } break; case 0x3: /* lsr */ if (s->condexec_mask) { gen_shr(tmp2, tmp2, tmp); } else { gen_helper_shr_cc(tmp2, cpu_env, tmp2, tmp); gen_logic_CC(tmp2); } break; case 0x4: /* asr */ if (s->condexec_mask) { gen_sar(tmp2, tmp2, tmp); } else { gen_helper_sar_cc(tmp2, cpu_env, tmp2, tmp); gen_logic_CC(tmp2); } break; case 0x5: /* adc */ if (s->condexec_mask) { gen_adc(tmp, tmp2); } else { gen_adc_CC(tmp, tmp, tmp2); } break; case 0x6: /* sbc */ if (s->condexec_mask) { gen_sub_carry(tmp, tmp, tmp2); } else { gen_sbc_CC(tmp, tmp, tmp2); } break; case 0x7: /* ror */ if (s->condexec_mask) { tcg_gen_andi_i32(tmp, tmp, 0x1f); tcg_gen_rotr_i32(tmp2, tmp2, tmp); } else { gen_helper_ror_cc(tmp2, cpu_env, tmp2, tmp); gen_logic_CC(tmp2); } break; case 0x8: /* tst */ tcg_gen_and_i32(tmp, tmp, tmp2); gen_logic_CC(tmp); rd = 16; break; case 0x9: /* neg */ if (s->condexec_mask) tcg_gen_neg_i32(tmp, tmp2); else gen_sub_CC(tmp, tmp, tmp2); break; case 0xa: /* cmp */ gen_sub_CC(tmp, tmp, tmp2); rd = 16; break; case 0xb: /* cmn */ gen_add_CC(tmp, tmp, tmp2); rd = 16; break; case 0xc: /* orr */ tcg_gen_or_i32(tmp, tmp, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp); break; case 0xd: /* mul */ tcg_gen_mul_i32(tmp, tmp, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp); break; case 0xe: /* bic */ tcg_gen_andc_i32(tmp, tmp, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp); break; case 0xf: /* mvn */ tcg_gen_not_i32(tmp2, tmp2); if (!s->condexec_mask) gen_logic_CC(tmp2); val = 1; rm = rd; break; } if (rd != 16) { if (val) { store_reg(s, rm, tmp2); if (op != 0xf) tcg_temp_free_i32(tmp); } else { store_reg(s, rd, tmp); tcg_temp_free_i32(tmp2); } } else { tcg_temp_free_i32(tmp); tcg_temp_free_i32(tmp2); } break; case 5: /* load/store register offset. */ rd = insn & 7; rn = (insn >> 3) & 7; rm = (insn >> 6) & 7; op = (insn >> 9) & 7; addr = load_reg(s, rn); tmp = load_reg(s, rm); tcg_gen_add_i32(addr, addr, tmp); tcg_temp_free_i32(tmp); if (op < 3) { /* store */ tmp = load_reg(s, rd); } else { tmp = tcg_temp_new_i32(); } switch (op) { case 0: /* str */ gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 1: /* strh */ gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 2: /* strb */ gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 3: /* ldrsb */ gen_aa32_ld8s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 4: /* ldr */ gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 5: /* ldrh */ gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 6: /* ldrb */ gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; case 7: /* ldrsh */ gen_aa32_ld16s_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); break; } if (op >= 3) { /* load */ store_reg(s, rd, tmp); } else { tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); break; case 6: /* load/store word immediate offset */ rd = insn & 7; rn = (insn >> 3) & 7; addr = load_reg(s, rn); val = (insn >> 4) & 0x7c; tcg_gen_addi_i32(addr, addr, val); if (insn & (1 << 11)) { /* load */ tmp = tcg_temp_new_i32(); gen_aa32_ld32u(s, tmp, addr, get_mem_index(s)); store_reg(s, rd, tmp); } else { /* store */ tmp = load_reg(s, rd); gen_aa32_st32(s, tmp, addr, get_mem_index(s)); tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); break; case 7: /* load/store byte immediate offset */ rd = insn & 7; rn = (insn >> 3) & 7; addr = load_reg(s, rn); val = (insn >> 6) & 0x1f; tcg_gen_addi_i32(addr, addr, val); if (insn & (1 << 11)) { /* load */ tmp = tcg_temp_new_i32(); gen_aa32_ld8u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); store_reg(s, rd, tmp); } else { /* store */ tmp = load_reg(s, rd); gen_aa32_st8_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); break; case 8: /* load/store halfword immediate offset */ rd = insn & 7; rn = (insn >> 3) & 7; addr = load_reg(s, rn); val = (insn >> 5) & 0x3e; tcg_gen_addi_i32(addr, addr, val); if (insn & (1 << 11)) { /* load */ tmp = tcg_temp_new_i32(); gen_aa32_ld16u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); store_reg(s, rd, tmp); } else { /* store */ tmp = load_reg(s, rd); gen_aa32_st16_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); break; case 9: /* load/store from stack */ rd = (insn >> 8) & 7; addr = load_reg(s, 13); val = (insn & 0xff) * 4; tcg_gen_addi_i32(addr, addr, val); if (insn & (1 << 11)) { /* load */ tmp = tcg_temp_new_i32(); gen_aa32_ld32u_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); store_reg(s, rd, tmp); } else { /* store */ tmp = load_reg(s, rd); gen_aa32_st32_iss(s, tmp, addr, get_mem_index(s), rd | ISSIs16Bit); tcg_temp_free_i32(tmp); } tcg_temp_free_i32(addr); break; case 10: /* add to high reg */ rd = (insn >> 8) & 7; if (insn & (1 << 11)) { /* SP */ tmp = load_reg(s, 13); } else { /* PC. bit 1 is ignored. */ tmp = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp, (s->pc + 2) & ~(uint32_t)2); } val = (insn & 0xff) * 4; tcg_gen_addi_i32(tmp, tmp, val); store_reg(s, rd, tmp); break; case 11: /* misc */ op = (insn >> 8) & 0xf; switch (op) { case 0: /* adjust stack pointer */ tmp = load_reg(s, 13); val = (insn & 0x7f) * 4; if (insn & (1 << 7)) val = -(int32_t)val; tcg_gen_addi_i32(tmp, tmp, val); store_reg(s, 13, tmp); break; case 2: /* sign/zero extend. */ ARCH(6); rd = insn & 7; rm = (insn >> 3) & 7; tmp = load_reg(s, rm); switch ((insn >> 6) & 3) { case 0: gen_sxth(tmp); break; case 1: gen_sxtb(tmp); break; case 2: gen_uxth(tmp); break; case 3: gen_uxtb(tmp); break; } store_reg(s, rd, tmp); break; case 4: case 5: case 0xc: case 0xd: /* push/pop */ addr = load_reg(s, 13); if (insn & (1 << 8)) offset = 4; else offset = 0; for (i = 0; i < 8; i++) { if (insn & (1 << i)) offset += 4; } if ((insn & (1 << 11)) == 0) { tcg_gen_addi_i32(addr, addr, -offset); } for (i = 0; i < 8; i++) { if (insn & (1 << i)) { if (insn & (1 << 11)) { /* pop */ tmp = tcg_temp_new_i32(); gen_aa32_ld32u(s, tmp, addr, get_mem_index(s)); store_reg(s, i, tmp); } else { /* push */ tmp = load_reg(s, i); gen_aa32_st32(s, tmp, addr, get_mem_index(s)); tcg_temp_free_i32(tmp); } /* advance to the next address. */ tcg_gen_addi_i32(addr, addr, 4); } } TCGV_UNUSED_I32(tmp); if (insn & (1 << 8)) { if (insn & (1 << 11)) { /* pop pc */ tmp = tcg_temp_new_i32(); gen_aa32_ld32u(s, tmp, addr, get_mem_index(s)); /* don't set the pc until the rest of the instruction has completed */ } else { /* push lr */ tmp = load_reg(s, 14); gen_aa32_st32(s, tmp, addr, get_mem_index(s)); tcg_temp_free_i32(tmp); } tcg_gen_addi_i32(addr, addr, 4); } if ((insn & (1 << 11)) == 0) { tcg_gen_addi_i32(addr, addr, -offset); } /* write back the new stack pointer */ store_reg(s, 13, addr); /* set the new PC value */ if ((insn & 0x0900) == 0x0900) { store_reg_from_load(s, 15, tmp); } break; case 1: case 3: case 9: case 11: /* czb */ rm = insn & 7; tmp = load_reg(s, rm); s->condlabel = gen_new_label(); s->condjmp = 1; if (insn & (1 << 11)) tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 0, s->condlabel); else tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 0, s->condlabel); tcg_temp_free_i32(tmp); offset = ((insn & 0xf8) >> 2) | (insn & 0x200) >> 3; val = (uint32_t)s->pc + 2; val += offset; gen_jmp(s, val); break; case 15: /* IT, nop-hint. */ if ((insn & 0xf) == 0) { gen_nop_hint(s, (insn >> 4) & 0xf); break; } /* If Then. */ s->condexec_cond = (insn >> 4) & 0xe; s->condexec_mask = insn & 0x1f; /* No actual code generated for this insn, just setup state. */ break; case 0xe: /* bkpt */ { int imm8 = extract32(insn, 0, 8); ARCH(5); gen_exception_insn(s, 2, EXCP_BKPT, syn_aa32_bkpt(imm8, true), default_exception_el(s)); break; } case 0xa: /* rev, and hlt */ { int op1 = extract32(insn, 6, 2); if (op1 == 2) { /* HLT */ int imm6 = extract32(insn, 0, 6); gen_hlt(s, imm6); break; } /* Otherwise this is rev */ ARCH(6); rn = (insn >> 3) & 0x7; rd = insn & 0x7; tmp = load_reg(s, rn); switch (op1) { case 0: tcg_gen_bswap32_i32(tmp, tmp); break; case 1: gen_rev16(tmp); break; case 3: gen_revsh(tmp); break; default: g_assert_not_reached(); } store_reg(s, rd, tmp); break; } case 6: switch ((insn >> 5) & 7) { case 2: /* setend */ ARCH(6); if (((insn >> 3) & 1) != !!(s->be_data == MO_BE)) { gen_helper_setend(cpu_env); s->is_jmp = DISAS_UPDATE; } break; case 3: /* cps */ ARCH(6); if (IS_USER(s)) { break; } if (arm_dc_feature(s, ARM_FEATURE_M)) { tmp = tcg_const_i32((insn & (1 << 4)) != 0); /* FAULTMASK */ if (insn & 1) { addr = tcg_const_i32(19); gen_helper_v7m_msr(cpu_env, addr, tmp); tcg_temp_free_i32(addr); } /* PRIMASK */ if (insn & 2) { addr = tcg_const_i32(16); gen_helper_v7m_msr(cpu_env, addr, tmp); tcg_temp_free_i32(addr); } tcg_temp_free_i32(tmp); gen_lookup_tb(s); } else { if (insn & (1 << 4)) { shift = CPSR_A | CPSR_I | CPSR_F; } else { shift = 0; } gen_set_psr_im(s, ((insn & 7) << 6), 0, shift); } break; default: goto undef; } break; default: goto undef; } break; case 12: { /* load/store multiple */ TCGv_i32 loaded_var; TCGV_UNUSED_I32(loaded_var); rn = (insn >> 8) & 0x7; addr = load_reg(s, rn); for (i = 0; i < 8; i++) { if (insn & (1 << i)) { if (insn & (1 << 11)) { /* load */ tmp = tcg_temp_new_i32(); gen_aa32_ld32u(s, tmp, addr, get_mem_index(s)); if (i == rn) { loaded_var = tmp; } else { store_reg(s, i, tmp); } } else { /* store */ tmp = load_reg(s, i); gen_aa32_st32(s, tmp, addr, get_mem_index(s)); tcg_temp_free_i32(tmp); } /* advance to the next address */ tcg_gen_addi_i32(addr, addr, 4); } } if ((insn & (1 << rn)) == 0) { /* base reg not in list: base register writeback */ store_reg(s, rn, addr); } else { /* base reg in list: if load, complete it now */ if (insn & (1 << 11)) { store_reg(s, rn, loaded_var); } tcg_temp_free_i32(addr); } break; } case 13: /* conditional branch or swi */ cond = (insn >> 8) & 0xf; if (cond == 0xe) goto undef; if (cond == 0xf) { /* swi */ gen_set_pc_im(s, s->pc); s->svc_imm = extract32(insn, 0, 8); s->is_jmp = DISAS_SWI; break; } /* generate a conditional jump to next instruction */ s->condlabel = gen_new_label(); arm_gen_test_cc(cond ^ 1, s->condlabel); s->condjmp = 1; /* jump to the offset */ val = (uint32_t)s->pc + 2; offset = ((int32_t)insn << 24) >> 24; val += offset << 1; gen_jmp(s, val); break; case 14: if (insn & (1 << 11)) { if (disas_thumb2_insn(env, s, insn)) goto undef32; break; } /* unconditional branch */ val = (uint32_t)s->pc; offset = ((int32_t)insn << 21) >> 21; val += (offset << 1) + 2; gen_jmp(s, val); break; case 15: if (disas_thumb2_insn(env, s, insn)) goto undef32; break; } return; undef32: gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(), default_exception_el(s)); return; illegal_op: undef: gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(), default_exception_el(s)); }","Yes, it is vulnerable."931929,"static int iscsi_open(BlockDriverState *bs, QDict *options, int flags, Error **errp) { IscsiLun *iscsilun = bs->opaque; struct iscsi_context *iscsi = NULL; struct iscsi_url *iscsi_url = NULL; struct scsi_task *task = NULL; struct scsi_inquiry_standard *inq = NULL; struct scsi_inquiry_supported_pages *inq_vpd; char *initiator_name = NULL; QemuOpts *opts; Error *local_err = NULL; const char *filename; int i, ret; if ((BDRV_SECTOR_SIZE % 512) != 0) { error_setg(errp, ""iSCSI: Invalid BDRV_SECTOR_SIZE. "" ""BDRV_SECTOR_SIZE(%lld) is not a multiple "" ""of 512"", BDRV_SECTOR_SIZE); return -EINVAL; opts = qemu_opts_create(&runtime_opts, NULL, 0, &error_abort); qemu_opts_absorb_qdict(opts, options, &local_err); if (local_err) { error_propagate(errp, local_err); ret = -EINVAL; filename = qemu_opt_get(opts, ""filename""); iscsi_url = iscsi_parse_full_url(iscsi, filename); if (iscsi_url == NULL) { error_setg(errp, ""Failed to parse URL : %s"", filename); ret = -EINVAL; memset(iscsilun, 0, sizeof(IscsiLun)); initiator_name = parse_initiator_name(iscsi_url->target); iscsi = iscsi_create_context(initiator_name); if (iscsi == NULL) { error_setg(errp, ""iSCSI: Failed to create iSCSI context.""); ret = -ENOMEM; if (iscsi_set_targetname(iscsi, iscsi_url->target)) { error_setg(errp, ""iSCSI: Failed to set target name.""); ret = -EINVAL; if (iscsi_url->user != NULL) { ret = iscsi_set_initiator_username_pwd(iscsi, iscsi_url->user, iscsi_url->passwd); if (ret != 0) { error_setg(errp, ""Failed to set initiator username and password""); ret = -EINVAL; /* check if we got CHAP username/password via the options */ parse_chap(iscsi, iscsi_url->target, &local_err); if (local_err != NULL) { error_propagate(errp, local_err); ret = -EINVAL; if (iscsi_set_session_type(iscsi, ISCSI_SESSION_NORMAL) != 0) { error_setg(errp, ""iSCSI: Failed to set session type to normal.""); ret = -EINVAL; iscsi_set_header_digest(iscsi, ISCSI_HEADER_DIGEST_NONE_CRC32C); /* check if we got HEADER_DIGEST via the options */ parse_header_digest(iscsi, iscsi_url->target, &local_err); if (local_err != NULL) { error_propagate(errp, local_err); ret = -EINVAL; if (iscsi_full_connect_sync(iscsi, iscsi_url->portal, iscsi_url->lun) != 0) { error_setg(errp, ""iSCSI: Failed to connect to LUN : %s"", iscsi_get_error(iscsi)); ret = -EINVAL; iscsilun->iscsi = iscsi; iscsilun->aio_context = bdrv_get_aio_context(bs); iscsilun->lun = iscsi_url->lun; iscsilun->has_write_same = true; task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 0, 0, (void **) &inq, errp); if (task == NULL) { ret = -EINVAL; iscsilun->type = inq->periperal_device_type; scsi_free_scsi_task(task); task = NULL; iscsi_readcapacity_sync(iscsilun, &local_err); if (local_err != NULL) { error_propagate(errp, local_err); ret = -EINVAL; bs->total_sectors = sector_lun2qemu(iscsilun->num_blocks, iscsilun); bs->request_alignment = iscsilun->block_size; /* We don't have any emulation for devices other than disks and CD-ROMs, so * this must be sg ioctl compatible. We force it to be sg, otherwise qemu * will try to read from the device to guess the image format. */ if (iscsilun->type != TYPE_DISK && iscsilun->type != TYPE_ROM) { bs->sg = 1; task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1, SCSI_INQUIRY_PAGECODE_SUPPORTED_VPD_PAGES, (void **) &inq_vpd, errp); if (task == NULL) { ret = -EINVAL; for (i = 0; i < inq_vpd->num_pages; i++) { struct scsi_task *inq_task; struct scsi_inquiry_logical_block_provisioning *inq_lbp; struct scsi_inquiry_block_limits *inq_bl; switch (inq_vpd->pages[i]) { case SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING: inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1, SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING, (void **) &inq_lbp, errp); if (inq_task == NULL) { ret = -EINVAL; memcpy(&iscsilun->lbp, inq_lbp, sizeof(struct scsi_inquiry_logical_block_provisioning)); scsi_free_scsi_task(inq_task); break; case SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS: inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1, SCSI_INQUIRY_PAGECODE_BLOCK_LIMITS, (void **) &inq_bl, errp); if (inq_task == NULL) { ret = -EINVAL; memcpy(&iscsilun->bl, inq_bl, sizeof(struct scsi_inquiry_block_limits)); scsi_free_scsi_task(inq_task); break; default: break; scsi_free_scsi_task(task); task = NULL; iscsi_attach_aio_context(bs, iscsilun->aio_context); /* Guess the internal cluster (page) size of the iscsi target by the means * of opt_unmap_gran. Transfer the unmap granularity only if it has a * reasonable size */ if (iscsilun->bl.opt_unmap_gran * iscsilun->block_size >= 4 * 1024 && iscsilun->bl.opt_unmap_gran * iscsilun->block_size <= 16 * 1024 * 1024) { iscsilun->cluster_sectors = (iscsilun->bl.opt_unmap_gran * iscsilun->block_size) >> BDRV_SECTOR_BITS; if (iscsilun->lbprz && !(bs->open_flags & BDRV_O_NOCACHE)) { iscsilun->allocationmap = iscsi_allocationmap_init(iscsilun); if (iscsilun->allocationmap == NULL) { ret = -ENOMEM; out: qemu_opts_del(opts); g_free(initiator_name); if (iscsi_url != NULL) { iscsi_destroy_url(iscsi_url); if (task != NULL) { scsi_free_scsi_task(task); if (ret) { if (iscsi != NULL) { iscsi_destroy_context(iscsi); memset(iscsilun, 0, sizeof(IscsiLun)); return ret;","Yes, it is vulnerable."932930,"static inline void FUNC(idctSparseCol_extrashift)(int16_t *col) #else static inline void FUNC(idctSparseColPut)(pixel *dest, int line_size, int16_t *col) { int a0, a1, a2, a3, b0, b1, b2, b3; IDCT_COLS; dest[0] = av_clip_pixel((a0 + b0) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a1 + b1) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a2 + b2) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a3 + b3) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a3 - b3) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a2 - b2) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a1 - b1) >> COL_SHIFT); dest += line_size; dest[0] = av_clip_pixel((a0 - b0) >> COL_SHIFT); } static inline void FUNC(idctSparseColAdd)(pixel *dest, int line_size, int16_t *col) { int a0, a1, a2, a3, b0, b1, b2, b3; IDCT_COLS; dest[0] = av_clip_pixel(dest[0] + ((a0 + b0) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a1 + b1) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a2 + b2) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a3 + b3) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a3 - b3) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a2 - b2) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a1 - b1) >> COL_SHIFT)); dest += line_size; dest[0] = av_clip_pixel(dest[0] + ((a0 - b0) >> COL_SHIFT)); } static inline void FUNC(idctSparseCol)(int16_t *col) #endif { int a0, a1, a2, a3, b0, b1, b2, b3; IDCT_COLS; col[0 ] = ((a0 + b0) >> COL_SHIFT); col[8 ] = ((a1 + b1) >> COL_SHIFT); col[16] = ((a2 + b2) >> COL_SHIFT); col[24] = ((a3 + b3) >> COL_SHIFT); col[32] = ((a3 - b3) >> COL_SHIFT); col[40] = ((a2 - b2) >> COL_SHIFT); col[48] = ((a1 - b1) >> COL_SHIFT); col[56] = ((a0 - b0) >> COL_SHIFT); }","Yes, it is vulnerable."933931,"static void restore_median(uint8_t *src, int step, int stride, int width, int height, int slices, int rmode) { int i, j, slice; int A, B, C; uint8_t *bsrc; int slice_start, slice_height; const int cmask = ~rmode; for (slice = 0; slice < slices; slice++) { slice_start = ((slice * height) / slices) & cmask; slice_height = ((((slice + 1) * height) / slices) & cmask) - slice_start; bsrc = src + slice_start * stride; // first line - left neighbour prediction bsrc[0] += 0x80; A = bsrc[0]; for (i = step; i < width * step; i += step) { bsrc[i] += A; A = bsrc[i]; } bsrc += stride; if (slice_height == 1) // second line - first element has top prediction, the rest uses median C = bsrc[-stride]; bsrc[0] += C; A = bsrc[0]; for (i = step; i < width * step; i += step) { B = bsrc[i - stride]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[i]; } bsrc += stride; // the rest of lines use continuous median prediction for (j = 2; j < slice_height; j++) { for (i = 0; i < width * step; i += step) { B = bsrc[i - stride]; bsrc[i] += mid_pred(A, B, (uint8_t)(A + B - C)); C = B; A = bsrc[i]; } bsrc += stride; } } }","Yes, it is vulnerable."934932,"static int decode_seq_header(AVSContext *h) { MpegEncContext *s = &h->s; int frame_rate_code; h->profile = get_bits(&s->gb,8); h->level = get_bits(&s->gb,8); skip_bits1(&s->gb); //progressive sequence s->width = get_bits(&s->gb,14); s->height = get_bits(&s->gb,14); skip_bits(&s->gb,2); //chroma format skip_bits(&s->gb,3); //sample_precision h->aspect_ratio = get_bits(&s->gb,4); frame_rate_code = get_bits(&s->gb,4); skip_bits(&s->gb,18);//bit_rate_lower skip_bits1(&s->gb); //marker_bit skip_bits(&s->gb,12);//bit_rate_upper s->low_delay = get_bits1(&s->gb); h->mb_width = (s->width + 15) >> 4; h->mb_height = (s->height + 15) >> 4; h->s.avctx->time_base.den = avpriv_frame_rate_tab[frame_rate_code].num; h->s.avctx->time_base.num = avpriv_frame_rate_tab[frame_rate_code].den; h->s.avctx->width = s->width; h->s.avctx->height = s->height; if(!h->top_qp) ff_cavs_init_top_lines(h); return 0; }","No, it is non-vulnerable."935933,int ff_mpeg_er_init(MpegEncContext *s) { ERContext *er = &s->er; int mb_array_size = s->mb_height * s->mb_stride; int i; er->avctx = s->avctx; er->mb_index2xy = s->mb_index2xy; er->mb_num = s->mb_num; er->mb_width = s->mb_width; er->mb_height = s->mb_height; er->mb_stride = s->mb_stride; er->b8_stride = s->b8_stride; er->er_temp_buffer = av_malloc(s->mb_height * s->mb_stride); er->error_status_table = av_mallocz(mb_array_size); if (!er->er_temp_buffer || !er->error_status_table) goto fail; er->mbskip_table = s->mbskip_table; er->mbintra_table = s->mbintra_table; for (i = 0; i < FF_ARRAY_ELEMS(s->dc_val); i++) er->dc_val[i] = s->dc_val[i]; er->decode_mb = mpeg_er_decode_mb; er->opaque = s; return 0; fail: av_freep(&er->er_temp_buffer); av_freep(&er->error_status_table); return AVERROR(ENOMEM); },"Yes, it is vulnerable."936934,"static target_ulong remove_hpte(CPUPPCState *env, target_ulong ptex, target_ulong avpn, target_ulong flags, target_ulong *vp, target_ulong *rp) { uint8_t *hpte; target_ulong v, r, rb; if ((ptex * HASH_PTE_SIZE_64) & ~env->htab_mask) { return REMOVE_PARM; } hpte = env->external_htab + (ptex * HASH_PTE_SIZE_64); while (!lock_hpte(hpte, HPTE_V_HVLOCK)) { /* We have no real concurrency in qemu soft-emulation, so we * will never actually have a contested lock */ assert(0); } v = ldq_p(hpte); r = ldq_p(hpte + (HASH_PTE_SIZE_64/2)); if ((v & HPTE_V_VALID) == 0 || ((flags & H_AVPN) && (v & ~0x7fULL) != avpn) || ((flags & H_ANDCOND) && (v & avpn) != 0)) { stq_p(hpte, v & ~HPTE_V_HVLOCK); assert(!(ldq_p(hpte) & HPTE_V_HVLOCK)); return REMOVE_NOT_FOUND; } *vp = v & ~HPTE_V_HVLOCK; *rp = r; stq_p(hpte, 0); rb = compute_tlbie_rb(v, r, ptex); ppc_tlb_invalidate_one(env, rb); assert(!(ldq_p(hpte) & HPTE_V_HVLOCK)); return REMOVE_SUCCESS; }","Yes, it is vulnerable."937935,"SerialState *serial_init(int base, qemu_irq irq, int baudbase, CharDriverState *chr) { SerialState *s; s = qemu_mallocz(sizeof(SerialState)); if (!s) return NULL; s->irq = irq; s->baudbase = baudbase; s->tx_timer = qemu_new_timer(vm_clock, serial_tx_done, s); if (!s->tx_timer) return NULL; qemu_register_reset(serial_reset, s); serial_reset(s); register_savevm(""serial"", base, 2, serial_save, serial_load, s); register_ioport_write(base, 8, 1, serial_ioport_write, s); register_ioport_read(base, 8, 1, serial_ioport_read, s); s->chr = chr; qemu_chr_add_handlers(chr, serial_can_receive1, serial_receive1, serial_event, s); return s; }","Yes, it is vulnerable."938936,"static void kvmclock_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->realize = kvmclock_realize; dc->vmsd = &kvmclock_vmsd; dc->props = kvmclock_properties; }","Yes, it is vulnerable."939937,"int vc1_decode_entry_point(AVCodecContext *avctx, VC1Context *v, GetBitContext *gb) { int i; av_log(avctx, AV_LOG_DEBUG, ""Entry point: %08X\n"", show_bits_long(gb, 32)); v->broken_link = get_bits1(gb); v->closed_entry = get_bits1(gb); v->panscanflag = get_bits1(gb); v->refdist_flag = get_bits1(gb); v->s.loop_filter = get_bits1(gb); v->fastuvmc = get_bits1(gb); v->extended_mv = get_bits1(gb); v->dquant = get_bits(gb, 2); v->vstransform = get_bits1(gb); v->overlap = get_bits1(gb); v->quantizer_mode = get_bits(gb, 2); if(v->hrd_param_flag){ for(i = 0; i < v->hrd_num_leaky_buckets; i++) { skip_bits(gb, 8); //hrd_full[n] } } if(get_bits1(gb)){ avctx->coded_width = (get_bits(gb, 12)+1)<<1; avctx->coded_height = (get_bits(gb, 12)+1)<<1; } if(v->extended_mv) v->extended_dmv = get_bits1(gb); if((v->range_mapy_flag = get_bits1(gb))) { av_log(avctx, AV_LOG_ERROR, ""Luma scaling is not supported, expect wrong picture\n""); v->range_mapy = get_bits(gb, 3); } if((v->range_mapuv_flag = get_bits1(gb))) { av_log(avctx, AV_LOG_ERROR, ""Chroma scaling is not supported, expect wrong picture\n""); v->range_mapuv = get_bits(gb, 3); } av_log(avctx, AV_LOG_DEBUG, ""Entry point info:\n"" ""BrokenLink=%i, ClosedEntry=%i, PanscanFlag=%i\n"" ""RefDist=%i, Postproc=%i, FastUVMC=%i, ExtMV=%i\n"" ""DQuant=%i, VSTransform=%i, Overlap=%i, Qmode=%i\n"", v->broken_link, v->closed_entry, v->panscanflag, v->refdist_flag, v->s.loop_filter, v->fastuvmc, v->extended_mv, v->dquant, v->vstransform, v->overlap, v->quantizer_mode); return 0; }","Yes, it is vulnerable."940938,"static inline void RENAME(bgr24ToUV_half)(uint8_t *dstU, uint8_t *dstV, const uint8_t *src1, const uint8_t *src2, int width, uint32_t *unused) { int i; for (i=0; i<width; i++) { int b= src1[6*i + 0] + src1[6*i + 3]; int g= src1[6*i + 1] + src1[6*i + 4]; int r= src1[6*i + 2] + src1[6*i + 5]; dstU[i]= (RU*r + GU*g + BU*b + (257<<RGB2YUV_SHIFT))>>(RGB2YUV_SHIFT+1); dstV[i]= (RV*r + GV*g + BV*b + (257<<RGB2YUV_SHIFT))>>(RGB2YUV_SHIFT+1); } assert(src1 == src2); }","Yes, it is vulnerable."941939,"static int64_t guest_file_handle_add(FILE *fh, Error **errp) { GuestFileHandle *gfh; int64_t handle; handle = ga_get_fd_handle(ga_state, errp); if (handle < 0) { return -1; } gfh = g_malloc0(sizeof(GuestFileHandle)); gfh->id = handle; gfh->fh = fh; QTAILQ_INSERT_TAIL(&guest_file_state.filehandles, gfh, next); return handle; }","Yes, it is vulnerable."942940,"static inline void cpu_handle_interrupt(CPUState *cpu, TranslationBlock **last_tb) { CPUClass *cc = CPU_GET_CLASS(cpu); int interrupt_request = cpu->interrupt_request; if (unlikely(interrupt_request)) { if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) { /* Mask out external interrupts for this step. */ interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK; } if (interrupt_request & CPU_INTERRUPT_DEBUG) { cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG; cpu->exception_index = EXCP_DEBUG; cpu_loop_exit(cpu); } if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) { /* Do nothing */ } else if (interrupt_request & CPU_INTERRUPT_HALT) { replay_interrupt(); cpu->interrupt_request &= ~CPU_INTERRUPT_HALT; cpu->halted = 1; cpu->exception_index = EXCP_HLT; cpu_loop_exit(cpu); } #if defined(TARGET_I386) else if (interrupt_request & CPU_INTERRUPT_INIT) { X86CPU *x86_cpu = X86_CPU(cpu); CPUArchState *env = &x86_cpu->env; replay_interrupt(); cpu_svm_check_intercept_param(env, SVM_EXIT_INIT, 0); do_cpu_init(x86_cpu); cpu->exception_index = EXCP_HALTED; cpu_loop_exit(cpu); } #else else if (interrupt_request & CPU_INTERRUPT_RESET) { replay_interrupt(); cpu_reset(cpu); cpu_loop_exit(cpu); } #endif /* The target hook has 3 exit conditions: False when the interrupt isn't processed, True when it is, and we should restart on a new TB, and via longjmp via cpu_loop_exit. */ else { replay_interrupt(); if (cc->cpu_exec_interrupt(cpu, interrupt_request)) { *last_tb = NULL; } /* The target hook may have updated the 'cpu->interrupt_request'; * reload the 'interrupt_request' value */ interrupt_request = cpu->interrupt_request; } if (interrupt_request & CPU_INTERRUPT_EXITTB) { cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB; /* ensure that no TB jump will be modified as the program flow was changed */ *last_tb = NULL; } } if (unlikely(atomic_read(&cpu->exit_request) || replay_has_interrupt())) { atomic_set(&cpu->exit_request, 0); cpu->exception_index = EXCP_INTERRUPT; cpu_loop_exit(cpu); } }","No, it is non-vulnerable."943941,"static void test_redirector_tx(void) { int backend_sock[2], recv_sock; char *cmdline; uint32_t ret = 0, len = 0; char send_buf[] = ""Hello!!""; char sock_path0[] = ""filter-redirector0.XXXXXX""; char sock_path1[] = ""filter-redirector1.XXXXXX""; char *recv_buf; uint32_t size = sizeof(send_buf); size = htonl(size); ret = socketpair(PF_UNIX, SOCK_STREAM, 0, backend_sock); g_assert_cmpint(ret, !=, -1); ret = mkstemp(sock_path0); g_assert_cmpint(ret, !=, -1); ret = mkstemp(sock_path1); g_assert_cmpint(ret, !=, -1); cmdline = g_strdup_printf(""-netdev socket,id=qtest-bn0,fd=%d "" ""-device rtl8139,netdev=qtest-bn0,id=qtest-e0 "" ""-chardev socket,id=redirector0,path=%s,server,nowait "" ""-chardev socket,id=redirector1,path=%s,server,nowait "" ""-chardev socket,id=redirector2,path=%s,nowait "" ""-object filter-redirector,id=qtest-f0,netdev=qtest-bn0,"" ""queue=tx,outdev=redirector0 "" ""-object filter-redirector,id=qtest-f1,netdev=qtest-bn0,"" ""queue=tx,indev=redirector2 "" ""-object filter-redirector,id=qtest-f2,netdev=qtest-bn0,"" ""queue=tx,outdev=redirector1 "" , backend_sock[1], sock_path0, sock_path1, sock_path0); qtest_start(cmdline); g_free(cmdline); recv_sock = unix_connect(sock_path1, NULL); g_assert_cmpint(recv_sock, !=, -1); /* send a qmp command to guarantee that 'connected' is setting to true. */ qmp_discard_response(""{ 'execute' : 'query-status'}""); struct iovec iov[] = { { .iov_base = &size, .iov_len = sizeof(size), }, { .iov_base = send_buf, .iov_len = sizeof(send_buf), }, }; ret = iov_send(backend_sock[0], iov, 2, 0, sizeof(size) + sizeof(send_buf)); g_assert_cmpint(ret, ==, sizeof(send_buf) + sizeof(size)); close(backend_sock[0]); ret = qemu_recv(recv_sock, &len, sizeof(len), 0); g_assert_cmpint(ret, ==, sizeof(len)); len = ntohl(len); g_assert_cmpint(len, ==, sizeof(send_buf)); recv_buf = g_malloc(len); ret = qemu_recv(recv_sock, recv_buf, len, 0); g_assert_cmpstr(recv_buf, ==, send_buf); g_free(recv_buf); close(recv_sock); unlink(sock_path0); unlink(sock_path1); qtest_end(); }","No, it is non-vulnerable."944942,"int acpi_table_add(const char *t) { static const char *dfl_id = ""QEMUQEMU""; char buf[1024], *p, *f; struct acpi_table_header acpi_hdr; unsigned long val; uint32_t length; struct acpi_table_header *acpi_hdr_p; size_t off; memset(&acpi_hdr, 0, sizeof(acpi_hdr)); if (get_param_value(buf, sizeof(buf), ""sig"", t)) { strncpy(acpi_hdr.signature, buf, 4); } else { strncpy(acpi_hdr.signature, dfl_id, 4); } if (get_param_value(buf, sizeof(buf), ""rev"", t)) { val = strtoul(buf, &p, 10); if (val > 255 || *p != '\0') goto out; } else { val = 1; } acpi_hdr.revision = (int8_t)val; if (get_param_value(buf, sizeof(buf), ""oem_id"", t)) { strncpy(acpi_hdr.oem_id, buf, 6); } else { strncpy(acpi_hdr.oem_id, dfl_id, 6); } if (get_param_value(buf, sizeof(buf), ""oem_table_id"", t)) { strncpy(acpi_hdr.oem_table_id, buf, 8); } else { strncpy(acpi_hdr.oem_table_id, dfl_id, 8); } if (get_param_value(buf, sizeof(buf), ""oem_rev"", t)) { val = strtol(buf, &p, 10); if(*p != '\0') goto out; } else { val = 1; } acpi_hdr.oem_revision = cpu_to_le32(val); if (get_param_value(buf, sizeof(buf), ""asl_compiler_id"", t)) { strncpy(acpi_hdr.asl_compiler_id, buf, 4); } else { strncpy(acpi_hdr.asl_compiler_id, dfl_id, 4); } if (get_param_value(buf, sizeof(buf), ""asl_compiler_rev"", t)) { val = strtol(buf, &p, 10); if(*p != '\0') goto out; } else { val = 1; } acpi_hdr.asl_compiler_revision = cpu_to_le32(val); if (!get_param_value(buf, sizeof(buf), ""data"", t)) { buf[0] = '\0'; } length = sizeof(acpi_hdr); f = buf; while (buf[0]) { struct stat s; char *n = strchr(f, ':'); if (n) *n = '\0'; if(stat(f, &s) < 0) { fprintf(stderr, ""Can't stat file '%s': %s\n"", f, strerror(errno)); goto out; } length += s.st_size; if (!n) break; *n = ':'; f = n + 1; } if (!acpi_tables) { acpi_tables_len = sizeof(uint16_t); acpi_tables = qemu_mallocz(acpi_tables_len); } acpi_tables = qemu_realloc(acpi_tables, acpi_tables_len + sizeof(uint16_t) + length); p = acpi_tables + acpi_tables_len; acpi_tables_len += sizeof(uint16_t) + length; *(uint16_t*)p = cpu_to_le32(length); p += sizeof(uint16_t); memcpy(p, &acpi_hdr, sizeof(acpi_hdr)); off = sizeof(acpi_hdr); f = buf; while (buf[0]) { struct stat s; int fd; char *n = strchr(f, ':'); if (n) *n = '\0'; fd = open(f, O_RDONLY); if(fd < 0) goto out; if(fstat(fd, &s) < 0) { close(fd); goto out; } /* off < length is necessary because file size can be changed under our foot */ while(s.st_size && off < length) { int r; r = read(fd, p + off, s.st_size); if (r > 0) { off += r; s.st_size -= r; } else if ((r < 0 && errno != EINTR) || r == 0) { close(fd); goto out; } } close(fd); if (!n) break; f = n + 1; } if (off < length) { /* don't pass random value in process to guest */ memset(p + off, 0, length - off); } acpi_hdr_p = (struct acpi_table_header*)p; acpi_hdr_p->length = cpu_to_le32(length); acpi_hdr_p->checksum = acpi_checksum((uint8_t*)p, length); /* increase number of tables */ (*(uint16_t*)acpi_tables) = cpu_to_le32(le32_to_cpu(*(uint16_t*)acpi_tables) + 1); return 0; out: if (acpi_tables) { qemu_free(acpi_tables); acpi_tables = NULL; } return -1; }","No, it is non-vulnerable."945943,"static void armv7m_nvic_class_init(ObjectClass *klass, void *data) { NVICClass *nc = NVIC_CLASS(klass); DeviceClass *dc = DEVICE_CLASS(klass); SysBusDeviceClass *sdc = SYS_BUS_DEVICE_CLASS(klass); nc->parent_reset = dc->reset; nc->parent_init = sdc->init; sdc->init = armv7m_nvic_init; dc->vmsd = &vmstate_nvic; dc->reset = armv7m_nvic_reset; dc->props = armv7m_nvic_properties; }","No, it is non-vulnerable."946944,"static int ehci_qh_do_overlay(EHCIQueue *q) { int i; int dtoggle; int ping; int eps; int reload; // remember values in fields to preserve in qh after overlay dtoggle = q->qh.token & QTD_TOKEN_DTOGGLE; ping = q->qh.token & QTD_TOKEN_PING; q->qh.current_qtd = q->qtdaddr; q->qh.next_qtd = q->qtd.next; q->qh.altnext_qtd = q->qtd.altnext; q->qh.token = q->qtd.token; eps = get_field(q->qh.epchar, QH_EPCHAR_EPS); if (eps == EHCI_QH_EPS_HIGH) { q->qh.token &= ~QTD_TOKEN_PING; q->qh.token |= ping; } reload = get_field(q->qh.epchar, QH_EPCHAR_RL); set_field(&q->qh.altnext_qtd, reload, QH_ALTNEXT_NAKCNT); for (i = 0; i < 5; i++) { q->qh.bufptr[i] = q->qtd.bufptr[i]; } if (!(q->qh.epchar & QH_EPCHAR_DTC)) { // preserve QH DT bit q->qh.token &= ~QTD_TOKEN_DTOGGLE; q->qh.token |= dtoggle; } q->qh.bufptr[1] &= ~BUFPTR_CPROGMASK_MASK; q->qh.bufptr[2] &= ~BUFPTR_FRAMETAG_MASK; put_dwords(NLPTR_GET(q->qhaddr), (uint32_t *) &q->qh, sizeof(EHCIqh) >> 2); return 0; }","No, it is non-vulnerable."947945,"static uint32_t intel_hda_mmio_readw(void *opaque, target_phys_addr_t addr) { IntelHDAState *d = opaque; const IntelHDAReg *reg = intel_hda_reg_find(d, addr); return intel_hda_reg_read(d, reg, 0xffff); }","No, it is non-vulnerable."948946,"static void rtas_ibm_read_pci_config(sPAPREnvironment *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { uint64_t buid; uint32_t size, addr; if ((nargs != 4) || (nret != 2)) { rtas_st(rets, 0, -1); return; } buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); size = rtas_ld(args, 3); addr = rtas_ld(args, 0); finish_read_pci_config(spapr, buid, addr, size, rets); }","No, it is non-vulnerable."949947,"static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg) { Object *pci_host; QObject *o; pci_host = acpi_get_i386_pci_host(); g_assert(pci_host); o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_BASE, NULL); if (!o) { return false; } mcfg->mcfg_base = qnum_get_int(qobject_to_qnum(o)); qobject_decref(o); o = object_property_get_qobject(pci_host, PCIE_HOST_MCFG_SIZE, NULL); assert(o); mcfg->mcfg_size = qnum_get_int(qobject_to_qnum(o)); qobject_decref(o); return true; }","Yes, it is vulnerable."950948,"static void unassigned_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val) { #ifdef DEBUG_UNASSIGNED printf(""Unassigned mem write "" TARGET_FMT_plx "" = 0x%x\n"", addr, val); #endif #if defined(TARGET_ALPHA) || defined(TARGET_SPARC) || defined(TARGET_MICROBLAZE) do_unassigned_access(addr, 1, 0, 0, 4); #endif }","Yes, it is vulnerable."951949,"void sparc64_get_context(CPUSPARCState *env) { abi_ulong ucp_addr; struct target_ucontext *ucp; target_mc_gregset_t *grp; target_mcontext_t *mcp; abi_ulong fp, i7, w_addr; int err; unsigned int i; target_sigset_t target_set; sigset_t set; ucp_addr = env->regwptr[UREG_I0]; if (!lock_user_struct(VERIFY_WRITE, ucp, ucp_addr, 0)) goto do_sigsegv; mcp = &ucp->tuc_mcontext; grp = &mcp->mc_gregs; /* Skip over the trap instruction, first. */ env->pc = env->npc; env->npc += 4; err = 0; sigprocmask(0, NULL, &set); host_to_target_sigset_internal(&target_set, &set); if (TARGET_NSIG_WORDS == 1) { err |= __put_user(target_set.sig[0], (abi_ulong *)&ucp->tuc_sigmask); } else { abi_ulong *src, *dst; src = target_set.sig; dst = ucp->tuc_sigmask.sig; for (i = 0; i < TARGET_NSIG_WORDS; i++, dst++, src++) { err |= __put_user(*src, dst); } if (err) goto do_sigsegv; } /* XXX: tstate must be saved properly */ // err |= __put_user(env->tstate, &((*grp)[MC_TSTATE])); err |= __put_user(env->pc, &((*grp)[MC_PC])); err |= __put_user(env->npc, &((*grp)[MC_NPC])); err |= __put_user(env->y, &((*grp)[MC_Y])); err |= __put_user(env->gregs[1], &((*grp)[MC_G1])); err |= __put_user(env->gregs[2], &((*grp)[MC_G2])); err |= __put_user(env->gregs[3], &((*grp)[MC_G3])); err |= __put_user(env->gregs[4], &((*grp)[MC_G4])); err |= __put_user(env->gregs[5], &((*grp)[MC_G5])); err |= __put_user(env->gregs[6], &((*grp)[MC_G6])); err |= __put_user(env->gregs[7], &((*grp)[MC_G7])); err |= __put_user(env->regwptr[UREG_I0], &((*grp)[MC_O0])); err |= __put_user(env->regwptr[UREG_I1], &((*grp)[MC_O1])); err |= __put_user(env->regwptr[UREG_I2], &((*grp)[MC_O2])); err |= __put_user(env->regwptr[UREG_I3], &((*grp)[MC_O3])); err |= __put_user(env->regwptr[UREG_I4], &((*grp)[MC_O4])); err |= __put_user(env->regwptr[UREG_I5], &((*grp)[MC_O5])); err |= __put_user(env->regwptr[UREG_I6], &((*grp)[MC_O6])); err |= __put_user(env->regwptr[UREG_I7], &((*grp)[MC_O7])); w_addr = TARGET_STACK_BIAS+env->regwptr[UREG_I6]; fp = i7 = 0; if (get_user(fp, w_addr + offsetof(struct target_reg_window, ins[6]), abi_ulong) != 0) goto do_sigsegv; if (get_user(i7, w_addr + offsetof(struct target_reg_window, ins[7]), abi_ulong) != 0) goto do_sigsegv; err |= __put_user(fp, &(mcp->mc_fp)); err |= __put_user(i7, &(mcp->mc_i7)); { uint32_t *dst = ucp->tuc_mcontext.mc_fpregs.mcfpu_fregs.sregs; for (i = 0; i < 64; i++, dst++) { if (i & 1) { err |= __put_user(env->fpr[i/2].l.lower, dst); } else { err |= __put_user(env->fpr[i/2].l.upper, dst); } } } err |= __put_user(env->fsr, &(mcp->mc_fpregs.mcfpu_fsr)); err |= __put_user(env->gsr, &(mcp->mc_fpregs.mcfpu_gsr)); err |= __put_user(env->fprs, &(mcp->mc_fpregs.mcfpu_fprs)); if (err) goto do_sigsegv; unlock_user_struct(ucp, ucp_addr, 1); return; do_sigsegv: unlock_user_struct(ucp, ucp_addr, 1); force_sig(TARGET_SIGSEGV); }","No, it is non-vulnerable."952950,"static int proxy_utimensat(FsContext *s, V9fsPath *fs_path, const struct timespec *buf) { int retval; retval = v9fs_request(s->private, T_UTIME, NULL, ""sqqqq"", fs_path, buf[0].tv_sec, buf[0].tv_nsec, buf[1].tv_sec, buf[1].tv_nsec); if (retval < 0) { errno = -retval; } return retval; }","No, it is non-vulnerable."953951,"static int subviewer_decode_frame(AVCodecContext *avctx, void *data, int *got_sub_ptr, AVPacket *avpkt) { char c; AVSubtitle *sub = data; const char *ptr = avpkt->data; AVBPrint buf; /* To be removed later */ if (sscanf(ptr, ""%*u:%*u:%*u.%*u,%*u:%*u:%*u.%*u%c"", &c) == 1) { av_log(avctx, AV_LOG_ERROR, ""AVPacket is not clean (contains timing "" ""information). You need to upgrade your libavformat or "" ""sanitize your packet.\n""); return AVERROR_INVALIDDATA; } av_bprint_init(&buf, 0, AV_BPRINT_SIZE_UNLIMITED); // note: no need to rescale pts & duration since they are in the same // timebase as ASS (1/100) if (ptr && avpkt->size > 0 && !subviewer_event_to_ass(&buf, ptr)) ff_ass_add_rect(sub, buf.str, avpkt->pts, avpkt->duration, 0); *got_sub_ptr = sub->num_rects > 0; av_bprint_finalize(&buf, NULL); return avpkt->size; }","Yes, it is vulnerable."954952,"void ff_mpeg4_pred_ac(MpegEncContext *s, int16_t *block, int n, int dir) { int i; int16_t *ac_val, *ac_val1; int8_t *const qscale_table = s->current_picture.qscale_table; /* find prediction */ ac_val = s->ac_val[0][0] + s->block_index[n] * 16; ac_val1 = ac_val; if (s->ac_pred) { if (dir == 0) { const int xy = s->mb_x - 1 + s->mb_y * s->mb_stride; /* left prediction */ ac_val -= 16; if (s->mb_x == 0 || s->qscale == qscale_table[xy] || n == 1 || n == 3) { /* same qscale */ for (i = 1; i < 8; i++) block[s->idsp.idct_permutation[i << 3]] += ac_val[i]; } else { /* different qscale, we must rescale */ for (i = 1; i < 8; i++) block[s->idsp.idct_permutation[i << 3]] += ROUNDED_DIV(ac_val[i] * qscale_table[xy], s->qscale); } } else { const int xy = s->mb_x + s->mb_y * s->mb_stride - s->mb_stride; /* top prediction */ ac_val -= 16 * s->block_wrap[n]; if (s->mb_y == 0 || s->qscale == qscale_table[xy] || n == 2 || n == 3) { /* same qscale */ for (i = 1; i < 8; i++) block[s->idsp.idct_permutation[i]] += ac_val[i + 8]; } else { /* different qscale, we must rescale */ for (i = 1; i < 8; i++) block[s->idsp.idct_permutation[i]] += ROUNDED_DIV(ac_val[i + 8] * qscale_table[xy], s->qscale); } } } /* left copy */ for (i = 1; i < 8; i++) ac_val1[i] = block[s->idsp.idct_permutation[i << 3]]; /* top copy */ for (i = 1; i < 8; i++) ac_val1[8 + i] = block[s->idsp.idct_permutation[i]]; }","Yes, it is vulnerable."955953,"static int csrhci_write(struct CharDriverState *chr, const uint8_t *buf, int len) { struct csrhci_s *s = (struct csrhci_s *) chr->opaque; int plen = s->in_len; if (!s->enable) return 0; s->in_len += len; memcpy(s->inpkt + plen, buf, len); while (1) { if (s->in_len >= 2 && plen < 2) s->in_hdr = csrhci_header_len(s->inpkt) + 1; if (s->in_len >= s->in_hdr && plen < s->in_hdr) s->in_data = csrhci_data_len(s->inpkt) + s->in_hdr; if (s->in_len >= s->in_data) { csrhci_in_packet(s, s->inpkt); memmove(s->inpkt, s->inpkt + s->in_len, s->in_len - s->in_data); s->in_len -= s->in_data; s->in_hdr = INT_MAX; s->in_data = INT_MAX; plen = 0; } else break; } return len; }","Yes, it is vulnerable."956954,"static int standard_decode_picture_header(VC9Context *v) { int status = 0; if (v->finterpflag) v->interpfrm = get_bits(&v->gb, 1); skip_bits(&v->gb, 2); //framecnt unused if (v->rangered) v->rangeredfrm = get_bits(&v->gb, 1); v->pict_type = get_bits(&v->gb, 1); if (v->avctx->max_b_frames && !v->pict_type) { if (get_bits(&v->gb, 1)) v->pict_type = I_TYPE; else v->pict_type = P_TYPE; } else v->pict_type++; //P_TYPE switch (v->pict_type) { case I_TYPE: status = decode_i_picture_header(v); break; case BI_TYPE: status = decode_b_picture_header(v); break; case P_TYPE: status = decode_p_picture_header(v); break; case B_TYPE: status = decode_b_picture_header(v); break; } if (status == FRAME_SKIPED) { av_log(v, AV_LOG_INFO, ""Skipping frame...\n""); return status; } /* AC/DC Syntax */ v->transacfrm = get_bits(&v->gb, 1); if (v->transacfrm) v->transacfrm += get_bits(&v->gb, 1); if (v->pict_type == I_TYPE || v->pict_type == BI_TYPE) { v->transacfrm2 = get_bits(&v->gb, 1); if (v->transacfrm2) v->transacfrm2 += get_bits(&v->gb, 1); } v->transacdctab = get_bits(&v->gb, 1); return 0; }","No, it is non-vulnerable."957955,"static void do_program_interrupt(CPUS390XState *env) { uint64_t mask, addr; LowCore *lowcore; hwaddr len = TARGET_PAGE_SIZE; int ilen = env->int_pgm_ilen; switch (ilen) { case ILEN_LATER: ilen = get_ilen(cpu_ldub_code(env, env->psw.addr)); break; case ILEN_LATER_INC: ilen = get_ilen(cpu_ldub_code(env, env->psw.addr)); env->psw.addr += ilen; break; default: assert(ilen == 2 || ilen == 4 || ilen == 6); } qemu_log_mask(CPU_LOG_INT, ""%s: code=0x%x ilen=%d\n"", __func__, env->int_pgm_code, ilen); lowcore = cpu_physical_memory_map(env->psa, &len, 1); lowcore->pgm_ilen = cpu_to_be16(ilen); lowcore->pgm_code = cpu_to_be16(env->int_pgm_code); lowcore->program_old_psw.mask = cpu_to_be64(get_psw_mask(env)); lowcore->program_old_psw.addr = cpu_to_be64(env->psw.addr); mask = be64_to_cpu(lowcore->program_new_psw.mask); addr = be64_to_cpu(lowcore->program_new_psw.addr); cpu_physical_memory_unmap(lowcore, len, 1, len); DPRINTF(""%s: %x %x %"" PRIx64 "" %"" PRIx64 ""\n"", __func__, env->int_pgm_code, ilen, env->psw.mask, env->psw.addr); load_psw(env, mask, addr); }","No, it is non-vulnerable."958956,"int get_physical_address(CPUState * env, target_ulong * physical, int *prot, target_ulong address, int rw, int access_type) { /* P1, P2 and P4 areas do not use translation */ if ((address >= 0x80000000 && address < 0xc0000000) || address >= 0xe0000000) { if (!(env->sr & SR_MD) && (address < 0xe0000000 || address > 0xe4000000)) { /* Unauthorized access in user mode (only store queues are available) */ fprintf(stderr, ""Unauthorized access\n""); return (rw & PAGE_WRITE) ? MMU_DTLB_MISS_WRITE : MMU_DTLB_MISS_READ; } /* Mask upper 3 bits */ *physical = address & 0x1FFFFFFF; *prot = PAGE_READ | PAGE_WRITE; return MMU_OK; } /* If MMU is disabled, return the corresponding physical page */ if (!env->mmucr & MMUCR_AT) { *physical = address & 0x1FFFFFFF; *prot = PAGE_READ | PAGE_WRITE; return MMU_OK; } /* We need to resort to the MMU */ return get_mmu_address(env, physical, prot, address, rw, access_type); }","No, it is non-vulnerable."959957,"static int multiwrite_f(BlockBackend *blk, int argc, char **argv) { struct timeval t1, t2; int Cflag = 0, qflag = 0; int c, cnt; char **buf; int64_t offset, first_offset = 0; /* Some compilers get confused and warn if this is not initialized. */ int total = 0; int nr_iov; int nr_reqs; int pattern = 0xcd; QEMUIOVector *qiovs; int i; BlockRequest *reqs; while ((c = getopt(argc, argv, ""CqP:"")) != EOF) { switch (c) { case 'C': Cflag = 1; break; case 'q': qflag = 1; break; case 'P': pattern = parse_pattern(optarg); if (pattern < 0) { return 0; } break; default: return qemuio_command_usage(&writev_cmd); } } if (optind > argc - 2) { return qemuio_command_usage(&writev_cmd); } nr_reqs = 1; for (i = optind; i < argc; i++) { if (!strcmp(argv[i], "";"")) { nr_reqs++; } } reqs = g_new0(BlockRequest, nr_reqs); buf = g_new0(char *, nr_reqs); qiovs = g_new(QEMUIOVector, nr_reqs); for (i = 0; i < nr_reqs && optind < argc; i++) { int j; /* Read the offset of the request */ offset = cvtnum(argv[optind]); if (offset < 0) { printf(""non-numeric offset argument -- %s\n"", argv[optind]); goto out; } optind++; if (offset & 0x1ff) { printf(""offset %lld is not sector aligned\n"", (long long)offset); goto out; } if (i == 0) { first_offset = offset; } /* Read lengths for qiov entries */ for (j = optind; j < argc; j++) { if (!strcmp(argv[j], "";"")) { break; } } nr_iov = j - optind; /* Build request */ buf[i] = create_iovec(blk, &qiovs[i], &argv[optind], nr_iov, pattern); if (buf[i] == NULL) { goto out; } reqs[i].qiov = &qiovs[i]; reqs[i].sector = offset >> 9; reqs[i].nb_sectors = reqs[i].qiov->size >> 9; optind = j + 1; pattern++; } /* If there were empty requests at the end, ignore them */ nr_reqs = i; gettimeofday(&t1, NULL); cnt = do_aio_multiwrite(blk, reqs, nr_reqs, &total); gettimeofday(&t2, NULL); if (cnt < 0) { printf(""aio_multiwrite failed: %s\n"", strerror(-cnt)); goto out; } if (qflag) { goto out; } /* Finally, report back -- -C gives a parsable format */ t2 = tsub(t2, t1); print_report(""wrote"", &t2, first_offset, total, total, cnt, Cflag); out: for (i = 0; i < nr_reqs; i++) { qemu_io_free(buf[i]); if (reqs[i].qiov != NULL) { qemu_iovec_destroy(&qiovs[i]); } } g_free(buf); g_free(reqs); g_free(qiovs); return 0; }","No, it is non-vulnerable."960958,"static void rtsp_cmd_setup(HTTPContext *c, const char *url, RTSPHeader *h) { FFStream *stream; int stream_index, port; char buf[1024]; char path1[1024]; const char *path; HTTPContext *rtp_c; RTSPTransportField *th; struct sockaddr_in dest_addr; RTSPActionServerSetup setup; /* find which url is asked */ url_split(NULL, 0, NULL, 0, NULL, path1, sizeof(path1), url); path = path1; if (*path == '/') path++; /* now check each stream */ for(stream = first_stream; stream != NULL; stream = stream->next) { if (!stream->is_feed && stream->fmt == &rtp_mux) { /* accept aggregate filenames only if single stream */ if (!strcmp(path, stream->filename)) { if (stream->nb_streams != 1) { rtsp_reply_error(c, RTSP_STATUS_AGGREGATE); return; } stream_index = 0; goto found; } for(stream_index = 0; stream_index < stream->nb_streams; stream_index++) { snprintf(buf, sizeof(buf), ""%s/streamid=%d"", stream->filename, stream_index); if (!strcmp(path, buf)) goto found; } } } /* no stream found */ rtsp_reply_error(c, RTSP_STATUS_SERVICE); /* XXX: right error ? */ return; found: /* generate session id if needed */ if (h->session_id[0] == '\0') { snprintf(h->session_id, sizeof(h->session_id), ""%08x%08x"", (int)random(), (int)random()); } /* find rtp session, and create it if none found */ rtp_c = find_rtp_session(h->session_id); if (!rtp_c) { /* always prefer UDP */ th = find_transport(h, RTSP_PROTOCOL_RTP_UDP); if (!th) { th = find_transport(h, RTSP_PROTOCOL_RTP_TCP); if (!th) { rtsp_reply_error(c, RTSP_STATUS_TRANSPORT); return; } } rtp_c = rtp_new_connection(&c->from_addr, stream, h->session_id, th->protocol); if (!rtp_c) { rtsp_reply_error(c, RTSP_STATUS_BANDWIDTH); return; } /* open input stream */ if (open_input_stream(rtp_c, """") < 0) { rtsp_reply_error(c, RTSP_STATUS_INTERNAL); return; } } /* test if stream is OK (test needed because several SETUP needs to be done for a given file) */ if (rtp_c->stream != stream) { rtsp_reply_error(c, RTSP_STATUS_SERVICE); return; } /* test if stream is already set up */ if (rtp_c->rtp_ctx[stream_index]) { rtsp_reply_error(c, RTSP_STATUS_STATE); return; } /* check transport */ th = find_transport(h, rtp_c->rtp_protocol); if (!th || (th->protocol == RTSP_PROTOCOL_RTP_UDP && th->client_port_min <= 0)) { rtsp_reply_error(c, RTSP_STATUS_TRANSPORT); return; } /* setup default options */ setup.transport_option[0] = '\0'; dest_addr = rtp_c->from_addr; dest_addr.sin_port = htons(th->client_port_min); /* add transport option if needed */ if (ff_rtsp_callback) { setup.ipaddr = ntohl(dest_addr.sin_addr.s_addr); if (ff_rtsp_callback(RTSP_ACTION_SERVER_SETUP, rtp_c->session_id, (char *)&setup, sizeof(setup), stream->rtsp_option) < 0) { rtsp_reply_error(c, RTSP_STATUS_TRANSPORT); return; } dest_addr.sin_addr.s_addr = htonl(setup.ipaddr); } /* setup stream */ if (rtp_new_av_stream(rtp_c, stream_index, &dest_addr, c) < 0) { rtsp_reply_error(c, RTSP_STATUS_TRANSPORT); return; } /* now everything is OK, so we can send the connection parameters */ rtsp_reply_header(c, RTSP_STATUS_OK); /* session ID */ url_fprintf(c->pb, ""Session: %s\r\n"", rtp_c->session_id); switch(rtp_c->rtp_protocol) { case RTSP_PROTOCOL_RTP_UDP: port = rtp_get_local_port(rtp_c->rtp_handles[stream_index]); url_fprintf(c->pb, ""Transport: RTP/AVP/UDP;unicast;"" ""client_port=%d-%d;server_port=%d-%d"", th->client_port_min, th->client_port_min + 1, port, port + 1); break; case RTSP_PROTOCOL_RTP_TCP: url_fprintf(c->pb, ""Transport: RTP/AVP/TCP;interleaved=%d-%d"", stream_index * 2, stream_index * 2 + 1); break; default: break; } if (setup.transport_option[0] != '\0') { url_fprintf(c->pb, "";%s"", setup.transport_option); } url_fprintf(c->pb, ""\r\n""); url_fprintf(c->pb, ""\r\n""); }","No, it is non-vulnerable."961959,"static int show_format(WriterContext *w, AVFormatContext *fmt_ctx) { char val_str[128]; int64_t size = fmt_ctx->pb ? avio_size(fmt_ctx->pb) : -1; int ret = 0; writer_print_section_header(w, SECTION_ID_FORMAT); print_str(""filename"", fmt_ctx->filename); print_int(""nb_streams"", fmt_ctx->nb_streams); print_int(""nb_programs"", fmt_ctx->nb_programs); print_str(""format_name"", fmt_ctx->iformat->name); if (!do_bitexact) { if (fmt_ctx->iformat->long_name) print_str (""format_long_name"", fmt_ctx->iformat->long_name); else print_str_opt(""format_long_name"", ""unknown""); } print_time(""start_time"", fmt_ctx->start_time, &AV_TIME_BASE_Q); print_time(""duration"", fmt_ctx->duration, &AV_TIME_BASE_Q); if (size >= 0) print_val (""size"", size, unit_byte_str); else print_str_opt(""size"", ""N/A""); if (fmt_ctx->bit_rate > 0) print_val (""bit_rate"", fmt_ctx->bit_rate, unit_bit_per_second_str); else print_str_opt(""bit_rate"", ""N/A""); print_int(""probe_score"", av_format_get_probe_score(fmt_ctx)); ret = show_tags(w, fmt_ctx->metadata, SECTION_ID_FORMAT_TAGS); writer_print_section_footer(w); fflush(stdout); return ret; }","No, it is non-vulnerable."962960,"static void n8x0_init(ram_addr_t ram_size, const char *boot_device, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model, struct arm_boot_info *binfo, int model) { struct n800_s *s = (struct n800_s *) qemu_mallocz(sizeof(*s)); int sdram_size = binfo->ram_size; int onenandram_size = 0x00010000; DisplayState *ds; if (ram_size < sdram_size + onenandram_size + OMAP242X_SRAM_SIZE) { fprintf(stderr, ""This architecture uses %i bytes of memory\n"", sdram_size + onenandram_size + OMAP242X_SRAM_SIZE); exit(1); } s->cpu = omap2420_mpu_init(sdram_size, cpu_model); /* Setup peripherals * * Believed external peripherals layout in the N810: * (spi bus 1) * tsc2005 * lcd_mipid * (spi bus 2) * Conexant cx3110x (WLAN) * optional: pc2400m (WiMAX) * (i2c bus 0) * TLV320AIC33 (audio codec) * TCM825x (camera by Toshiba) * lp5521 (clever LEDs) * tsl2563 (light sensor, hwmon, model 7, rev. 0) * lm8323 (keypad, manf 00, rev 04) * (i2c bus 1) * tmp105 (temperature sensor, hwmon) * menelaus (pm) * (somewhere on i2c - maybe N800-only) * tea5761 (FM tuner) * (serial 0) * GPS * (some serial port) * csr41814 (Bluetooth) */ n8x0_gpio_setup(s); n8x0_nand_setup(s); n8x0_i2c_setup(s); if (model == 800) n800_tsc_kbd_setup(s); else if (model == 810) { n810_tsc_setup(s); n810_kbd_setup(s); } n8x0_spi_setup(s); n8x0_dss_setup(s); n8x0_cbus_setup(s); n8x0_uart_setup(s); if (usb_enabled) n8x0_usb_setup(s); /* Setup initial (reset) machine state */ /* Start at the OneNAND bootloader. */ s->cpu->env->regs[15] = 0; if (kernel_filename) { /* Or at the linux loader. */ binfo->kernel_filename = kernel_filename; binfo->kernel_cmdline = kernel_cmdline; binfo->initrd_filename = initrd_filename; arm_load_kernel(s->cpu->env, binfo); qemu_register_reset(n8x0_boot_init, s); n8x0_boot_init(s); } if (option_rom[0] && (boot_device[0] == 'n' || !kernel_filename)) { int rom_size; uint8_t nolo_tags[0x10000]; /* No, wait, better start at the ROM. */ s->cpu->env->regs[15] = OMAP2_Q2_BASE + 0x400000; /* This is intended for loading the `secondary.bin' program from * Nokia images (the NOLO bootloader). The entry point seems * to be at OMAP2_Q2_BASE + 0x400000. * * The `2nd.bin' files contain some kind of earlier boot code and * for them the entry point needs to be set to OMAP2_SRAM_BASE. * * The code above is for loading the `zImage' file from Nokia * images. */ rom_size = load_image_targphys(option_rom[0], OMAP2_Q2_BASE + 0x400000, sdram_size - 0x400000); printf(""%i bytes of image loaded\n"", rom_size); n800_setup_nolo_tags(nolo_tags); cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000); } /* FIXME: We shouldn't really be doing this here. The LCD controller will set the size once configured, so this just sets an initial size until the guest activates the display. */ ds = get_displaystate(); ds->surface = qemu_resize_displaysurface(ds, 800, 480); dpy_resize(ds); }","No, it is non-vulnerable."963961,"void replay_fetch_data_kind(void) { if (replay_file) { if (!replay_has_unread_data) { replay_data_kind = replay_get_byte(); if (replay_data_kind == EVENT_INSTRUCTION) { replay_state.instructions_count = replay_get_dword(); } replay_check_error(); replay_has_unread_data = 1; if (replay_data_kind >= EVENT_COUNT) { error_report(""Replay: unknown event kind %d"", replay_data_kind); exit(1); } } } }","No, it is non-vulnerable."964962,"static void DMA_run (void) { struct dma_cont *d; int icont, ichan; int rearm = 0; static int running = 0; if (running) { rearm = 1; goto out; } else { running = 1; } d = dma_controllers; for (icont = 0; icont < 2; icont++, d++) { for (ichan = 0; ichan < 4; ichan++) { int mask; mask = 1 << ichan; if ((0 == (d->mask & mask)) && (0 != (d->status & (mask << 4)))) { channel_run (icont, ichan); rearm = 1; } } } running = 0; out: if (rearm) qemu_bh_schedule_idle(dma_bh); }","No, it is non-vulnerable."965963,"int bdrv_img_create(const char *filename, const char *fmt, const char *base_filename, const char *base_fmt, char *options, uint64_t img_size, int flags) { QEMUOptionParameter *param = NULL, *create_options = NULL; QEMUOptionParameter *backing_fmt; BlockDriverState *bs = NULL; BlockDriver *drv, *proto_drv; int ret = 0; /* Find driver and parse its options */ drv = bdrv_find_format(fmt); if (!drv) { error_report(""Unknown file format '%s'"", fmt); ret = -1; goto out; } proto_drv = bdrv_find_protocol(filename); if (!proto_drv) { error_report(""Unknown protocol '%s'"", filename); ret = -1; goto out; } create_options = append_option_parameters(create_options, drv->create_options); create_options = append_option_parameters(create_options, proto_drv->create_options); /* Create parameter list with default values */ param = parse_option_parameters("""", create_options, param); set_option_parameter_int(param, BLOCK_OPT_SIZE, img_size); /* Parse -o options */ if (options) { param = parse_option_parameters(options, create_options, param); if (param == NULL) { error_report(""Invalid options for file format '%s'."", fmt); ret = -1; goto out; } } if (base_filename) { if (set_option_parameter(param, BLOCK_OPT_BACKING_FILE, base_filename)) { error_report(""Backing file not supported for file format '%s'"", fmt); ret = -1; goto out; } } if (base_fmt) { if (set_option_parameter(param, BLOCK_OPT_BACKING_FMT, base_fmt)) { error_report(""Backing file format not supported for file "" ""format '%s'"", fmt); ret = -1; goto out; } } backing_fmt = get_option_parameter(param, BLOCK_OPT_BACKING_FMT); if (backing_fmt && backing_fmt->value.s) { if (!bdrv_find_format(backing_fmt->value.s)) { error_report(""Unknown backing file format '%s'"", backing_fmt->value.s); ret = -1; goto out; } } // The size for the image must always be specified, with one exception: // If we are using a backing file, we can obtain the size from there if (get_option_parameter(param, BLOCK_OPT_SIZE)->value.n == -1) { QEMUOptionParameter *backing_file = get_option_parameter(param, BLOCK_OPT_BACKING_FILE); if (backing_file && backing_file->value.s) { uint64_t size; const char *fmt = NULL; char buf[32]; if (backing_fmt && backing_fmt->value.s) { fmt = backing_fmt->value.s; } bs = bdrv_new(""""); ret = bdrv_open(bs, backing_file->value.s, flags, drv); if (ret < 0) { error_report(""Could not open '%s'"", filename); ret = -1; goto out; } bdrv_get_geometry(bs, &size); size *= 512; snprintf(buf, sizeof(buf), ""%"" PRId64, size); set_option_parameter(param, BLOCK_OPT_SIZE, buf); } else { error_report(""Image creation needs a size parameter""); ret = -1; goto out; } } printf(""Formatting '%s', fmt=%s "", filename, fmt); print_option_parameters(param); puts(""""); ret = bdrv_create(drv, filename, param); if (ret < 0) { if (ret == -ENOTSUP) { error_report(""Formatting or formatting option not supported for "" ""file format '%s'"", fmt); } else if (ret == -EFBIG) { error_report(""The image size is too large for file format '%s'"", fmt); } else { error_report(""%s: error while creating %s: %s"", filename, fmt, strerror(-ret)); } } out: free_option_parameters(create_options); free_option_parameters(param); if (bs) { bdrv_delete(bs); } if (ret) { return 1; } return 0; }","No, it is non-vulnerable."966964,"static inline void reset_bit(uint32_t *field, int bit) { field[bit >> 5] &= ~(1 << (bit & 0x1F)); }","No, it is non-vulnerable."967965,void bdrv_aio_cancel_async(BlockAIOCB *acb) { if (acb->aiocb_info->cancel_async) { acb->aiocb_info->cancel_async(acb); } },"No, it is non-vulnerable."968966,Visitor *qapi_dealloc_get_visitor(QapiDeallocVisitor *v) { return &v->visitor; },"No, it is non-vulnerable."969967,"int av_asrc_buffer_add_audio_buffer_ref(AVFilterContext *ctx, AVFilterBufferRef *samplesref, int av_unused flags) { BufferSourceContext *abuffer = ctx->priv; AVFilterLink *link; int ret, logged = 0; if (av_fifo_space(abuffer->fifo) < sizeof(samplesref)) { av_log(ctx, AV_LOG_ERROR, ""Buffering limit reached. Please consume some available frames "" ""before adding new ones.\n""); return AVERROR(EINVAL); } // Normalize input link = ctx->outputs[0]; if (samplesref->audio->sample_rate != link->sample_rate) { log_input_change(ctx, link, samplesref); logged = 1; abuffer->sample_rate = samplesref->audio->sample_rate; if (!abuffer->aresample) { ret = insert_filter(abuffer, link, &abuffer->aresample, ""aresample""); if (ret < 0) return ret; } else { link = abuffer->aresample->outputs[0]; if (samplesref->audio->sample_rate == link->sample_rate) remove_filter(&abuffer->aresample); else if ((ret = reconfigure_filter(abuffer, abuffer->aresample)) < 0) return ret; } } link = ctx->outputs[0]; if (samplesref->format != link->format || samplesref->audio->channel_layout != link->channel_layout || samplesref->audio->planar != link->planar) { if (!logged) log_input_change(ctx, link, samplesref); abuffer->sample_format = samplesref->format; abuffer->channel_layout = samplesref->audio->channel_layout; abuffer->packing_format = samplesref->audio->planar; if (!abuffer->aconvert) { ret = insert_filter(abuffer, link, &abuffer->aconvert, ""aconvert""); if (ret < 0) return ret; } else { link = abuffer->aconvert->outputs[0]; if (samplesref->format == link->format && samplesref->audio->channel_layout == link->channel_layout && samplesref->audio->planar == link->planar ) remove_filter(&abuffer->aconvert); else if ((ret = reconfigure_filter(abuffer, abuffer->aconvert)) < 0) return ret; } } if (sizeof(samplesref) != av_fifo_generic_write(abuffer->fifo, &samplesref, sizeof(samplesref), NULL)) { av_log(ctx, AV_LOG_ERROR, ""Error while writing to FIFO\n""); return AVERROR(EINVAL); } return 0; }","No, it is non-vulnerable."970968,"static V4L2Buffer* v4l2_dequeue_v4l2buf(V4L2Context *ctx, int timeout) { struct v4l2_plane planes[VIDEO_MAX_PLANES]; struct v4l2_buffer buf = { 0 }; V4L2Buffer* avbuf = NULL; struct pollfd pfd = { .events = POLLIN | POLLRDNORM | POLLPRI | POLLOUT | POLLWRNORM, /* default blocking capture */ .fd = ctx_to_m2mctx(ctx)->fd, }; int ret; if (V4L2_TYPE_IS_OUTPUT(ctx->type)) pfd.events = POLLOUT | POLLWRNORM; for (;;) { ret = poll(&pfd, 1, timeout); if (ret > 0) break; if (errno == EINTR) continue; /* timeout is being used to indicate last valid bufer when draining */ if (ctx_to_m2mctx(ctx)->draining) ctx->done = 1; return NULL; } /* 0. handle errors */ if (pfd.revents & POLLERR) { av_log(logger(ctx), AV_LOG_WARNING, ""%s POLLERR\n"", ctx->name); return NULL; } /* 1. handle resolution changes */ if (pfd.revents & POLLPRI) { ret = v4l2_handle_event(ctx); if (ret < 0) { /* if re-init failed, abort */ ctx->done = EINVAL; return NULL; } if (ret) { /* if re-init was successful drop the buffer (if there was one) * since we had to reconfigure capture (unmap all buffers) */ return NULL; } } /* 2. dequeue the buffer */ if (pfd.revents & (POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM)) { if (!V4L2_TYPE_IS_OUTPUT(ctx->type)) { /* there is a capture buffer ready */ if (pfd.revents & (POLLIN | POLLRDNORM)) goto dequeue; /* the driver is ready to accept more input; instead of waiting for the capture * buffer to complete we return NULL so input can proceed (we are single threaded) */ if (pfd.revents & (POLLOUT | POLLWRNORM)) return NULL; } dequeue: memset(&buf, 0, sizeof(buf)); buf.memory = V4L2_MEMORY_MMAP; buf.type = ctx->type; if (V4L2_TYPE_IS_MULTIPLANAR(ctx->type)) { memset(planes, 0, sizeof(planes)); buf.length = VIDEO_MAX_PLANES; buf.m.planes = planes; } ret = ioctl(ctx_to_m2mctx(ctx)->fd, VIDIOC_DQBUF, &buf); if (ret) { if (errno != EAGAIN) { ctx->done = errno; if (errno != EPIPE) av_log(logger(ctx), AV_LOG_DEBUG, ""%s VIDIOC_DQBUF, errno (%s)\n"", ctx->name, av_err2str(AVERROR(errno))); } } else { avbuf = &ctx->buffers[buf.index]; avbuf->status = V4L2BUF_AVAILABLE; avbuf->buf = buf; if (V4L2_TYPE_IS_MULTIPLANAR(ctx->type)) { memcpy(avbuf->planes, planes, sizeof(planes)); avbuf->buf.m.planes = avbuf->planes; } } } return avbuf; }","No, it is non-vulnerable."971969,"static void _decode_opc(DisasContext * ctx) { #if 0 fprintf(stderr, ""Translating opcode 0x%04x\n"", ctx->opcode); #endif switch (ctx->opcode) { case 0x0019: /* div0u */ tcg_gen_andi_i32(cpu_sr, cpu_sr, ~(SR_M | SR_Q | SR_T)); return; case 0x000b: /* rts */ CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_delayed_pc, cpu_pr); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0028: /* clrmac */ tcg_gen_movi_i32(cpu_mach, 0); tcg_gen_movi_i32(cpu_macl, 0); return; case 0x0048: /* clrs */ tcg_gen_andi_i32(cpu_sr, cpu_sr, ~SR_S); return; case 0x0008: /* clrt */ gen_clr_t(); return; case 0x0038: /* ldtlb */ CHECK_PRIVILEGED gen_helper_ldtlb(); return; case 0x002b: /* rte */ CHECK_PRIVILEGED CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_sr, cpu_ssr); tcg_gen_mov_i32(cpu_delayed_pc, cpu_spc); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0058: /* sets */ tcg_gen_ori_i32(cpu_sr, cpu_sr, SR_S); return; case 0x0018: /* sett */ gen_set_t(); return; case 0xfbfd: /* frchg */ tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_FR); ctx->bstate = BS_STOP; return; case 0xf3fd: /* fschg */ tcg_gen_xori_i32(cpu_fpscr, cpu_fpscr, FPSCR_SZ); ctx->bstate = BS_STOP; return; case 0x0009: /* nop */ return; case 0x001b: /* sleep */ CHECK_PRIVILEGED gen_helper_sleep(tcg_const_i32(ctx->pc + 2)); return; } switch (ctx->opcode & 0xf000) { case 0x1000: /* mov.l Rm,@(disp,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B11_8), B3_0 * 4); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x5000: /* mov.l @(disp,Rm),Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 4); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xe000: /* mov #imm,Rn */ tcg_gen_movi_i32(REG(B11_8), B7_0s); return; case 0x9000: /* mov.w @(disp,PC),Rn */ { TCGv addr = tcg_const_i32(ctx->pc + 4 + B7_0 * 2); tcg_gen_qemu_ld16s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xd000: /* mov.l @(disp,PC),Rn */ { TCGv addr = tcg_const_i32((ctx->pc + 4 + B7_0 * 4) & ~3); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x7000: /* add #imm,Rn */ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), B7_0s); return; case 0xa000: /* bra disp */ CHECK_NOT_DELAY_SLOT ctx->delayed_pc = ctx->pc + 4 + B11_0s * 2; tcg_gen_movi_i32(cpu_delayed_pc, ctx->delayed_pc); ctx->flags |= DELAY_SLOT; return; case 0xb000: /* bsr disp */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); ctx->delayed_pc = ctx->pc + 4 + B11_0s * 2; tcg_gen_movi_i32(cpu_delayed_pc, ctx->delayed_pc); ctx->flags |= DELAY_SLOT; return; } switch (ctx->opcode & 0xf00f) { case 0x6003: /* mov Rm,Rn */ tcg_gen_mov_i32(REG(B11_8), REG(B7_4)); return; case 0x2000: /* mov.b Rm,@Rn */ tcg_gen_qemu_st8(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x2001: /* mov.w Rm,@Rn */ tcg_gen_qemu_st16(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x2002: /* mov.l Rm,@Rn */ tcg_gen_qemu_st32(REG(B7_4), REG(B11_8), ctx->memidx); return; case 0x6000: /* mov.b @Rm,Rn */ tcg_gen_qemu_ld8s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x6001: /* mov.w @Rm,Rn */ tcg_gen_qemu_ld16s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x6002: /* mov.l @Rm,Rn */ tcg_gen_qemu_ld32s(REG(B11_8), REG(B7_4), ctx->memidx); return; case 0x2004: /* mov.b Rm,@-Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 1); tcg_gen_qemu_st8(REG(B7_4), addr, ctx->memidx); /* might cause re-execution */ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 1); /* modify register status */ tcg_temp_free(addr); } return; case 0x2005: /* mov.w Rm,@-Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 2); tcg_gen_qemu_st16(REG(B7_4), addr, ctx->memidx); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 2); tcg_temp_free(addr); } return; case 0x2006: /* mov.l Rm,@-Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x6004: /* mov.b @Rm+,Rn */ tcg_gen_qemu_ld8s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 1); return; case 0x6005: /* mov.w @Rm+,Rn */ tcg_gen_qemu_ld16s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 2); return; case 0x6006: /* mov.l @Rm+,Rn */ tcg_gen_qemu_ld32s(REG(B11_8), REG(B7_4), ctx->memidx); if ( B11_8 != B7_4 ) tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); return; case 0x0004: /* mov.b Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st8(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x0005: /* mov.w Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st16(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x0006: /* mov.l Rm,@(R0,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); tcg_gen_qemu_st32(REG(B7_4), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000c: /* mov.b @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld8s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000d: /* mov.w @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld16s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x000e: /* mov.l @(R0,Rm),Rn */ { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); tcg_gen_qemu_ld32s(REG(B11_8), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x6008: /* swap.b Rm,Rn */ { TCGv highw, high, low; highw = tcg_temp_new(); tcg_gen_andi_i32(highw, REG(B7_4), 0xffff0000); high = tcg_temp_new(); tcg_gen_ext8u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 8); low = tcg_temp_new(); tcg_gen_shri_i32(low, REG(B7_4), 8); tcg_gen_ext8u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_gen_or_i32(REG(B11_8), REG(B11_8), highw); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x6009: /* swap.w Rm,Rn */ { TCGv high, low; high = tcg_temp_new(); tcg_gen_ext16u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 16); low = tcg_temp_new(); tcg_gen_shri_i32(low, REG(B7_4), 16); tcg_gen_ext16u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x200d: /* xtrct Rm,Rn */ { TCGv high, low; high = tcg_temp_new(); tcg_gen_ext16u_i32(high, REG(B7_4)); tcg_gen_shli_i32(high, high, 16); low = tcg_temp_new(); tcg_gen_shri_i32(low, REG(B11_8), 16); tcg_gen_ext16u_i32(low, low); tcg_gen_or_i32(REG(B11_8), high, low); tcg_temp_free(low); tcg_temp_free(high); } return; case 0x300c: /* add Rm,Rn */ tcg_gen_add_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x300e: /* addc Rm,Rn */ gen_helper_addc(REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300f: /* addv Rm,Rn */ gen_helper_addv(REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x2009: /* and Rm,Rn */ tcg_gen_and_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x3000: /* cmp/eq Rm,Rn */ gen_cmp(TCG_COND_EQ, REG(B7_4), REG(B11_8)); return; case 0x3003: /* cmp/ge Rm,Rn */ gen_cmp(TCG_COND_GE, REG(B7_4), REG(B11_8)); return; case 0x3007: /* cmp/gt Rm,Rn */ gen_cmp(TCG_COND_GT, REG(B7_4), REG(B11_8)); return; case 0x3006: /* cmp/hi Rm,Rn */ gen_cmp(TCG_COND_GTU, REG(B7_4), REG(B11_8)); return; case 0x3002: /* cmp/hs Rm,Rn */ gen_cmp(TCG_COND_GEU, REG(B7_4), REG(B11_8)); return; case 0x200c: /* cmp/str Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); TCGv cmp1 = tcg_temp_local_new(); TCGv cmp2 = tcg_temp_local_new(); tcg_gen_xor_i32(cmp1, REG(B7_4), REG(B11_8)); tcg_gen_andi_i32(cmp2, cmp1, 0xff000000); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x00ff0000); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x0000ff00); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cmp2, cmp1, 0x000000ff); tcg_gen_brcondi_i32(TCG_COND_EQ, cmp2, 0, label1); tcg_gen_andi_i32(cpu_sr, cpu_sr, ~SR_T); tcg_gen_br(label2); gen_set_label(label1); tcg_gen_ori_i32(cpu_sr, cpu_sr, SR_T); gen_set_label(label2); tcg_temp_free(cmp2); tcg_temp_free(cmp1); } return; case 0x2007: /* div0s Rm,Rn */ { gen_copy_bit_i32(cpu_sr, 8, REG(B11_8), 31); /* SR_Q */ gen_copy_bit_i32(cpu_sr, 9, REG(B7_4), 31); /* SR_M */ TCGv val = tcg_temp_new(); tcg_gen_xor_i32(val, REG(B7_4), REG(B11_8)); gen_copy_bit_i32(cpu_sr, 0, val, 31); /* SR_T */ tcg_temp_free(val); } return; case 0x3004: /* div1 Rm,Rn */ gen_helper_div1(REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300d: /* dmuls.l Rm,Rn */ { TCGv_i64 tmp1 = tcg_temp_new_i64(); TCGv_i64 tmp2 = tcg_temp_new_i64(); tcg_gen_ext_i32_i64(tmp1, REG(B7_4)); tcg_gen_ext_i32_i64(tmp2, REG(B11_8)); tcg_gen_mul_i64(tmp1, tmp1, tmp2); tcg_gen_trunc_i64_i32(cpu_macl, tmp1); tcg_gen_shri_i64(tmp1, tmp1, 32); tcg_gen_trunc_i64_i32(cpu_mach, tmp1); tcg_temp_free_i64(tmp2); tcg_temp_free_i64(tmp1); } return; case 0x3005: /* dmulu.l Rm,Rn */ { TCGv_i64 tmp1 = tcg_temp_new_i64(); TCGv_i64 tmp2 = tcg_temp_new_i64(); tcg_gen_extu_i32_i64(tmp1, REG(B7_4)); tcg_gen_extu_i32_i64(tmp2, REG(B11_8)); tcg_gen_mul_i64(tmp1, tmp1, tmp2); tcg_gen_trunc_i64_i32(cpu_macl, tmp1); tcg_gen_shri_i64(tmp1, tmp1, 32); tcg_gen_trunc_i64_i32(cpu_mach, tmp1); tcg_temp_free_i64(tmp2); tcg_temp_free_i64(tmp1); } return; case 0x600e: /* exts.b Rm,Rn */ tcg_gen_ext8s_i32(REG(B11_8), REG(B7_4)); return; case 0x600f: /* exts.w Rm,Rn */ tcg_gen_ext16s_i32(REG(B11_8), REG(B7_4)); return; case 0x600c: /* extu.b Rm,Rn */ tcg_gen_ext8u_i32(REG(B11_8), REG(B7_4)); return; case 0x600d: /* extu.w Rm,Rn */ tcg_gen_ext16u_i32(REG(B11_8), REG(B7_4)); return; case 0x000f: /* mac.l @Rm+,@Rn+ */ { TCGv arg0, arg1; arg0 = tcg_temp_new(); tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx); arg1 = tcg_temp_new(); tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx); gen_helper_macl(arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x400f: /* mac.w @Rm+,@Rn+ */ { TCGv arg0, arg1; arg0 = tcg_temp_new(); tcg_gen_qemu_ld32s(arg0, REG(B7_4), ctx->memidx); arg1 = tcg_temp_new(); tcg_gen_qemu_ld32s(arg1, REG(B11_8), ctx->memidx); gen_helper_macw(arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 2); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 2); } return; case 0x0007: /* mul.l Rm,Rn */ tcg_gen_mul_i32(cpu_macl, REG(B7_4), REG(B11_8)); return; case 0x200f: /* muls.w Rm,Rn */ { TCGv arg0, arg1; arg0 = tcg_temp_new(); tcg_gen_ext16s_i32(arg0, REG(B7_4)); arg1 = tcg_temp_new(); tcg_gen_ext16s_i32(arg1, REG(B11_8)); tcg_gen_mul_i32(cpu_macl, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); } return; case 0x200e: /* mulu.w Rm,Rn */ { TCGv arg0, arg1; arg0 = tcg_temp_new(); tcg_gen_ext16u_i32(arg0, REG(B7_4)); arg1 = tcg_temp_new(); tcg_gen_ext16u_i32(arg1, REG(B11_8)); tcg_gen_mul_i32(cpu_macl, arg0, arg1); tcg_temp_free(arg1); tcg_temp_free(arg0); } return; case 0x600b: /* neg Rm,Rn */ tcg_gen_neg_i32(REG(B11_8), REG(B7_4)); return; case 0x600a: /* negc Rm,Rn */ gen_helper_negc(REG(B11_8), REG(B7_4)); return; case 0x6007: /* not Rm,Rn */ tcg_gen_not_i32(REG(B11_8), REG(B7_4)); return; case 0x200b: /* or Rm,Rn */ tcg_gen_or_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x400c: /* shad Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); int label3 = gen_new_label(); int label4 = gen_new_label(); TCGv shift = tcg_temp_local_new(); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B7_4), 0, label1); /* Rm positive, shift to the left */ tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_shl_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label4); /* Rm negative, shift to the right */ gen_set_label(label1); tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_brcondi_i32(TCG_COND_EQ, shift, 0, label2); tcg_gen_not_i32(shift, REG(B7_4)); tcg_gen_andi_i32(shift, shift, 0x1f); tcg_gen_addi_i32(shift, shift, 1); tcg_gen_sar_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label4); /* Rm = -32 */ gen_set_label(label2); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B11_8), 0, label3); tcg_gen_movi_i32(REG(B11_8), 0); tcg_gen_br(label4); gen_set_label(label3); tcg_gen_movi_i32(REG(B11_8), 0xffffffff); gen_set_label(label4); tcg_temp_free(shift); } return; case 0x400d: /* shld Rm,Rn */ { int label1 = gen_new_label(); int label2 = gen_new_label(); int label3 = gen_new_label(); TCGv shift = tcg_temp_local_new(); tcg_gen_brcondi_i32(TCG_COND_LT, REG(B7_4), 0, label1); /* Rm positive, shift to the left */ tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_shl_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label3); /* Rm negative, shift to the right */ gen_set_label(label1); tcg_gen_andi_i32(shift, REG(B7_4), 0x1f); tcg_gen_brcondi_i32(TCG_COND_EQ, shift, 0, label2); tcg_gen_not_i32(shift, REG(B7_4)); tcg_gen_andi_i32(shift, shift, 0x1f); tcg_gen_addi_i32(shift, shift, 1); tcg_gen_shr_i32(REG(B11_8), REG(B11_8), shift); tcg_gen_br(label3); /* Rm = -32 */ gen_set_label(label2); tcg_gen_movi_i32(REG(B11_8), 0); gen_set_label(label3); tcg_temp_free(shift); } return; case 0x3008: /* sub Rm,Rn */ tcg_gen_sub_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0x300a: /* subc Rm,Rn */ gen_helper_subc(REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x300b: /* subv Rm,Rn */ gen_helper_subv(REG(B11_8), REG(B7_4), REG(B11_8)); return; case 0x2008: /* tst Rm,Rn */ { TCGv val = tcg_temp_new(); tcg_gen_and_i32(val, REG(B7_4), REG(B11_8)); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0x200a: /* xor Rm,Rn */ tcg_gen_xor_i32(REG(B11_8), REG(B11_8), REG(B7_4)); return; case 0xf00c: /* fmov {F,D,X}Rm,{F,D,X}Rn - FPSCR: Nothing */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_SZ) { TCGv_i64 fp = tcg_temp_new_i64(); gen_load_fpr64(fp, XREG(B7_4)); gen_store_fpr64(fp, XREG(B11_8)); tcg_temp_free_i64(fp); } else { tcg_gen_mov_i32(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); } return; case 0xf00a: /* fmov {F,D,X}Rm,@Rn - FPSCR: Nothing */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_SZ) { TCGv addr_hi = tcg_temp_new(); int fr = XREG(B7_4); tcg_gen_addi_i32(addr_hi, REG(B11_8), 4); tcg_gen_qemu_st32(cpu_fregs[fr ], REG(B11_8), ctx->memidx); tcg_gen_qemu_st32(cpu_fregs[fr+1], addr_hi, ctx->memidx); tcg_temp_free(addr_hi); } else { tcg_gen_qemu_st32(cpu_fregs[FREG(B7_4)], REG(B11_8), ctx->memidx); } return; case 0xf008: /* fmov @Rm,{F,D,X}Rn - FPSCR: Nothing */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_SZ) { TCGv addr_hi = tcg_temp_new(); int fr = XREG(B11_8); tcg_gen_addi_i32(addr_hi, REG(B7_4), 4); tcg_gen_qemu_ld32u(cpu_fregs[fr ], REG(B7_4), ctx->memidx); tcg_gen_qemu_ld32u(cpu_fregs[fr+1], addr_hi, ctx->memidx); tcg_temp_free(addr_hi); } else { tcg_gen_qemu_ld32u(cpu_fregs[FREG(B11_8)], REG(B7_4), ctx->memidx); } return; case 0xf009: /* fmov @Rm+,{F,D,X}Rn - FPSCR: Nothing */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_SZ) { TCGv addr_hi = tcg_temp_new(); int fr = XREG(B11_8); tcg_gen_addi_i32(addr_hi, REG(B7_4), 4); tcg_gen_qemu_ld32u(cpu_fregs[fr ], REG(B7_4), ctx->memidx); tcg_gen_qemu_ld32u(cpu_fregs[fr+1], addr_hi, ctx->memidx); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 8); tcg_temp_free(addr_hi); } else { tcg_gen_qemu_ld32u(cpu_fregs[FREG(B11_8)], REG(B7_4), ctx->memidx); tcg_gen_addi_i32(REG(B7_4), REG(B7_4), 4); } return; case 0xf00b: /* fmov {F,D,X}Rm,@-Rn - FPSCR: Nothing */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_SZ) { TCGv addr = tcg_temp_new_i32(); int fr = XREG(B7_4); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(cpu_fregs[fr+1], addr, ctx->memidx); tcg_gen_subi_i32(addr, REG(B11_8), 8); tcg_gen_qemu_st32(cpu_fregs[fr ], addr, ctx->memidx); tcg_gen_mov_i32(REG(B11_8), addr); tcg_temp_free(addr); } else { TCGv addr; addr = tcg_temp_new_i32(); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(cpu_fregs[FREG(B7_4)], addr, ctx->memidx); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0xf006: /* fmov @(R0,Rm),{F,D,X}Rm - FPSCR: Nothing */ CHECK_FPU_ENABLED { TCGv addr = tcg_temp_new_i32(); tcg_gen_add_i32(addr, REG(B7_4), REG(0)); if (ctx->fpscr & FPSCR_SZ) { int fr = XREG(B11_8); tcg_gen_qemu_ld32u(cpu_fregs[fr ], addr, ctx->memidx); tcg_gen_addi_i32(addr, addr, 4); tcg_gen_qemu_ld32u(cpu_fregs[fr+1], addr, ctx->memidx); } else { tcg_gen_qemu_ld32u(cpu_fregs[FREG(B11_8)], addr, ctx->memidx); } tcg_temp_free(addr); } return; case 0xf007: /* fmov {F,D,X}Rn,@(R0,Rn) - FPSCR: Nothing */ CHECK_FPU_ENABLED { TCGv addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(B11_8), REG(0)); if (ctx->fpscr & FPSCR_SZ) { int fr = XREG(B7_4); tcg_gen_qemu_ld32u(cpu_fregs[fr ], addr, ctx->memidx); tcg_gen_addi_i32(addr, addr, 4); tcg_gen_qemu_ld32u(cpu_fregs[fr+1], addr, ctx->memidx); } else { tcg_gen_qemu_st32(cpu_fregs[FREG(B7_4)], addr, ctx->memidx); } tcg_temp_free(addr); } return; case 0xf000: /* fadd Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf001: /* fsub Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf002: /* fmul Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf003: /* fdiv Rm,Rn - FPSCR: R[PR,Enable.O/U/I]/W[Cause,Flag] */ case 0xf004: /* fcmp/eq Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ case 0xf005: /* fcmp/gt Rm,Rn - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ { CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { TCGv_i64 fp0, fp1; if (ctx->opcode & 0x0110) break; /* illegal instruction */ fp0 = tcg_temp_new_i64(); fp1 = tcg_temp_new_i64(); gen_load_fpr64(fp0, DREG(B11_8)); gen_load_fpr64(fp1, DREG(B7_4)); switch (ctx->opcode & 0xf00f) { case 0xf000: /* fadd Rm,Rn */ gen_helper_fadd_DT(fp0, fp0, fp1); break; case 0xf001: /* fsub Rm,Rn */ gen_helper_fsub_DT(fp0, fp0, fp1); break; case 0xf002: /* fmul Rm,Rn */ gen_helper_fmul_DT(fp0, fp0, fp1); break; case 0xf003: /* fdiv Rm,Rn */ gen_helper_fdiv_DT(fp0, fp0, fp1); break; case 0xf004: /* fcmp/eq Rm,Rn */ gen_helper_fcmp_eq_DT(fp0, fp1); return; case 0xf005: /* fcmp/gt Rm,Rn */ gen_helper_fcmp_gt_DT(fp0, fp1); return; } gen_store_fpr64(fp0, DREG(B11_8)); tcg_temp_free_i64(fp0); tcg_temp_free_i64(fp1); } else { switch (ctx->opcode & 0xf00f) { case 0xf000: /* fadd Rm,Rn */ gen_helper_fadd_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); break; case 0xf001: /* fsub Rm,Rn */ gen_helper_fsub_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); break; case 0xf002: /* fmul Rm,Rn */ gen_helper_fmul_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); break; case 0xf003: /* fdiv Rm,Rn */ gen_helper_fdiv_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); break; case 0xf004: /* fcmp/eq Rm,Rn */ gen_helper_fcmp_eq_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); return; case 0xf005: /* fcmp/gt Rm,Rn */ gen_helper_fcmp_gt_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B7_4)]); return; } } } return; case 0xf00e: /* fmac FR0,RM,Rn */ { CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { break; /* illegal instruction */ } else { gen_helper_fmac_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(0)], cpu_fregs[FREG(B7_4)], cpu_fregs[FREG(B11_8)]); return; } } } switch (ctx->opcode & 0xff00) { case 0xc900: /* and #imm,R0 */ tcg_gen_andi_i32(REG(0), REG(0), B7_0); return; case 0xcd00: /* and.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_andi_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0x8b00: /* bf label */ CHECK_NOT_DELAY_SLOT gen_conditional_jump(ctx, ctx->pc + 2, ctx->pc + 4 + B7_0s * 2); ctx->bstate = BS_BRANCH; return; case 0x8f00: /* bf/s label */ CHECK_NOT_DELAY_SLOT gen_branch_slot(ctx->delayed_pc = ctx->pc + 4 + B7_0s * 2, 0); ctx->flags |= DELAY_SLOT_CONDITIONAL; return; case 0x8900: /* bt label */ CHECK_NOT_DELAY_SLOT gen_conditional_jump(ctx, ctx->pc + 4 + B7_0s * 2, ctx->pc + 2); ctx->bstate = BS_BRANCH; return; case 0x8d00: /* bt/s label */ CHECK_NOT_DELAY_SLOT gen_branch_slot(ctx->delayed_pc = ctx->pc + 4 + B7_0s * 2, 1); ctx->flags |= DELAY_SLOT_CONDITIONAL; return; case 0x8800: /* cmp/eq #imm,R0 */ gen_cmp_imm(TCG_COND_EQ, REG(0), B7_0s); return; case 0xc400: /* mov.b @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0); tcg_gen_qemu_ld8s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc500: /* mov.w @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 2); tcg_gen_qemu_ld16s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc600: /* mov.l @(disp,GBR),R0 */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 4); tcg_gen_qemu_ld32s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc000: /* mov.b R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0); tcg_gen_qemu_st8(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc100: /* mov.w R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 2); tcg_gen_qemu_st16(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc200: /* mov.l R0,@(disp,GBR) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, cpu_gbr, B7_0 * 4); tcg_gen_qemu_st32(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8000: /* mov.b R0,@(disp,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B7_4), B3_0); tcg_gen_qemu_st8(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8100: /* mov.w R0,@(disp,Rn) */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 2); tcg_gen_qemu_st16(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8400: /* mov.b @(disp,Rn),R0 */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B7_4), B3_0); tcg_gen_qemu_ld8s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0x8500: /* mov.w @(disp,Rn),R0 */ { TCGv addr = tcg_temp_new(); tcg_gen_addi_i32(addr, REG(B7_4), B3_0 * 2); tcg_gen_qemu_ld16s(REG(0), addr, ctx->memidx); tcg_temp_free(addr); } return; case 0xc700: /* mova @(disp,PC),R0 */ tcg_gen_movi_i32(REG(0), ((ctx->pc & 0xfffffffc) + 4 + B7_0 * 4) & ~3); return; case 0xcb00: /* or #imm,R0 */ tcg_gen_ori_i32(REG(0), REG(0), B7_0); return; case 0xcf00: /* or.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_ori_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0xc300: /* trapa #imm */ { TCGv imm; CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pc, ctx->pc); imm = tcg_const_i32(B7_0); gen_helper_trapa(imm); tcg_temp_free(imm); ctx->bstate = BS_BRANCH; } return; case 0xc800: /* tst #imm,R0 */ { TCGv val = tcg_temp_new(); tcg_gen_andi_i32(val, REG(0), B7_0); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0xcc00: /* tst.b #imm,@(R0,GBR) */ { TCGv val = tcg_temp_new(); tcg_gen_add_i32(val, REG(0), cpu_gbr); tcg_gen_qemu_ld8u(val, val, ctx->memidx); tcg_gen_andi_i32(val, val, B7_0); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_temp_free(val); } return; case 0xca00: /* xor #imm,R0 */ tcg_gen_xori_i32(REG(0), REG(0), B7_0); return; case 0xce00: /* xor.b #imm,@(R0,GBR) */ { TCGv addr, val; addr = tcg_temp_new(); tcg_gen_add_i32(addr, REG(0), cpu_gbr); val = tcg_temp_new(); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); tcg_gen_xori_i32(val, val, B7_0); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; } switch (ctx->opcode & 0xf08f) { case 0x408e: /* ldc Rm,Rn_BANK */ CHECK_PRIVILEGED tcg_gen_mov_i32(ALTREG(B6_4), REG(B11_8)); return; case 0x4087: /* ldc.l @Rm+,Rn_BANK */ CHECK_PRIVILEGED tcg_gen_qemu_ld32s(ALTREG(B6_4), REG(B11_8), ctx->memidx); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); return; case 0x0082: /* stc Rm_BANK,Rn */ CHECK_PRIVILEGED tcg_gen_mov_i32(REG(B11_8), ALTREG(B6_4)); return; case 0x4083: /* stc.l Rm_BANK,@-Rn */ CHECK_PRIVILEGED { TCGv addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(ALTREG(B6_4), addr, ctx->memidx); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; } switch (ctx->opcode & 0xf0ff) { case 0x0023: /* braf Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_addi_i32(cpu_delayed_pc, REG(B11_8), ctx->pc + 4); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x0003: /* bsrf Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); tcg_gen_add_i32(cpu_delayed_pc, REG(B11_8), cpu_pr); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x4015: /* cmp/pl Rn */ gen_cmp_imm(TCG_COND_GT, REG(B11_8), 0); return; case 0x4011: /* cmp/pz Rn */ gen_cmp_imm(TCG_COND_GE, REG(B11_8), 0); return; case 0x4010: /* dt Rn */ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 1); gen_cmp_imm(TCG_COND_EQ, REG(B11_8), 0); return; case 0x402b: /* jmp @Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8)); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x400b: /* jsr @Rn */ CHECK_NOT_DELAY_SLOT tcg_gen_movi_i32(cpu_pr, ctx->pc + 4); tcg_gen_mov_i32(cpu_delayed_pc, REG(B11_8)); ctx->flags |= DELAY_SLOT; ctx->delayed_pc = (uint32_t) - 1; return; case 0x400e: /* ldc Rm,SR */ CHECK_PRIVILEGED tcg_gen_andi_i32(cpu_sr, REG(B11_8), 0x700083f3); ctx->bstate = BS_STOP; return; case 0x4007: /* ldc.l @Rm+,SR */ CHECK_PRIVILEGED { TCGv val = tcg_temp_new(); tcg_gen_qemu_ld32s(val, REG(B11_8), ctx->memidx); tcg_gen_andi_i32(cpu_sr, val, 0x700083f3); tcg_temp_free(val); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); ctx->bstate = BS_STOP; } return; case 0x0002: /* stc SR,Rn */ CHECK_PRIVILEGED tcg_gen_mov_i32(REG(B11_8), cpu_sr); return; case 0x4003: /* stc SR,@-Rn */ CHECK_PRIVILEGED { TCGv addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(cpu_sr, addr, ctx->memidx); tcg_temp_free(addr); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; #define LDST(reg,ldnum,ldpnum,stnum,stpnum,prechk) \ case ldnum: \ prechk \ tcg_gen_mov_i32 (cpu_##reg, REG(B11_8)); \ return; \ case ldpnum: \ prechk \ tcg_gen_qemu_ld32s (cpu_##reg, REG(B11_8), ctx->memidx); \ tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); \ return; \ case stnum: \ prechk \ tcg_gen_mov_i32 (REG(B11_8), cpu_##reg); \ return; \ case stpnum: \ prechk \ { \ TCGv addr = tcg_temp_new(); \ tcg_gen_subi_i32(addr, REG(B11_8), 4); \ tcg_gen_qemu_st32 (cpu_##reg, addr, ctx->memidx); \ tcg_temp_free(addr); \ tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); \ } \ return; LDST(gbr, 0x401e, 0x4017, 0x0012, 0x4013, {}) LDST(vbr, 0x402e, 0x4027, 0x0022, 0x4023, CHECK_PRIVILEGED) LDST(ssr, 0x403e, 0x4037, 0x0032, 0x4033, CHECK_PRIVILEGED) LDST(spc, 0x404e, 0x4047, 0x0042, 0x4043, CHECK_PRIVILEGED) LDST(dbr, 0x40fa, 0x40f6, 0x00fa, 0x40f2, CHECK_PRIVILEGED) LDST(mach, 0x400a, 0x4006, 0x000a, 0x4002, {}) LDST(macl, 0x401a, 0x4016, 0x001a, 0x4012, {}) LDST(pr, 0x402a, 0x4026, 0x002a, 0x4022, {}) LDST(fpul, 0x405a, 0x4056, 0x005a, 0x4052, {CHECK_FPU_ENABLED}) case 0x406a: /* lds Rm,FPSCR */ CHECK_FPU_ENABLED gen_helper_ld_fpscr(REG(B11_8)); ctx->bstate = BS_STOP; return; case 0x4066: /* lds.l @Rm+,FPSCR */ CHECK_FPU_ENABLED { TCGv addr = tcg_temp_new(); tcg_gen_qemu_ld32s(addr, REG(B11_8), ctx->memidx); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); gen_helper_ld_fpscr(addr); tcg_temp_free(addr); ctx->bstate = BS_STOP; } return; case 0x006a: /* sts FPSCR,Rn */ CHECK_FPU_ENABLED tcg_gen_andi_i32(REG(B11_8), cpu_fpscr, 0x003fffff); return; case 0x4062: /* sts FPSCR,@-Rn */ CHECK_FPU_ENABLED { TCGv addr, val; val = tcg_temp_new(); tcg_gen_andi_i32(val, cpu_fpscr, 0x003fffff); addr = tcg_temp_new(); tcg_gen_subi_i32(addr, REG(B11_8), 4); tcg_gen_qemu_st32(val, addr, ctx->memidx); tcg_temp_free(addr); tcg_temp_free(val); tcg_gen_subi_i32(REG(B11_8), REG(B11_8), 4); } return; case 0x00c3: /* movca.l R0,@Rm */ tcg_gen_qemu_st32(REG(0), REG(B11_8), ctx->memidx); return; case 0x40a9: /* MOVUA.L @Rm,R0 (Rm) -> R0 Load non-boundary-aligned data */ tcg_gen_qemu_ld32u(REG(0), REG(B11_8), ctx->memidx); return; case 0x40e9: /* MOVUA.L @Rm+,R0 (Rm) -> R0, Rm + 4 -> Rm Load non-boundary-aligned data */ tcg_gen_qemu_ld32u(REG(0), REG(B11_8), ctx->memidx); tcg_gen_addi_i32(REG(B11_8), REG(B11_8), 4); return; case 0x0029: /* movt Rn */ tcg_gen_andi_i32(REG(B11_8), cpu_sr, SR_T); return; case 0x0073: /* MOVCO.L LDST -> T If (T == 1) R0 -> (Rn) 0 -> LDST */ if (ctx->features & SH_FEATURE_SH4A) { int label = gen_new_label(); gen_clr_t(); tcg_gen_or_i32(cpu_sr, cpu_sr, cpu_ldst); tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_ldst, 0, label); tcg_gen_qemu_st32(REG(0), REG(B11_8), ctx->memidx); gen_set_label(label); tcg_gen_movi_i32(cpu_ldst, 0); return; } else break; case 0x0063: /* MOVLI.L @Rm,R0 1 -> LDST (Rm) -> R0 When interrupt/exception occurred 0 -> LDST */ if (ctx->features & SH_FEATURE_SH4A) { tcg_gen_movi_i32(cpu_ldst, 0); tcg_gen_qemu_ld32s(REG(0), REG(B11_8), ctx->memidx); tcg_gen_movi_i32(cpu_ldst, 1); return; } else break; case 0x0093: /* ocbi @Rn */ { TCGv dummy = tcg_temp_new(); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x00a3: /* ocbp @Rn */ { TCGv dummy = tcg_temp_new(); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x00b3: /* ocbwb @Rn */ { TCGv dummy = tcg_temp_new(); tcg_gen_qemu_ld32s(dummy, REG(B11_8), ctx->memidx); tcg_temp_free(dummy); } return; case 0x0083: /* pref @Rn */ return; case 0x00d3: /* prefi @Rn */ if (ctx->features & SH_FEATURE_SH4A) return; else break; case 0x00e3: /* icbi @Rn */ if (ctx->features & SH_FEATURE_SH4A) return; else break; case 0x00ab: /* synco */ if (ctx->features & SH_FEATURE_SH4A) return; else break; case 0x4024: /* rotcl Rn */ { TCGv tmp = tcg_temp_new(); tcg_gen_mov_i32(tmp, cpu_sr); gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 0, tmp, 0); tcg_temp_free(tmp); } return; case 0x4025: /* rotcr Rn */ { TCGv tmp = tcg_temp_new(); tcg_gen_mov_i32(tmp, cpu_sr); gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 31, tmp, 0); tcg_temp_free(tmp); } return; case 0x4004: /* rotl Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 0, cpu_sr, 0); return; case 0x4005: /* rotr Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); gen_copy_bit_i32(REG(B11_8), 31, cpu_sr, 0); return; case 0x4000: /* shll Rn */ case 0x4020: /* shal Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 31); tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4021: /* shar Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_sari_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4001: /* shlr Rn */ gen_copy_bit_i32(cpu_sr, 0, REG(B11_8), 0); tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 1); return; case 0x4008: /* shll2 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 2); return; case 0x4018: /* shll8 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 8); return; case 0x4028: /* shll16 Rn */ tcg_gen_shli_i32(REG(B11_8), REG(B11_8), 16); return; case 0x4009: /* shlr2 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 2); return; case 0x4019: /* shlr8 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 8); return; case 0x4029: /* shlr16 Rn */ tcg_gen_shri_i32(REG(B11_8), REG(B11_8), 16); return; case 0x401b: /* tas.b @Rn */ { TCGv addr, val; addr = tcg_temp_local_new(); tcg_gen_mov_i32(addr, REG(B11_8)); val = tcg_temp_local_new(); tcg_gen_qemu_ld8u(val, addr, ctx->memidx); gen_cmp_imm(TCG_COND_EQ, val, 0); tcg_gen_ori_i32(val, val, 0x80); tcg_gen_qemu_st8(val, addr, ctx->memidx); tcg_temp_free(val); tcg_temp_free(addr); } return; case 0xf00d: /* fsts FPUL,FRn - FPSCR: Nothing */ CHECK_FPU_ENABLED tcg_gen_mov_i32(cpu_fregs[FREG(B11_8)], cpu_fpul); return; case 0xf01d: /* flds FRm,FPUL - FPSCR: Nothing */ CHECK_FPU_ENABLED tcg_gen_mov_i32(cpu_fpul, cpu_fregs[FREG(B11_8)]); return; case 0xf02d: /* float FPUL,FRn/DRn - FPSCR: R[PR,Enable.I]/W[Cause,Flag] */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { TCGv_i64 fp; if (ctx->opcode & 0x0100) break; /* illegal instruction */ fp = tcg_temp_new_i64(); gen_helper_float_DT(fp, cpu_fpul); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free_i64(fp); } else { gen_helper_float_FT(cpu_fregs[FREG(B11_8)], cpu_fpul); } return; case 0xf03d: /* ftrc FRm/DRm,FPUL - FPSCR: R[PR,Enable.V]/W[Cause,Flag] */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { TCGv_i64 fp; if (ctx->opcode & 0x0100) break; /* illegal instruction */ fp = tcg_temp_new_i64(); gen_load_fpr64(fp, DREG(B11_8)); gen_helper_ftrc_DT(cpu_fpul, fp); tcg_temp_free_i64(fp); } else { gen_helper_ftrc_FT(cpu_fpul, cpu_fregs[FREG(B11_8)]); } return; case 0xf04d: /* fneg FRn/DRn - FPSCR: Nothing */ CHECK_FPU_ENABLED { gen_helper_fneg_T(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)]); } return; case 0xf05d: /* fabs FRn/DRn */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { if (ctx->opcode & 0x0100) break; /* illegal instruction */ TCGv_i64 fp = tcg_temp_new_i64(); gen_load_fpr64(fp, DREG(B11_8)); gen_helper_fabs_DT(fp, fp); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free_i64(fp); } else { gen_helper_fabs_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)]); } return; case 0xf06d: /* fsqrt FRn */ CHECK_FPU_ENABLED if (ctx->fpscr & FPSCR_PR) { if (ctx->opcode & 0x0100) break; /* illegal instruction */ TCGv_i64 fp = tcg_temp_new_i64(); gen_load_fpr64(fp, DREG(B11_8)); gen_helper_fsqrt_DT(fp, fp); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free_i64(fp); } else { gen_helper_fsqrt_FT(cpu_fregs[FREG(B11_8)], cpu_fregs[FREG(B11_8)]); } return; case 0xf07d: /* fsrra FRn */ CHECK_FPU_ENABLED break; case 0xf08d: /* fldi0 FRn - FPSCR: R[PR] */ CHECK_FPU_ENABLED if (!(ctx->fpscr & FPSCR_PR)) { tcg_gen_movi_i32(cpu_fregs[FREG(B11_8)], 0); } return; case 0xf09d: /* fldi1 FRn - FPSCR: R[PR] */ CHECK_FPU_ENABLED if (!(ctx->fpscr & FPSCR_PR)) { tcg_gen_movi_i32(cpu_fregs[FREG(B11_8)], 0x3f800000); } return; case 0xf0ad: /* fcnvsd FPUL,DRn */ CHECK_FPU_ENABLED { TCGv_i64 fp = tcg_temp_new_i64(); gen_helper_fcnvsd_FT_DT(fp, cpu_fpul); gen_store_fpr64(fp, DREG(B11_8)); tcg_temp_free_i64(fp); } return; case 0xf0bd: /* fcnvds DRn,FPUL */ CHECK_FPU_ENABLED { TCGv_i64 fp = tcg_temp_new_i64(); gen_load_fpr64(fp, DREG(B11_8)); gen_helper_fcnvds_DT_FT(cpu_fpul, fp); tcg_temp_free_i64(fp); } return; } #if 0 fprintf(stderr, ""unknown instruction 0x%04x at pc 0x%08x\n"", ctx->opcode, ctx->pc); fflush(stderr); #endif gen_helper_raise_illegal_instruction(); ctx->bstate = BS_EXCP; }","No, it is non-vulnerable."972970,"static void *spapr_create_fdt_skel(const char *cpu_model, target_phys_addr_t initrd_base, target_phys_addr_t initrd_size, const char *boot_device, const char *kernel_cmdline, long hash_shift) { void *fdt; CPUState *env; uint64_t mem_reg_property[] = { 0, cpu_to_be64(ram_size) }; uint32_t start_prop = cpu_to_be32(initrd_base); uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size); uint32_t pft_size_prop[] = {0, cpu_to_be32(hash_shift)}; char hypertas_prop[] = ""hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt"" ""\0hcall-tce\0hcall-vio\0hcall-splpar""; uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)}; int i; char *modelname; #define _FDT(exp) \ do { \ int ret = (exp); \ if (ret < 0) { \ fprintf(stderr, ""qemu: error creating device tree: %s: %s\n"", \ #exp, fdt_strerror(ret)); \ exit(1); \ } \ } while (0) fdt = g_malloc0(FDT_MAX_SIZE); _FDT((fdt_create(fdt, FDT_MAX_SIZE))); _FDT((fdt_finish_reservemap(fdt))); /* Root node */ _FDT((fdt_begin_node(fdt, """"))); _FDT((fdt_property_string(fdt, ""device_type"", ""chrp""))); _FDT((fdt_property_string(fdt, ""model"", ""IBM pSeries (emulated by qemu)""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x2))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x2))); /* /chosen */ _FDT((fdt_begin_node(fdt, ""chosen""))); _FDT((fdt_property_string(fdt, ""bootargs"", kernel_cmdline))); _FDT((fdt_property(fdt, ""linux,initrd-start"", &start_prop, sizeof(start_prop)))); _FDT((fdt_property(fdt, ""linux,initrd-end"", &end_prop, sizeof(end_prop)))); _FDT((fdt_property_string(fdt, ""qemu,boot-device"", boot_device))); _FDT((fdt_end_node(fdt))); /* memory node */ _FDT((fdt_begin_node(fdt, ""memory@0""))); _FDT((fdt_property_string(fdt, ""device_type"", ""memory""))); _FDT((fdt_property(fdt, ""reg"", mem_reg_property, sizeof(mem_reg_property)))); _FDT((fdt_end_node(fdt))); /* cpus */ _FDT((fdt_begin_node(fdt, ""cpus""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x1))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x0))); modelname = g_strdup(cpu_model); for (i = 0; i < strlen(modelname); i++) { modelname[i] = toupper(modelname[i]); } for (env = first_cpu; env != NULL; env = env->next_cpu) { int index = env->cpu_index; uint32_t gserver_prop[] = {cpu_to_be32(index), 0}; /* HACK! */ char *nodename; uint32_t segs[] = {cpu_to_be32(28), cpu_to_be32(40), 0xffffffff, 0xffffffff}; uint32_t tbfreq = kvm_enabled() ? kvmppc_get_tbfreq() : TIMEBASE_FREQ; uint32_t cpufreq = kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000; if (asprintf(&nodename, ""%s@%x"", modelname, index) < 0) { fprintf(stderr, ""Allocation failure\n""); exit(1); } _FDT((fdt_begin_node(fdt, nodename))); free(nodename); _FDT((fdt_property_cell(fdt, ""reg"", index))); _FDT((fdt_property_string(fdt, ""device_type"", ""cpu""))); _FDT((fdt_property_cell(fdt, ""cpu-version"", env->spr[SPR_PVR]))); _FDT((fdt_property_cell(fdt, ""dcache-block-size"", env->dcache_line_size))); _FDT((fdt_property_cell(fdt, ""icache-block-size"", env->icache_line_size))); _FDT((fdt_property_cell(fdt, ""timebase-frequency"", tbfreq))); _FDT((fdt_property_cell(fdt, ""clock-frequency"", cpufreq))); _FDT((fdt_property_cell(fdt, ""ibm,slb-size"", env->slb_nr))); _FDT((fdt_property(fdt, ""ibm,pft-size"", pft_size_prop, sizeof(pft_size_prop)))); _FDT((fdt_property_string(fdt, ""status"", ""okay""))); _FDT((fdt_property(fdt, ""64-bit"", NULL, 0))); _FDT((fdt_property_cell(fdt, ""ibm,ppc-interrupt-server#s"", index))); _FDT((fdt_property(fdt, ""ibm,ppc-interrupt-gserver#s"", gserver_prop, sizeof(gserver_prop)))); if (env->mmu_model & POWERPC_MMU_1TSEG) { _FDT((fdt_property(fdt, ""ibm,processor-segment-sizes"", segs, sizeof(segs)))); } _FDT((fdt_end_node(fdt))); } g_free(modelname); _FDT((fdt_end_node(fdt))); /* RTAS */ _FDT((fdt_begin_node(fdt, ""rtas""))); _FDT((fdt_property(fdt, ""ibm,hypertas-functions"", hypertas_prop, sizeof(hypertas_prop)))); _FDT((fdt_end_node(fdt))); /* interrupt controller */ _FDT((fdt_begin_node(fdt, ""interrupt-controller@0""))); _FDT((fdt_property_string(fdt, ""device_type"", ""PowerPC-External-Interrupt-Presentation""))); _FDT((fdt_property_string(fdt, ""compatible"", ""IBM,ppc-xicp""))); _FDT((fdt_property_cell(fdt, ""reg"", 0))); _FDT((fdt_property(fdt, ""interrupt-controller"", NULL, 0))); _FDT((fdt_property(fdt, ""ibm,interrupt-server-ranges"", interrupt_server_ranges_prop, sizeof(interrupt_server_ranges_prop)))); _FDT((fdt_property_cell(fdt, ""#interrupt-cells"", 2))); _FDT((fdt_property_cell(fdt, ""linux,phandle"", PHANDLE_XICP))); _FDT((fdt_property_cell(fdt, ""phandle"", PHANDLE_XICP))); _FDT((fdt_end_node(fdt))); /* vdevice */ _FDT((fdt_begin_node(fdt, ""vdevice""))); _FDT((fdt_property_string(fdt, ""device_type"", ""vdevice""))); _FDT((fdt_property_string(fdt, ""compatible"", ""IBM,vdevice""))); _FDT((fdt_property_cell(fdt, ""#address-cells"", 0x1))); _FDT((fdt_property_cell(fdt, ""#size-cells"", 0x0))); _FDT((fdt_property_cell(fdt, ""#interrupt-cells"", 0x2))); _FDT((fdt_property(fdt, ""interrupt-controller"", NULL, 0))); _FDT((fdt_end_node(fdt))); _FDT((fdt_end_node(fdt))); /* close root node */ _FDT((fdt_finish(fdt))); return fdt; }","No, it is non-vulnerable."973971,"static int decode_extradata_ps(const uint8_t *data, int size, H264ParamSets *ps, int is_avc, void *logctx) { H2645Packet pkt = { 0 }; int i, ret = 0; ret = ff_h2645_packet_split(&pkt, data, size, logctx, is_avc, 2, AV_CODEC_ID_H264); if (ret < 0) { ret = 0; goto fail; } for (i = 0; i < pkt.nb_nals; i++) { H2645NAL *nal = &pkt.nals[i]; switch (nal->type) { case H264_NAL_SPS: ret = ff_h264_decode_seq_parameter_set(&nal->gb, logctx, ps, 0); if (ret < 0) goto fail; break; case H264_NAL_PPS: ret = ff_h264_decode_picture_parameter_set(&nal->gb, logctx, ps, nal->size_bits); if (ret < 0) goto fail; break; default: av_log(logctx, AV_LOG_VERBOSE, ""Ignoring NAL type %d in extradata\n"", nal->type); break; } } fail: ff_h2645_packet_uninit(&pkt); return ret; }","No, it is non-vulnerable."974972,"int qcow2_get_cluster_offset(BlockDriverState *bs, uint64_t offset, unsigned int *bytes, uint64_t *cluster_offset) { BDRVQcow2State *s = bs->opaque; unsigned int l2_index; uint64_t l1_index, l2_offset, *l2_table; int l1_bits, c; unsigned int offset_in_cluster, nb_clusters; uint64_t bytes_available, bytes_needed; int ret; offset_in_cluster = offset_into_cluster(s, offset); bytes_needed = (uint64_t) *bytes + offset_in_cluster; l1_bits = s->l2_bits + s->cluster_bits; /* compute how many bytes there are between the start of the cluster * containing offset and the end of the l1 entry */ bytes_available = (1ULL << l1_bits) - (offset & ((1ULL << l1_bits) - 1)) + offset_in_cluster; if (bytes_needed > bytes_available) { bytes_needed = bytes_available; } assert(bytes_needed <= INT_MAX); *cluster_offset = 0; /* seek to the l2 offset in the l1 table */ l1_index = offset >> l1_bits; if (l1_index >= s->l1_size) { ret = QCOW2_CLUSTER_UNALLOCATED; goto out; } l2_offset = s->l1_table[l1_index] & L1E_OFFSET_MASK; if (!l2_offset) { ret = QCOW2_CLUSTER_UNALLOCATED; goto out; } if (offset_into_cluster(s, l2_offset)) { qcow2_signal_corruption(bs, true, -1, -1, ""L2 table offset %#"" PRIx64 "" unaligned (L1 index: %#"" PRIx64 "")"", l2_offset, l1_index); return -EIO; } /* load the l2 table in memory */ ret = l2_load(bs, l2_offset, &l2_table); if (ret < 0) { return ret; } /* find the cluster offset for the given disk offset */ l2_index = (offset >> s->cluster_bits) & (s->l2_size - 1); *cluster_offset = be64_to_cpu(l2_table[l2_index]); /* nb_needed <= INT_MAX, thus nb_clusters <= INT_MAX, too */ nb_clusters = size_to_clusters(s, bytes_needed); ret = qcow2_get_cluster_type(*cluster_offset); switch (ret) { case QCOW2_CLUSTER_COMPRESSED: /* Compressed clusters can only be processed one by one */ c = 1; *cluster_offset &= L2E_COMPRESSED_OFFSET_SIZE_MASK; break; case QCOW2_CLUSTER_ZERO: if (s->qcow_version < 3) { qcow2_signal_corruption(bs, true, -1, -1, ""Zero cluster entry found"" "" in pre-v3 image (L2 offset: %#"" PRIx64 "", L2 index: %#x)"", l2_offset, l2_index); ret = -EIO; goto fail; } c = count_contiguous_clusters_by_type(nb_clusters, &l2_table[l2_index], QCOW2_CLUSTER_ZERO); *cluster_offset = 0; break; case QCOW2_CLUSTER_UNALLOCATED: /* how many empty clusters ? */ c = count_contiguous_clusters_by_type(nb_clusters, &l2_table[l2_index], QCOW2_CLUSTER_UNALLOCATED); *cluster_offset = 0; break; case QCOW2_CLUSTER_NORMAL: /* how many allocated clusters ? */ c = count_contiguous_clusters(nb_clusters, s->cluster_size, &l2_table[l2_index], QCOW_OFLAG_ZERO); *cluster_offset &= L2E_OFFSET_MASK; if (offset_into_cluster(s, *cluster_offset)) { qcow2_signal_corruption(bs, true, -1, -1, ""Data cluster offset %#"" PRIx64 "" unaligned (L2 offset: %#"" PRIx64 "", L2 index: %#x)"", *cluster_offset, l2_offset, l2_index); ret = -EIO; goto fail; } break; default: abort(); } qcow2_cache_put(bs, s->l2_table_cache, (void**) &l2_table); bytes_available = (c * s->cluster_size); out: if (bytes_available > bytes_needed) { bytes_available = bytes_needed; } *bytes = bytes_available - offset_in_cluster; return ret; fail: qcow2_cache_put(bs, s->l2_table_cache, (void **)&l2_table); return ret; }","Yes, it is vulnerable."975973,"int ff_qsv_decode_init(AVCodecContext *avctx, QSVContext *q, mfxSession session) { mfxVideoParam param = { { 0 } }; int ret; q->async_fifo = av_fifo_alloc((1 + q->async_depth) * (sizeof(mfxSyncPoint) + sizeof(QSVFrame*))); if (!q->async_fifo) return AVERROR(ENOMEM); ret = qsv_init_session(avctx, q, session); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Error initializing an MFX session\n""); return ret; } ret = ff_qsv_codec_id_to_mfx(avctx->codec_id); if (ret < 0) return ret; param.mfx.CodecId = ret; param.mfx.CodecProfile = avctx->profile; param.mfx.CodecLevel = avctx->level; param.mfx.FrameInfo.BitDepthLuma = 8; param.mfx.FrameInfo.BitDepthChroma = 8; param.mfx.FrameInfo.Shift = 0; param.mfx.FrameInfo.FourCC = MFX_FOURCC_NV12; param.mfx.FrameInfo.Width = avctx->coded_width; param.mfx.FrameInfo.Height = avctx->coded_height; param.mfx.FrameInfo.ChromaFormat = MFX_CHROMAFORMAT_YUV420; param.IOPattern = q->iopattern; param.AsyncDepth = q->async_depth; param.ExtParam = q->ext_buffers; param.NumExtParam = q->nb_ext_buffers; ret = MFXVideoDECODE_Init(q->session, &param); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Error initializing the MFX video decoder\n""); return ff_qsv_error(ret); } return 0; }","Yes, it is vulnerable."976974,"static int kvm_init(MachineState *ms) { MachineClass *mc = MACHINE_GET_CLASS(ms); static const char upgrade_note[] = ""Please upgrade to at least kernel 2.6.29 or recent kvm-kmod\n"" ""(see http://sourceforge.net/projects/kvm).\n""; struct { const char *name; int num; } num_cpus[] = { { ""SMP"", smp_cpus }, { ""hotpluggable"", max_cpus }, { NULL, } }, *nc = num_cpus; int soft_vcpus_limit, hard_vcpus_limit; KVMState *s; const KVMCapabilityInfo *missing_cap; int ret; int i, type = 0; const char *kvm_type; s = KVM_STATE(ms->accelerator); /* * On systems where the kernel can support different base page * sizes, host page size may be different from TARGET_PAGE_SIZE, * even with KVM. TARGET_PAGE_SIZE is assumed to be the minimum * page size for the system though. */ assert(TARGET_PAGE_SIZE <= getpagesize()); page_size_init(); s->sigmask_len = 8; #ifdef KVM_CAP_SET_GUEST_DEBUG QTAILQ_INIT(&s->kvm_sw_breakpoints); #endif s->vmfd = -1; s->fd = qemu_open(""/dev/kvm"", O_RDWR); if (s->fd == -1) { fprintf(stderr, ""Could not access KVM kernel module: %m\n""); ret = -errno; goto err; } ret = kvm_ioctl(s, KVM_GET_API_VERSION, 0); if (ret < KVM_API_VERSION) { if (ret >= 0) { ret = -EINVAL; } fprintf(stderr, ""kvm version too old\n""); goto err; } if (ret > KVM_API_VERSION) { ret = -EINVAL; fprintf(stderr, ""kvm version not supported\n""); goto err; } s->nr_slots = kvm_check_extension(s, KVM_CAP_NR_MEMSLOTS); /* If unspecified, use the default value */ if (!s->nr_slots) { s->nr_slots = 32; } s->slots = g_malloc0(s->nr_slots * sizeof(KVMSlot)); for (i = 0; i < s->nr_slots; i++) { s->slots[i].slot = i; } /* check the vcpu limits */ soft_vcpus_limit = kvm_recommended_vcpus(s); hard_vcpus_limit = kvm_max_vcpus(s); while (nc->name) { if (nc->num > soft_vcpus_limit) { fprintf(stderr, ""Warning: Number of %s cpus requested (%d) exceeds "" ""the recommended cpus supported by KVM (%d)\n"", nc->name, nc->num, soft_vcpus_limit); if (nc->num > hard_vcpus_limit) { fprintf(stderr, ""Number of %s cpus requested (%d) exceeds "" ""the maximum cpus supported by KVM (%d)\n"", nc->name, nc->num, hard_vcpus_limit); exit(1); } } nc++; } kvm_type = qemu_opt_get(qemu_get_machine_opts(), ""kvm-type""); if (mc->kvm_type) { type = mc->kvm_type(kvm_type); } else if (kvm_type) { ret = -EINVAL; fprintf(stderr, ""Invalid argument kvm-type=%s\n"", kvm_type); goto err; } do { ret = kvm_ioctl(s, KVM_CREATE_VM, type); } while (ret == -EINTR); if (ret < 0) { fprintf(stderr, ""ioctl(KVM_CREATE_VM) failed: %d %s\n"", -ret, strerror(-ret)); #ifdef TARGET_S390X fprintf(stderr, ""Please add the 'switch_amode' kernel parameter to "" ""your host kernel command line\n""); #endif goto err; } s->vmfd = ret; missing_cap = kvm_check_extension_list(s, kvm_required_capabilites); if (!missing_cap) { missing_cap = kvm_check_extension_list(s, kvm_arch_required_capabilities); } if (missing_cap) { ret = -EINVAL; fprintf(stderr, ""kvm does not support %s\n%s"", missing_cap->name, upgrade_note); goto err; } s->coalesced_mmio = kvm_check_extension(s, KVM_CAP_COALESCED_MMIO); s->broken_set_mem_region = 1; ret = kvm_check_extension(s, KVM_CAP_JOIN_MEMORY_REGIONS_WORKS); if (ret > 0) { s->broken_set_mem_region = 0; } #ifdef KVM_CAP_VCPU_EVENTS s->vcpu_events = kvm_check_extension(s, KVM_CAP_VCPU_EVENTS); #endif s->robust_singlestep = kvm_check_extension(s, KVM_CAP_X86_ROBUST_SINGLESTEP); #ifdef KVM_CAP_DEBUGREGS s->debugregs = kvm_check_extension(s, KVM_CAP_DEBUGREGS); #endif #ifdef KVM_CAP_XSAVE s->xsave = kvm_check_extension(s, KVM_CAP_XSAVE); #endif #ifdef KVM_CAP_XCRS s->xcrs = kvm_check_extension(s, KVM_CAP_XCRS); #endif #ifdef KVM_CAP_PIT_STATE2 s->pit_state2 = kvm_check_extension(s, KVM_CAP_PIT_STATE2); #endif #ifdef KVM_CAP_IRQ_ROUTING s->direct_msi = (kvm_check_extension(s, KVM_CAP_SIGNAL_MSI) > 0); #endif s->intx_set_mask = kvm_check_extension(s, KVM_CAP_PCI_2_3); s->irq_set_ioctl = KVM_IRQ_LINE; if (kvm_check_extension(s, KVM_CAP_IRQ_INJECT_STATUS)) { s->irq_set_ioctl = KVM_IRQ_LINE_STATUS; } #ifdef KVM_CAP_READONLY_MEM kvm_readonly_mem_allowed = (kvm_check_extension(s, KVM_CAP_READONLY_MEM) > 0); #endif kvm_eventfds_allowed = (kvm_check_extension(s, KVM_CAP_IOEVENTFD) > 0); kvm_irqfds_allowed = (kvm_check_extension(s, KVM_CAP_IRQFD) > 0); kvm_resamplefds_allowed = (kvm_check_extension(s, KVM_CAP_IRQFD_RESAMPLE) > 0); ret = kvm_arch_init(s); if (ret < 0) { goto err; } ret = kvm_irqchip_create(s); if (ret < 0) { goto err; } kvm_state = s; memory_listener_register(&kvm_memory_listener, &address_space_memory); memory_listener_register(&kvm_io_listener, &address_space_io); s->many_ioeventfds = kvm_check_many_ioeventfds(); cpu_interrupt_handler = kvm_handle_interrupt; return 0; err: assert(ret < 0); if (s->vmfd >= 0) { close(s->vmfd); } if (s->fd != -1) { close(s->fd); } g_free(s->slots); return ret; }","Yes, it is vulnerable."977975,"int ff_msmpeg4_decode_init(MpegEncContext *s) { static int done = 0; int i; MVTable *mv; common_init(s); if (!done) { done = 1; for(i=0;i<NB_RL_TABLES;i++) { init_rl(&rl_table[i]); init_vlc_rl(&rl_table[i]); } for(i=0;i<2;i++) { mv = &mv_tables[i]; init_vlc(&mv->vlc, MV_VLC_BITS, mv->n + 1, mv->table_mv_bits, 1, 1, mv->table_mv_code, 2, 2); } init_vlc(&dc_lum_vlc[0], DC_VLC_BITS, 120, &table0_dc_lum[0][1], 8, 4, &table0_dc_lum[0][0], 8, 4); init_vlc(&dc_chroma_vlc[0], DC_VLC_BITS, 120, &table0_dc_chroma[0][1], 8, 4, &table0_dc_chroma[0][0], 8, 4); init_vlc(&dc_lum_vlc[1], DC_VLC_BITS, 120, &table1_dc_lum[0][1], 8, 4, &table1_dc_lum[0][0], 8, 4); init_vlc(&dc_chroma_vlc[1], DC_VLC_BITS, 120, &table1_dc_chroma[0][1], 8, 4, &table1_dc_chroma[0][0], 8, 4); init_vlc(&v2_dc_lum_vlc, DC_VLC_BITS, 512, &v2_dc_lum_table[0][1], 8, 4, &v2_dc_lum_table[0][0], 8, 4); init_vlc(&v2_dc_chroma_vlc, DC_VLC_BITS, 512, &v2_dc_chroma_table[0][1], 8, 4, &v2_dc_chroma_table[0][0], 8, 4); init_vlc(&cbpy_vlc, CBPY_VLC_BITS, 16, &cbpy_tab[0][1], 2, 1, &cbpy_tab[0][0], 2, 1); init_vlc(&v2_intra_cbpc_vlc, V2_INTRA_CBPC_VLC_BITS, 4, &v2_intra_cbpc[0][1], 2, 1, &v2_intra_cbpc[0][0], 2, 1); init_vlc(&v2_mb_type_vlc, V2_MB_TYPE_VLC_BITS, 8, &v2_mb_type[0][1], 2, 1, &v2_mb_type[0][0], 2, 1); init_vlc(&v2_mv_vlc, V2_MV_VLC_BITS, 33, &mvtab[0][1], 2, 1, &mvtab[0][0], 2, 1); for(i=0; i<4; i++){ init_vlc(&mb_non_intra_vlc[i], MB_NON_INTRA_VLC_BITS, 128, &wmv2_inter_table[i][0][1], 8, 4, &wmv2_inter_table[i][0][0], 8, 4); //FIXME name? } init_vlc(&mb_intra_vlc, MB_INTRA_VLC_BITS, 64, &table_mb_intra[0][1], 4, 2, &table_mb_intra[0][0], 4, 2); init_vlc(&v1_intra_cbpc_vlc, V1_INTRA_CBPC_VLC_BITS, 8, intra_MCBPC_bits, 1, 1, intra_MCBPC_code, 1, 1); init_vlc(&v1_inter_cbpc_vlc, V1_INTER_CBPC_VLC_BITS, 25, inter_MCBPC_bits, 1, 1, inter_MCBPC_code, 1, 1); init_vlc(&inter_intra_vlc, INTER_INTRA_VLC_BITS, 4, &table_inter_intra[0][1], 2, 1, &table_inter_intra[0][0], 2, 1); } switch(s->msmpeg4_version){ case 1: case 2: s->decode_mb= msmpeg4v12_decode_mb; break; case 3: case 4: s->decode_mb= msmpeg4v34_decode_mb; break; case 5: s->decode_mb= wmv2_decode_mb; break; } s->slice_height= s->mb_height; //to avoid 1/0 if the first frame isnt a keyframe return 0; }","Yes, it is vulnerable."978976,"void block_job_sleep_ns(BlockJob *job, QEMUClockType type, int64_t ns) { assert(job->busy); /* Check cancellation *before* setting busy = false, too! */ if (block_job_is_cancelled(job)) { return; } job->busy = false; if (!block_job_should_pause(job)) { co_aio_sleep_ns(blk_get_aio_context(job->blk), type, ns); } /* The job can be paused while sleeping, so check this again */ if (block_job_should_pause(job)) { qemu_coroutine_yield(); } job->busy = true; }","Yes, it is vulnerable."979977,static void adb_mouse_reset(DeviceState *dev) { ADBDevice *d = ADB_DEVICE(dev); MouseState *s = ADB_MOUSE(dev); d->handler = 2; d->devaddr = ADB_DEVID_MOUSE; s->last_buttons_state = s->buttons_state = 0; s->dx = s->dy = s->dz = 0; },"Yes, it is vulnerable."980978,static void raw_close(BlockDriverState *bs) { BDRVRawState *s = bs->opaque; if (s->fd >= 0) { close(s->fd); s->fd = -1; if (s->aligned_buf != NULL) qemu_free(s->aligned_buf); } },"Yes, it is vulnerable."981979,"static void start_frame_overlay(AVFilterLink *inlink, AVFilterBufferRef *inpicref) { AVFilterContext *ctx = inlink->dst; OverlayContext *over = ctx->priv; inpicref->pts = av_rescale_q(inpicref->pts, ctx->inputs[OVERLAY]->time_base, ctx->outputs[0]->time_base); if (!over->overpicref) over->overpicref = inpicref; else over->overpicref_next = inpicref; }","Yes, it is vulnerable."982980,"START_TEST(simple_dict) { int i; struct { const char *encoded; LiteralQObject decoded; } test_cases[] = { { .encoded = ""{\""foo\"": 42, \""bar\"": \""hello world\""}"", .decoded = QLIT_QDICT(((LiteralQDictEntry[]){ { ""foo"", QLIT_QINT(42) }, { ""bar"", QLIT_QSTR(""hello world"") }, { } })), }, { .encoded = ""{}"", .decoded = QLIT_QDICT(((LiteralQDictEntry[]){ { } })), }, { .encoded = ""{\""foo\"": 43}"", .decoded = QLIT_QDICT(((LiteralQDictEntry[]){ { ""foo"", QLIT_QINT(43) }, { } })), }, { } }; for (i = 0; test_cases[i].encoded; i++) { QObject *obj; QString *str; obj = qobject_from_json(test_cases[i].encoded); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QDICT); fail_unless(compare_litqobj_to_qobj(&test_cases[i].decoded, obj) == 1); str = qobject_to_json(obj); qobject_decref(obj); obj = qobject_from_json(qstring_get_str(str)); fail_unless(obj != NULL); fail_unless(qobject_type(obj) == QTYPE_QDICT); fail_unless(compare_litqobj_to_qobj(&test_cases[i].decoded, obj) == 1); qobject_decref(obj); QDECREF(str); } }","No, it is non-vulnerable."983981,"static void i440fx_pcihost_get_pci_hole64_end(Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { PCIHostState *h = PCI_HOST_BRIDGE(obj); Range w64; pci_bus_get_w64_range(h->bus, &w64); visit_type_uint64(v, name, &w64.end, errp); }","No, it is non-vulnerable."984982,"void ioinst_handle_stsch(S390CPU *cpu, uint64_t reg1, uint32_t ipb) { int cssid, ssid, schid, m; SubchDev *sch; uint64_t addr; int cc; SCHIB schib; CPUS390XState *env = &cpu->env; uint8_t ar; addr = decode_basedisp_s(env, ipb, &ar); if (addr & 3) { program_interrupt(env, PGM_SPECIFICATION, 2); return; } if (ioinst_disassemble_sch_ident(reg1, &m, &cssid, &ssid, &schid)) { /* * As operand exceptions have a lower priority than access exceptions, * we check whether the memory area is writeable (injecting the * access execption if it is not) first. */ if (!s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib))) { program_interrupt(env, PGM_OPERAND, 2); } return; } trace_ioinst_sch_id(""stsch"", cssid, ssid, schid); sch = css_find_subch(m, cssid, ssid, schid); if (sch) { if (css_subch_visible(sch)) { css_do_stsch(sch, &schib); cc = 0; } else { /* Indicate no more subchannels in this css/ss */ cc = 3; } } else { if (css_schid_final(m, cssid, ssid, schid)) { cc = 3; /* No more subchannels in this css/ss */ } else { /* Store an empty schib. */ memset(&schib, 0, sizeof(schib)); cc = 0; } } if (cc != 3) { if (s390_cpu_virt_mem_write(cpu, addr, ar, &schib, sizeof(schib)) != 0) { return; } } else { /* Access exceptions have a higher priority than cc3 */ if (s390_cpu_virt_mem_check_write(cpu, addr, ar, sizeof(schib)) != 0) { return; } } setcc(cpu, cc); }","No, it is non-vulnerable."985983,static void cow_close(BlockDriverState *bs) { },"No, it is non-vulnerable."986984,"static int cllc_decode_frame(AVCodecContext *avctx, void *data, int *got_picture_ptr, AVPacket *avpkt) { CLLCContext *ctx = avctx->priv_data; AVFrame *pic = avctx->coded_frame; uint8_t *src = avpkt->data; uint8_t *swapped_buf_new; uint32_t info_tag, info_offset; GetBitContext gb; int coding_type, ret; if (pic->data[0]) avctx->release_buffer(avctx, pic); pic->reference = 0; /* Make sure our bswap16'd buffer is big enough */ swapped_buf_new = av_fast_realloc(ctx->swapped_buf, &ctx->swapped_buf_size, avpkt->size); if (!swapped_buf_new) { av_log(avctx, AV_LOG_ERROR, ""Could not realloc swapped buffer.\n""); return AVERROR(ENOMEM); } ctx->swapped_buf = swapped_buf_new; /* Skip the INFO header if present */ info_offset = 0; info_tag = AV_RL32(src); if (info_tag == MKTAG('I', 'N', 'F', 'O')) { info_offset = AV_RL32(src + 4); if (info_offset > UINT32_MAX - 8 || info_offset + 8 > avpkt->size) { av_log(avctx, AV_LOG_ERROR, ""Invalid INFO header offset: 0x%08X is too large.\n"", info_offset); return AVERROR_INVALIDDATA; } info_offset += 8; src += info_offset; av_log(avctx, AV_LOG_DEBUG, ""Skipping INFO chunk.\n""); } /* bswap16 the buffer since CLLC's bitreader works in 16-bit words */ ctx->dsp.bswap16_buf((uint16_t *) ctx->swapped_buf, (uint16_t *) src, (avpkt->size - info_offset) / 2); init_get_bits(&gb, ctx->swapped_buf, (avpkt->size - info_offset) * 8); /* * Read in coding type. The types are as follows: * * 0 - YUY2 * 1 - BGR24 (Triples) * 2 - BGR24 (Quads) * 3 - BGRA */ coding_type = (AV_RL32(src) >> 8) & 0xFF; av_log(avctx, AV_LOG_DEBUG, ""Frame coding type: %d\n"", coding_type); switch (coding_type) { case 1: case 2: avctx->pix_fmt = PIX_FMT_RGB24; avctx->bits_per_raw_sample = 8; ret = avctx->get_buffer(avctx, pic); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Could not allocate buffer.\n""); return ret; } ret = decode_rgb24_frame(ctx, &gb, pic); if (ret < 0) return ret; break; case 3: avctx->pix_fmt = PIX_FMT_ARGB; avctx->bits_per_raw_sample = 8; ret = avctx->get_buffer(avctx, pic); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""Could not allocate buffer.\n""); return ret; } ret = decode_argb_frame(ctx, &gb, pic); if (ret < 0) return ret; break; default: av_log(avctx, AV_LOG_ERROR, ""Unknown coding type: %d.\n"", coding_type); return AVERROR_INVALIDDATA; } pic->key_frame = 1; pic->pict_type = AV_PICTURE_TYPE_I; *got_picture_ptr = 1; *(AVFrame *)data = *pic; return avpkt->size; }","Yes, it is vulnerable."987985,"void mips_malta_init (ram_addr_t ram_size, int vga_ram_size, const char *boot_device, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model) { char buf[1024]; unsigned long bios_offset; target_long bios_size; int64_t kernel_entry; PCIBus *pci_bus; CPUState *env; RTCState *rtc_state; fdctrl_t *floppy_controller; MaltaFPGAState *malta_fpga; qemu_irq *i8259; int piix4_devfn; uint8_t *eeprom_buf; i2c_bus *smbus; int i; int index; BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS]; BlockDriverState *fd[MAX_FD]; int fl_idx = 0; int fl_sectors = 0; /* init CPUs */ if (cpu_model == NULL) { #ifdef TARGET_MIPS64 cpu_model = ""20Kc""; #else cpu_model = ""24Kf""; #endif env = cpu_init(cpu_model); if (!env) { fprintf(stderr, ""Unable to find CPU definition\n""); qemu_register_reset(main_cpu_reset, env); /* allocate RAM */ cpu_register_physical_memory(0, ram_size, IO_MEM_RAM); /* Map the bios at two physical locations, as on the real board. */ bios_offset = ram_size + vga_ram_size; cpu_register_physical_memory(0x1e000000LL, BIOS_SIZE, bios_offset | IO_MEM_ROM); cpu_register_physical_memory(0x1fc00000LL, BIOS_SIZE, bios_offset | IO_MEM_ROM); /* FPGA */ malta_fpga = malta_fpga_init(0x1f000000LL, env->irq[2], serial_hds[2]); /* Load firmware in flash / BIOS unless we boot directly into a kernel. */ if (kernel_filename) { /* Write a small bootloader to the flash location. */ loaderparams.ram_size = ram_size; loaderparams.kernel_filename = kernel_filename; loaderparams.kernel_cmdline = kernel_cmdline; loaderparams.initrd_filename = initrd_filename; kernel_entry = load_kernel(env); env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL)); write_bootloader(env, bios_offset, kernel_entry); } else { index = drive_get_index(IF_PFLASH, 0, fl_idx); if (index != -1) { /* Load firmware from flash. */ bios_size = 0x400000; fl_sectors = bios_size >> 16; #ifdef DEBUG_BOARD_INIT printf(""Register parallel flash %d size "" TARGET_FMT_lx "" at "" ""offset %08lx addr %08llx '%s' %x\n"", fl_idx, bios_size, bios_offset, 0x1e000000LL, bdrv_get_device_name(drives_table[index].bdrv), fl_sectors); #endif pflash_cfi01_register(0x1e000000LL, bios_offset, drives_table[index].bdrv, 65536, fl_sectors, 4, 0x0000, 0x0000, 0x0000, 0x0000); fl_idx++; } else { /* Load a BIOS image. */ if (bios_name == NULL) bios_name = BIOS_FILENAME; snprintf(buf, sizeof(buf), ""%s/%s"", bios_dir, bios_name); bios_size = load_image(buf, phys_ram_base + bios_offset); if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) { ""qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n"", buf); /* In little endian mode the 32bit words in the bios are swapped, a neat trick which allows bi-endian firmware. */ #ifndef TARGET_WORDS_BIGENDIAN { uint32_t *addr; for (addr = (uint32_t *)(phys_ram_base + bios_offset); addr < (uint32_t *)(phys_ram_base + bios_offset + bios_size); addr++) { *addr = bswap32(*addr); #endif /* Board ID = 0x420 (Malta Board with CoreLV) XXX: theoretically 0x1e000010 should map to flash and 0x1fc00010 should map to the board ID. */ stl_raw(phys_ram_base + bios_offset + 0x10, 0x00000420); /* Init internal devices */ cpu_mips_irq_init_cpu(env); cpu_mips_clock_init(env); /* Interrupt controller */ /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */ i8259 = i8259_init(env->irq[2]); /* Northbridge */ pci_bus = pci_gt64120_init(i8259); /* Southbridge */ if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) { fprintf(stderr, ""qemu: too many IDE bus\n""); for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) { index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS); if (index != -1) hd[i] = drives_table[index].bdrv; else hd[i] = NULL; piix4_devfn = piix4_init(pci_bus, 80); pci_piix4_ide_init(pci_bus, hd, piix4_devfn + 1, i8259); usb_uhci_piix4_init(pci_bus, piix4_devfn + 2); smbus = piix4_pm_init(pci_bus, piix4_devfn + 3, 0x1100, i8259[9]); eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */ for (i = 0; i < 8; i++) { /* TODO: Populate SPD eeprom data. */ smbus_eeprom_device_init(smbus, 0x50 + i, eeprom_buf + (i * 256)); pit = pit_init(0x40, i8259[0]); DMA_init(0); /* Super I/O */ i8042_init(i8259[1], i8259[12], 0x60); rtc_state = rtc_init(0x70, i8259[8]); serial_init(0x3f8, i8259[4], 115200, serial_hds[0]); serial_init(0x2f8, i8259[3], 115200, serial_hds[1]); if (parallel_hds[0]) parallel_init(0x378, i8259[7], parallel_hds[0]); for(i = 0; i < MAX_FD; i++) { index = drive_get_index(IF_FLOPPY, 0, i); if (index != -1) fd[i] = drives_table[index].bdrv; else fd[i] = NULL; floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd); /* Sound card */ #ifdef HAS_AUDIO audio_init(pci_bus); #endif /* Network card */ network_init(pci_bus); /* Optional PCI video card */ pci_cirrus_vga_init(pci_bus, phys_ram_base + ram_size, ram_size, vga_ram_size);","Yes, it is vulnerable."988986,"static int ohci_service_td(OHCIState *ohci, struct ohci_ed *ed) { int dir; size_t len = 0; #ifdef DEBUG_PACKET const char *str = NULL; #endif int pid; int ret; int i; USBDevice *dev; struct ohci_td td; uint32_t addr; int flag_r; int completion; addr = ed->head & OHCI_DPTR_MASK; /* See if this TD has already been submitted to the device. */ completion = (addr == ohci->async_td); if (completion && !ohci->async_complete) { #ifdef DEBUG_PACKET DPRINTF(""Skipping async TD\n""); #endif return 1; } if (!ohci_read_td(ohci, addr, &td)) { fprintf(stderr, ""usb-ohci: TD read error at %x\n"", addr); return 0; } dir = OHCI_BM(ed->flags, ED_D); switch (dir) { case OHCI_TD_DIR_OUT: case OHCI_TD_DIR_IN: /* Same value. */ break; default: dir = OHCI_BM(td.flags, TD_DP); break; } switch (dir) { case OHCI_TD_DIR_IN: #ifdef DEBUG_PACKET str = ""in""; #endif pid = USB_TOKEN_IN; break; case OHCI_TD_DIR_OUT: #ifdef DEBUG_PACKET str = ""out""; #endif pid = USB_TOKEN_OUT; break; case OHCI_TD_DIR_SETUP: #ifdef DEBUG_PACKET str = ""setup""; #endif pid = USB_TOKEN_SETUP; break; default: fprintf(stderr, ""usb-ohci: Bad direction\n""); return 1; } if (td.cbp && td.be) { if ((td.cbp & 0xfffff000) != (td.be & 0xfffff000)) { len = (td.be & 0xfff) + 0x1001 - (td.cbp & 0xfff); } else { len = (td.be - td.cbp) + 1; } if (len && dir != OHCI_TD_DIR_IN && !completion) { ohci_copy_td(ohci, &td, ohci->usb_buf, len, 0); } } flag_r = (td.flags & OHCI_TD_R) != 0; #ifdef DEBUG_PACKET DPRINTF("" TD @ 0x%.8x %"" PRId64 "" bytes %s r=%d cbp=0x%.8x be=0x%.8x\n"", addr, (int64_t)len, str, flag_r, td.cbp, td.be); if (len > 0 && dir != OHCI_TD_DIR_IN) { DPRINTF("" data:""); for (i = 0; i < len; i++) printf("" %.2x"", ohci->usb_buf[i]); DPRINTF(""\n""); } #endif if (completion) { ret = ohci->usb_packet.len; ohci->async_td = 0; ohci->async_complete = 0; } else { ret = USB_RET_NODEV; for (i = 0; i < ohci->num_ports; i++) { dev = ohci->rhport[i].port.dev; if ((ohci->rhport[i].ctrl & OHCI_PORT_PES) == 0) continue; if (ohci->async_td) { /* ??? The hardware should allow one active packet per endpoint. We only allow one active packet per controller. This should be sufficient as long as devices respond in a timely manner. */ #ifdef DEBUG_PACKET DPRINTF(""Too many pending packets\n""); #endif return 1; } ohci->usb_packet.pid = pid; ohci->usb_packet.devaddr = OHCI_BM(ed->flags, ED_FA); ohci->usb_packet.devep = OHCI_BM(ed->flags, ED_EN); ohci->usb_packet.data = ohci->usb_buf; ohci->usb_packet.len = len; ret = usb_handle_packet(dev, &ohci->usb_packet); if (ret != USB_RET_NODEV) break; } #ifdef DEBUG_PACKET DPRINTF(""ret=%d\n"", ret); #endif if (ret == USB_RET_ASYNC) { ohci->async_td = addr; return 1; } } if (ret >= 0) { if (dir == OHCI_TD_DIR_IN) { ohci_copy_td(ohci, &td, ohci->usb_buf, ret, 1); #ifdef DEBUG_PACKET DPRINTF("" data:""); for (i = 0; i < ret; i++) printf("" %.2x"", ohci->usb_buf[i]); DPRINTF(""\n""); #endif } else { ret = len; } } /* Writeback */ if (ret == len || (dir == OHCI_TD_DIR_IN && ret >= 0 && flag_r)) { /* Transmission succeeded. */ if (ret == len) { td.cbp = 0; } else { td.cbp += ret; if ((td.cbp & 0xfff) + ret > 0xfff) { td.cbp &= 0xfff; td.cbp |= td.be & ~0xfff; } } td.flags |= OHCI_TD_T1; td.flags ^= OHCI_TD_T0; OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_NOERROR); OHCI_SET_BM(td.flags, TD_EC, 0); ed->head &= ~OHCI_ED_C; if (td.flags & OHCI_TD_T0) ed->head |= OHCI_ED_C; } else { if (ret >= 0) { DPRINTF(""usb-ohci: Underrun\n""); OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAUNDERRUN); } else { switch (ret) { case USB_RET_NODEV: OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DEVICENOTRESPONDING); case USB_RET_NAK: DPRINTF(""usb-ohci: got NAK\n""); return 1; case USB_RET_STALL: DPRINTF(""usb-ohci: got STALL\n""); OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_STALL); break; case USB_RET_BABBLE: DPRINTF(""usb-ohci: got BABBLE\n""); OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_DATAOVERRUN); break; default: fprintf(stderr, ""usb-ohci: Bad device response %d\n"", ret); OHCI_SET_BM(td.flags, TD_CC, OHCI_CC_UNDEXPETEDPID); OHCI_SET_BM(td.flags, TD_EC, 3); break; } } ed->head |= OHCI_ED_H; } /* Retire this TD */ ed->head &= ~OHCI_DPTR_MASK; ed->head |= td.next & OHCI_DPTR_MASK; td.next = ohci->done; ohci->done = addr; i = OHCI_BM(td.flags, TD_DI); if (i < ohci->done_count) ohci->done_count = i; ohci_put_td(ohci, addr, &td); return OHCI_BM(td.flags, TD_CC) != OHCI_CC_NOERROR; }","Yes, it is vulnerable."989987,"void qdev_prop_set_drive(DeviceState *dev, const char *name, BlockBackend *value, Error **errp) { object_property_set_str(OBJECT(dev), value ? blk_name(value) : """", name, errp); }","Yes, it is vulnerable."990988,"int net_slirp_redir(const char *redir_str) { struct slirp_config_str *config; if (QTAILQ_EMPTY(&slirp_stacks)) { config = g_malloc(sizeof(*config)); pstrcpy(config->str, sizeof(config->str), redir_str); config->flags = SLIRP_CFG_HOSTFWD | SLIRP_CFG_LEGACY; config->next = slirp_configs; slirp_configs = config; return 0; } return slirp_hostfwd(QTAILQ_FIRST(&slirp_stacks), redir_str, 1); }","Yes, it is vulnerable."991989,"static int decode_frame(AVCodecContext *avctx, const uint8_t *databuf, float **out_samples) { ATRAC3Context *q = avctx->priv_data; int ret, i, ch; uint8_t *ptr1; if (q->coding_mode == JOINT_STEREO) { /* channel coupling mode */ /* Decode sound unit pairs (channels are expected to be even). * Multichannel joint stereo interleaves pairs (6ch: 2ch + 2ch + 2ch) */ const uint8_t *js_databuf; int js_pair, js_block_align; js_block_align = (avctx->block_align / avctx->channels) * 2; /* block pair */ for (ch = 0; ch < avctx->channels; ch = ch + 2) { js_pair = ch/2; js_databuf = databuf + js_pair * js_block_align; /* align to current pair */ /* Set the bitstream reader at the start of first channel sound unit. */ init_get_bits(&q->gb, js_databuf, js_block_align * 8); /* decode Sound Unit 1 */ ret = decode_channel_sound_unit(q, &q->gb, &q->units[ch], out_samples[ch], ch, JOINT_STEREO); if (ret != 0) return ret; /* Framedata of the su2 in the joint-stereo mode is encoded in * reverse byte order so we need to swap it first. */ if (js_databuf == q->decoded_bytes_buffer) { uint8_t *ptr2 = q->decoded_bytes_buffer + js_block_align - 1; ptr1 = q->decoded_bytes_buffer; for (i = 0; i < js_block_align / 2; i++, ptr1++, ptr2--) FFSWAP(uint8_t, *ptr1, *ptr2); } else { const uint8_t *ptr2 = js_databuf + js_block_align - 1; for (i = 0; i < js_block_align; i++) q->decoded_bytes_buffer[i] = *ptr2--; } /* Skip the sync codes (0xF8). */ ptr1 = q->decoded_bytes_buffer; for (i = 4; *ptr1 == 0xF8; i++, ptr1++) { if (i >= js_block_align) return AVERROR_INVALIDDATA; } /* set the bitstream reader at the start of the second Sound Unit */ init_get_bits8(&q->gb, ptr1, q->decoded_bytes_buffer + js_block_align - ptr1); /* Fill the Weighting coeffs delay buffer */ memmove(q->weighting_delay[js_pair], &q->weighting_delay[js_pair][2], 4 * sizeof(*q->weighting_delay[js_pair])); q->weighting_delay[js_pair][4] = get_bits1(&q->gb); q->weighting_delay[js_pair][5] = get_bits(&q->gb, 3); for (i = 0; i < 4; i++) { q->matrix_coeff_index_prev[js_pair][i] = q->matrix_coeff_index_now[js_pair][i]; q->matrix_coeff_index_now[js_pair][i] = q->matrix_coeff_index_next[js_pair][i]; q->matrix_coeff_index_next[js_pair][i] = get_bits(&q->gb, 2); } /* Decode Sound Unit 2. */ ret = decode_channel_sound_unit(q, &q->gb, &q->units[ch+1], out_samples[ch+1], ch+1, JOINT_STEREO); if (ret != 0) return ret; /* Reconstruct the channel coefficients. */ reverse_matrixing(out_samples[ch], out_samples[ch+1], q->matrix_coeff_index_prev[js_pair], q->matrix_coeff_index_now[js_pair]); channel_weighting(out_samples[ch], out_samples[ch+1], q->weighting_delay[js_pair]); } } else { /* single channels */ /* Decode the channel sound units. */ for (i = 0; i < avctx->channels; i++) { /* Set the bitstream reader at the start of a channel sound unit. */ init_get_bits(&q->gb, databuf + i * avctx->block_align / avctx->channels, avctx->block_align * 8 / avctx->channels); ret = decode_channel_sound_unit(q, &q->gb, &q->units[i], out_samples[i], i, q->coding_mode); if (ret != 0) return ret; } } /* Apply the iQMF synthesis filter. */ for (i = 0; i < avctx->channels; i++) { float *p1 = out_samples[i]; float *p2 = p1 + 256; float *p3 = p2 + 256; float *p4 = p3 + 256; ff_atrac_iqmf(p1, p2, 256, p1, q->units[i].delay_buf1, q->temp_buf); ff_atrac_iqmf(p4, p3, 256, p3, q->units[i].delay_buf2, q->temp_buf); ff_atrac_iqmf(p1, p3, 512, p1, q->units[i].delay_buf3, q->temp_buf); } return 0; }","Yes, it is vulnerable."992990,"static void decode_refpass(Jpeg2000T1Context *t1, int width, int height, int bpno, int vert_causal_ctx_csty_symbol) { int phalf, nhalf; int y0, x, y; phalf = 1 << (bpno - 1); nhalf = -phalf; for (y0 = 0; y0 < height; y0 += 4) for (x = 0; x < width; x++) for (y = y0; y < height && y < y0 + 4; y++) if ((t1->flags[y + 1][x + 1] & (JPEG2000_T1_SIG | JPEG2000_T1_VIS)) == JPEG2000_T1_SIG) { int flags_mask = (vert_causal_ctx_csty_symbol && y == y0 + 3) ? ~(JPEG2000_T1_SIG_S | JPEG2000_T1_SIG_SW | JPEG2000_T1_SIG_SE | JPEG2000_T1_SGN_S) : -1; int ctxno = ff_jpeg2000_getrefctxno(t1->flags[y + 1][x + 1] & flags_mask); int r = ff_mqc_decode(&t1->mqc, t1->mqc.cx_states + ctxno) ? phalf : nhalf; t1->data[y][x] += t1->data[y][x] < 0 ? -r : r; t1->flags[y + 1][x + 1] |= JPEG2000_T1_REF; } }","No, it is non-vulnerable."993991,"static void kvm_invoke_set_guest_debug(void *data) { struct kvm_set_guest_debug_data *dbg_data = data; CPUState *env = dbg_data->env; if (env->kvm_vcpu_dirty) { kvm_arch_put_registers(env); env->kvm_vcpu_dirty = 0; } dbg_data->err = kvm_vcpu_ioctl(env, KVM_SET_GUEST_DEBUG, &dbg_data->dbg); }","Yes, it is vulnerable."994992,"static uint32_t find_subframe_rice_params(FlacEncodeContext *s, FlacSubframe *sub, int pred_order) { int pmin = get_max_p_order(s->options.min_partition_order, s->frame.blocksize, pred_order); int pmax = get_max_p_order(s->options.max_partition_order, s->frame.blocksize, pred_order); uint32_t bits = 8 + pred_order * sub->obits + 2 + 4; if (sub->type == FLAC_SUBFRAME_LPC) bits += 4 + 5 + pred_order * s->options.lpc_coeff_precision; bits += calc_rice_params(&sub->rc, pmin, pmax, sub->residual, s->frame.blocksize, pred_order); return bits; }","Yes, it is vulnerable."995993,"static int mmap_start(AVFormatContext *ctx) { struct video_data *s = ctx->priv_data; enum v4l2_buf_type type; int i, res; for (i = 0; i < s->buffers; i++) { struct v4l2_buffer buf; memset(&buf, 0, sizeof(struct v4l2_buffer)); buf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; buf.memory = V4L2_MEMORY_MMAP; buf.index = i; res = ioctl(s->fd, VIDIOC_QBUF, &buf); if (res < 0) { av_log(ctx, AV_LOG_ERROR, ""ioctl(VIDIOC_QBUF): %s\n"", strerror(errno)); return AVERROR(errno); } } type = V4L2_BUF_TYPE_VIDEO_CAPTURE; res = ioctl(s->fd, VIDIOC_STREAMON, &type); if (res < 0) { av_log(ctx, AV_LOG_ERROR, ""ioctl(VIDIOC_STREAMON): %s\n"", strerror(errno)); return AVERROR(errno); } return 0; }","No, it is non-vulnerable."996994,"static void bdrv_rw_em_cb(void *opaque, int ret) { *(int *)opaque = ret; }","No, it is non-vulnerable."997995,"void ppc_set_compat(PowerPCCPU *cpu, uint32_t compat_pvr, Error **errp) { int ret = 0; CPUPPCState *env = &cpu->env; PowerPCCPUClass *host_pcc; cpu->compat_pvr = compat_pvr; switch (compat_pvr) { case CPU_POWERPC_LOGICAL_2_05: env->spr[SPR_PCR] = PCR_TM_DIS | PCR_VSX_DIS | PCR_COMPAT_2_07 | PCR_COMPAT_2_06 | PCR_COMPAT_2_05; break; case CPU_POWERPC_LOGICAL_2_06: case CPU_POWERPC_LOGICAL_2_06_PLUS: env->spr[SPR_PCR] = PCR_TM_DIS | PCR_COMPAT_2_07 | PCR_COMPAT_2_06; break; case CPU_POWERPC_LOGICAL_2_07: env->spr[SPR_PCR] = PCR_COMPAT_2_07; break; default: env->spr[SPR_PCR] = 0; break; } host_pcc = kvm_ppc_get_host_cpu_class(); if (host_pcc) { env->spr[SPR_PCR] &= host_pcc->pcr_mask; } if (kvm_enabled()) { ret = kvmppc_set_compat(cpu, cpu->compat_pvr); if (ret < 0) { error_setg_errno(errp, -ret, ""Unable to set CPU compatibility mode in KVM""); } } }","No, it is non-vulnerable."998996,"static coroutine_fn int sd_co_pdiscard(BlockDriverState *bs, int64_t offset, int count) { SheepdogAIOCB acb; BDRVSheepdogState *s = bs->opaque; QEMUIOVector discard_iov; struct iovec iov; uint32_t zero = 0; if (!s->discard_supported) { return 0; } memset(&discard_iov, 0, sizeof(discard_iov)); memset(&iov, 0, sizeof(iov)); iov.iov_base = &zero; iov.iov_len = sizeof(zero); discard_iov.iov = &iov; discard_iov.niov = 1; if (!QEMU_IS_ALIGNED(offset | count, BDRV_SECTOR_SIZE)) { return -ENOTSUP; } sd_aio_setup(&acb, s, &discard_iov, offset >> BDRV_SECTOR_BITS, count >> BDRV_SECTOR_BITS, AIOCB_DISCARD_OBJ); retry: if (check_overlapping_aiocb(s, &acb)) { qemu_co_queue_wait(&s->overlapping_queue); goto retry; } sd_co_rw_vector(&acb); QLIST_REMOVE(&acb, aiocb_siblings); qemu_co_queue_restart_all(&s->overlapping_queue); return acb.ret; }","No, it is non-vulnerable."999997,"static void gdb_vm_stopped(void *opaque, int reason) { GDBState *s = opaque; char buf[256]; const char *type; int ret; if (s->state == RS_SYSCALL) return; /* disable single step if it was enable */ cpu_single_step(s->env, 0); if (reason == EXCP_DEBUG) { if (s->env->watchpoint_hit) { switch (s->env->watchpoint_hit->flags & BP_MEM_ACCESS) { case BP_MEM_READ: type = ""r""; break; case BP_MEM_ACCESS: type = ""a""; break; default: type = """"; break; } snprintf(buf, sizeof(buf), ""T%02x%swatch:"" TARGET_FMT_lx "";"", SIGTRAP, type, s->env->watchpoint_hit->vaddr); put_packet(s, buf); s->env->watchpoint_hit = NULL; return; } tb_flush(s->env); ret = SIGTRAP; } else if (reason == EXCP_INTERRUPT) { ret = SIGINT; } else { ret = 0; } snprintf(buf, sizeof(buf), ""S%02x"", ret); put_packet(s, buf); }","No, it is non-vulnerable."1000998,"void qemu_peer_set_offload(NetClientState *nc, int csum, int tso4, int tso6, int ecn, int ufo) { if (!nc->peer || !nc->peer->info->set_offload) { return; } nc->peer->info->set_offload(nc->peer, csum, tso4, tso6, ecn, ufo); }","No, it is non-vulnerable."1001999,"uint32_t helper_bcdsetsgn(ppc_avr_t *r, ppc_avr_t *b, uint32_t ps) { int i; int invalid = 0; int sgnb = bcd_get_sgn(b); *r = *b; bcd_put_digit(r, bcd_preferred_sgn(sgnb, ps), 0); for (i = 1; i < 32; i++) { bcd_get_digit(b, i, &invalid); if (unlikely(invalid)) { return CRF_SO; } } return bcd_cmp_zero(r); }","No, it is non-vulnerable."10021000,uint32_t msix_bar_size(PCIDevice *dev) { return (dev->cap_present & QEMU_PCI_CAP_MSIX) ? dev->msix_bar_size : 0; },"No, it is non-vulnerable."10031001,"static int mxf_parse_mpeg2_frame(AVFormatContext *s, AVStream *st, AVPacket *pkt, int *flags) { MXFStreamContext *sc = st->priv_data; MXFContext *mxf = s->priv_data; uint32_t c = -1; int i; *flags = 0; for(i = 0; i < pkt->size - 4; i++) { c = (c<<8) + pkt->data[i]; if (c == 0x1B5) { if (i + 2 < pkt->size && (pkt->data[i+1] & 0xf0) == 0x10) { // seq ext st->codec->profile = pkt->data[i+1] & 0x07; st->codec->level = pkt->data[i+2] >> 4; } else if (i + 5 < pkt->size && (pkt->data[i+1] & 0xf0) == 0x80) { // pict coding ext sc->interlaced = !(pkt->data[i+5] & 0x80); // progressive frame break; } } else if (c == 0x1b8) { // gop if (i + 4 < pkt->size) { if (pkt->data[i+4]>>6 & 0x01) // closed *flags |= 0x80; // random access if (!mxf->header_written) { unsigned hours = (pkt->data[i+1]>>2) & 0x1f; unsigned minutes = ((pkt->data[i+1] & 0x03) << 4) | (pkt->data[i+2]>>4); unsigned seconds = ((pkt->data[i+2] & 0x07) << 3) | (pkt->data[i+3]>>5); unsigned frames = ((pkt->data[i+3] & 0x1f) << 1) | (pkt->data[i+4]>>7); mxf->timecode_drop_frame = !!(pkt->data[i+1] & 0x80); mxf->timecode_start = (hours*3600 + minutes*60 + seconds) * mxf->timecode_base + frames; if (mxf->timecode_drop_frame) { unsigned tminutes = 60 * hours + minutes; mxf->timecode_start -= 2 * (tminutes - tminutes / 10); } av_log(s, AV_LOG_DEBUG, ""frame %d %d:%d:%d%c%d\n"", mxf->timecode_start, hours, minutes, seconds, mxf->timecode_drop_frame ? ';':':', frames); } } } else if (c == 0x1b3) { // seq *flags |= 0x40; if (i + 4 < pkt->size) { switch ((pkt->data[i+4]>>4) & 0xf) { case 2: sc->aspect_ratio = (AVRational){ 4, 3}; break; case 3: sc->aspect_ratio = (AVRational){ 16, 9}; break; case 4: sc->aspect_ratio = (AVRational){221,100}; break; default: av_reduce(&sc->aspect_ratio.num, &sc->aspect_ratio.den, st->codec->width, st->codec->height, 1024*1024); } } } else if (c == 0x100) { // pic int pict_type = (pkt->data[i+2]>>3) & 0x07; if (pict_type == 2) { // P frame *flags |= 0x22; st->codec->gop_size = 1; } else if (pict_type == 3) { // B frame *flags |= 0x33; sc->temporal_reordering = -1; } else if (!pict_type) { av_log(s, AV_LOG_ERROR, ""error parsing mpeg2 frame\n""); return 0; } } } if (s->oformat != &mxf_d10_muxer) sc->codec_ul = mxf_get_mpeg2_codec_ul(st->codec); return !!sc->codec_ul; }","No, it is non-vulnerable."10041002,"VirtIODevice *virtio_blk_init(DeviceState *dev, BlockConf *conf) { VirtIOBlock *s; int cylinders, heads, secs; static int virtio_blk_id; s = (VirtIOBlock *)virtio_common_init(""virtio-blk"", VIRTIO_ID_BLOCK, sizeof(struct virtio_blk_config), sizeof(VirtIOBlock)); s->vdev.get_config = virtio_blk_update_config; s->vdev.get_features = virtio_blk_get_features; s->vdev.reset = virtio_blk_reset; s->bs = conf->dinfo->bdrv; s->conf = conf; s->rq = NULL; s->sector_mask = (s->conf->logical_block_size / BDRV_SECTOR_SIZE) - 1; bdrv_guess_geometry(s->bs, &cylinders, &heads, &secs); s->vq = virtio_add_queue(&s->vdev, 128, virtio_blk_handle_output); qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s); register_savevm(""virtio-blk"", virtio_blk_id++, 2, virtio_blk_save, virtio_blk_load, s); return &s->vdev; }","No, it is non-vulnerable."10051003,int ffurl_register_protocol(URLProtocol *protocol) { URLProtocol **p; p = &first_protocol; while (*p != NULL) p = &(*p)->next; *p = protocol; protocol->next = NULL; return 0; },"No, it is non-vulnerable."10061004,"static av_cold int common_init(AVCodecContext *avctx){ FFV1Context *s = avctx->priv_data; s->avctx= avctx; s->flags= avctx->flags; avcodec_get_frame_defaults(&s->picture); ff_dsputil_init(&s->dsp, avctx); s->width = avctx->width; s->height= avctx->height; assert(s->width && s->height); //defaults s->num_h_slices=1; s->num_v_slices=1; return 0; }","No, it is non-vulnerable."10071005,"static bool e1000_has_rxbufs(E1000State *s, size_t total_size) { int bufs; /* Fast-path short packets */ if (total_size <= s->rxbuf_size) { return s->mac_reg[RDH] != s->mac_reg[RDT] || !s->check_rxov; } if (s->mac_reg[RDH] < s->mac_reg[RDT]) { bufs = s->mac_reg[RDT] - s->mac_reg[RDH]; } else if (s->mac_reg[RDH] > s->mac_reg[RDT] || !s->check_rxov) { bufs = s->mac_reg[RDLEN] / sizeof(struct e1000_rx_desc) + s->mac_reg[RDT] - s->mac_reg[RDH]; } else { return false; } return total_size <= bufs * s->rxbuf_size; }","No, it is non-vulnerable."10081006,"static int get_uint8_equal(QEMUFile *f, void *pv, size_t size, VMStateField *field) { uint8_t *v = pv; uint8_t v2; qemu_get_8s(f, &v2); if (*v == v2) { return 0; error_report(""%x != %x"", *v, v2); return -EINVAL;","Yes, it is vulnerable."10091007,"static int vhdx_create_bat(BlockDriverState *bs, BDRVVHDXState *s, uint64_t image_size, VHDXImageType type, bool use_zero_blocks, uint64_t file_offset, uint32_t length) { int ret = 0; uint64_t data_file_offset; uint64_t total_sectors = 0; uint64_t sector_num = 0; uint64_t unused; int block_state; VHDXSectorInfo sinfo; assert(s->bat == NULL); /* this gives a data start after BAT/bitmap entries, and well * past any metadata entries (with a 4 MB buffer for future * expansion */ data_file_offset = file_offset + length + 5 * MiB; total_sectors = image_size >> s->logical_sector_size_bits; if (type == VHDX_TYPE_DYNAMIC) { /* All zeroes, so we can just extend the file - the end of the BAT * is the furthest thing we have written yet */ ret = bdrv_truncate(bs, data_file_offset); if (ret < 0) { goto exit; } } else if (type == VHDX_TYPE_FIXED) { ret = bdrv_truncate(bs, data_file_offset + image_size); if (ret < 0) { goto exit; } } else { ret = -ENOTSUP; goto exit; } if (type == VHDX_TYPE_FIXED || use_zero_blocks || bdrv_has_zero_init(bs) == 0) { /* for a fixed file, the default BAT entry is not zero */ s->bat = g_malloc0(length); block_state = type == VHDX_TYPE_FIXED ? PAYLOAD_BLOCK_FULLY_PRESENT : PAYLOAD_BLOCK_NOT_PRESENT; block_state = use_zero_blocks ? PAYLOAD_BLOCK_ZERO : block_state; /* fill the BAT by emulating sector writes of sectors_per_block size */ while (sector_num < total_sectors) { vhdx_block_translate(s, sector_num, s->sectors_per_block, &sinfo); sinfo.file_offset = data_file_offset + (sector_num << s->logical_sector_size_bits); sinfo.file_offset = ROUND_UP(sinfo.file_offset, MiB); vhdx_update_bat_table_entry(bs, s, &sinfo, &unused, &unused, block_state); cpu_to_le64s(&s->bat[sinfo.bat_idx]); sector_num += s->sectors_per_block; } ret = bdrv_pwrite(bs, file_offset, s->bat, length); if (ret < 0) { goto exit; } } exit: g_free(s->bat); return ret; }","Yes, it is vulnerable."10101008,"static void cpu_ioreq_move(ioreq_t *req) { int i; if (!req->data_is_ptr) { if (req->dir == IOREQ_READ) { for (i = 0; i < req->count; i++) { read_phys_req_item(req->addr, req, i, &req->data); } } else if (req->dir == IOREQ_WRITE) { for (i = 0; i < req->count; i++) { write_phys_req_item(req->addr, req, i, &req->data); } } } else { uint64_t tmp; if (req->dir == IOREQ_READ) { for (i = 0; i < req->count; i++) { read_phys_req_item(req->addr, req, i, &tmp); write_phys_req_item(req->data, req, i, &tmp); } } else if (req->dir == IOREQ_WRITE) { for (i = 0; i < req->count; i++) { read_phys_req_item(req->data, req, i, &tmp); write_phys_req_item(req->addr, req, i, &tmp); } } } }","No, it is non-vulnerable."10111009,"bool qemu_savevm_state_blocked(Monitor *mon) { SaveStateEntry *se; QTAILQ_FOREACH(se, &savevm_handlers, entry) { if (se->no_migrate) { monitor_printf(mon, ""state blocked by non-migratable device '%s'\n"", se->idstr); return true; } } return false; }","No, it is non-vulnerable."10121010,"static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int count, BdrvRequestFlags flags) { int ret; BDRVQcow2State *s = bs->opaque; uint32_t head = offset % s->cluster_size; uint32_t tail = (offset + count) % s->cluster_size; trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, count); if (offset + count == bs->total_sectors * BDRV_SECTOR_SIZE) { tail = 0; } if (head || tail) { int64_t cl_start = (offset - head) >> BDRV_SECTOR_BITS; uint64_t off; unsigned int nr; assert(head + count <= s->cluster_size); /* check whether remainder of cluster already reads as zero */ if (!(is_zero_sectors(bs, cl_start, DIV_ROUND_UP(head, BDRV_SECTOR_SIZE)) && is_zero_sectors(bs, (offset + count) >> BDRV_SECTOR_BITS, DIV_ROUND_UP(-tail & (s->cluster_size - 1), BDRV_SECTOR_SIZE)))) { return -ENOTSUP; } qemu_co_mutex_lock(&s->lock); /* We can have new write after previous check */ offset = cl_start << BDRV_SECTOR_BITS; count = s->cluster_size; nr = s->cluster_size; ret = qcow2_get_cluster_offset(bs, offset, &nr, &off); if (ret != QCOW2_CLUSTER_UNALLOCATED && ret != QCOW2_CLUSTER_ZERO_PLAIN && ret != QCOW2_CLUSTER_ZERO_ALLOC) { qemu_co_mutex_unlock(&s->lock); return -ENOTSUP; } } else { qemu_co_mutex_lock(&s->lock); } trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, count); /* Whatever is left can use real zero clusters */ ret = qcow2_zero_clusters(bs, offset, count >> BDRV_SECTOR_BITS, flags); qemu_co_mutex_unlock(&s->lock); return ret; }","No, it is non-vulnerable."10131011,"static void gen_abso(DisasContext *ctx) { int l1 = gen_new_label(); int l2 = gen_new_label(); int l3 = gen_new_label(); /* Start with XER OV disabled, the most likely case */ tcg_gen_movi_tl(cpu_ov, 0); tcg_gen_brcondi_tl(TCG_COND_GE, cpu_gpr[rA(ctx->opcode)], 0, l2); tcg_gen_brcondi_tl(TCG_COND_NE, cpu_gpr[rA(ctx->opcode)], 0x80000000, l1); tcg_gen_movi_tl(cpu_ov, 1); tcg_gen_movi_tl(cpu_so, 1); tcg_gen_br(l2); gen_set_label(l1); tcg_gen_neg_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]); tcg_gen_br(l3); gen_set_label(l2); tcg_gen_mov_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]); gen_set_label(l3); if (unlikely(Rc(ctx->opcode) != 0)) gen_set_Rc0(ctx, cpu_gpr[rD(ctx->opcode)]); }","No, it is non-vulnerable."10141012,"DeviceState *sysbus_create_varargs(const char *name, target_phys_addr_t addr, ...) { DeviceState *dev; SysBusDevice *s; va_list va; qemu_irq irq; int n; dev = qdev_create(NULL, name); s = sysbus_from_qdev(dev); qdev_init(dev); if (addr != (target_phys_addr_t)-1) { sysbus_mmio_map(s, 0, addr); } va_start(va, addr); n = 0; while (1) { irq = va_arg(va, qemu_irq); if (!irq) { break; } sysbus_connect_irq(s, n, irq); n++; } return dev; }","Yes, it is vulnerable."10151013,"static int dca_decode_frame(AVCodecContext * avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; int lfe_samples; int num_core_channels = 0; int i; float *samples_flt = data; int16_t *samples_s16 = data; int out_size; DCAContext *s = avctx->priv_data; int channels; int core_ss_end; s->xch_present = 0; s->dca_buffer_size = dca_convert_bitstream(buf, buf_size, s->dca_buffer, DCA_MAX_FRAME_SIZE + DCA_MAX_EXSS_HEADER_SIZE); if (s->dca_buffer_size == AVERROR_INVALIDDATA) { av_log(avctx, AV_LOG_ERROR, ""Not a valid DCA frame\n""); return AVERROR_INVALIDDATA; } init_get_bits(&s->gb, s->dca_buffer, s->dca_buffer_size * 8); if (dca_parse_frame_header(s) < 0) { //seems like the frame is corrupt, try with the next one *data_size=0; return buf_size; } //set AVCodec values with parsed data avctx->sample_rate = s->sample_rate; avctx->bit_rate = s->bit_rate; avctx->frame_size = s->sample_blocks * 32; s->profile = FF_PROFILE_DTS; for (i = 0; i < (s->sample_blocks / 8); i++) { dca_decode_block(s, 0, i); } /* record number of core channels incase less than max channels are requested */ num_core_channels = s->prim_channels; if (s->ext_coding) s->core_ext_mask = dca_ext_audio_descr_mask[s->ext_descr]; else s->core_ext_mask = 0; core_ss_end = FFMIN(s->frame_size, s->dca_buffer_size) * 8; /* only scan for extensions if ext_descr was unknown or indicated a * supported XCh extension */ if (s->core_ext_mask < 0 || s->core_ext_mask & DCA_EXT_XCH) { /* if ext_descr was unknown, clear s->core_ext_mask so that the * extensions scan can fill it up */ s->core_ext_mask = FFMAX(s->core_ext_mask, 0); /* extensions start at 32-bit boundaries into bitstream */ skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31); while(core_ss_end - get_bits_count(&s->gb) >= 32) { uint32_t bits = get_bits_long(&s->gb, 32); switch(bits) { case 0x5a5a5a5a: { int ext_amode, xch_fsize; s->xch_base_channel = s->prim_channels; /* validate sync word using XCHFSIZE field */ xch_fsize = show_bits(&s->gb, 10); if((s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize) && (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + xch_fsize + 1)) continue; /* skip length-to-end-of-frame field for the moment */ skip_bits(&s->gb, 10); s->core_ext_mask |= DCA_EXT_XCH; /* extension amode should == 1, number of channels in extension */ /* AFAIK XCh is not used for more channels */ if ((ext_amode = get_bits(&s->gb, 4)) != 1) { av_log(avctx, AV_LOG_ERROR, ""XCh extension amode %d not"" "" supported!\n"",ext_amode); continue; } /* much like core primary audio coding header */ dca_parse_audio_coding_header(s, s->xch_base_channel); for (i = 0; i < (s->sample_blocks / 8); i++) { dca_decode_block(s, s->xch_base_channel, i); } s->xch_present = 1; break; } case 0x47004a03: /* XXCh: extended channels */ /* usually found either in core or HD part in DTS-HD HRA streams, * but not in DTS-ES which contains XCh extensions instead */ s->core_ext_mask |= DCA_EXT_XXCH; break; case 0x1d95f262: { int fsize96 = show_bits(&s->gb, 12) + 1; if (s->frame_size != (get_bits_count(&s->gb) >> 3) - 4 + fsize96) continue; av_log(avctx, AV_LOG_DEBUG, ""X96 extension found at %d bits\n"", get_bits_count(&s->gb)); skip_bits(&s->gb, 12); av_log(avctx, AV_LOG_DEBUG, ""FSIZE96 = %d bytes\n"", fsize96); av_log(avctx, AV_LOG_DEBUG, ""REVNO = %d\n"", get_bits(&s->gb, 4)); s->core_ext_mask |= DCA_EXT_X96; break; } } skip_bits_long(&s->gb, (-get_bits_count(&s->gb)) & 31); } } else { /* no supported extensions, skip the rest of the core substream */ skip_bits_long(&s->gb, core_ss_end - get_bits_count(&s->gb)); } if (s->core_ext_mask & DCA_EXT_X96) s->profile = FF_PROFILE_DTS_96_24; else if (s->core_ext_mask & (DCA_EXT_XCH | DCA_EXT_XXCH)) s->profile = FF_PROFILE_DTS_ES; /* check for ExSS (HD part) */ if (s->dca_buffer_size - s->frame_size > 32 && get_bits_long(&s->gb, 32) == DCA_HD_MARKER) dca_exss_parse_header(s); avctx->profile = s->profile; channels = s->prim_channels + !!s->lfe; if (s->amode<16) { avctx->channel_layout = dca_core_channel_layout[s->amode]; if (s->xch_present && (!avctx->request_channels || avctx->request_channels > num_core_channels + !!s->lfe)) { avctx->channel_layout |= AV_CH_BACK_CENTER; if (s->lfe) { avctx->channel_layout |= AV_CH_LOW_FREQUENCY; s->channel_order_tab = dca_channel_reorder_lfe_xch[s->amode]; } else { s->channel_order_tab = dca_channel_reorder_nolfe_xch[s->amode]; } } else { channels = num_core_channels + !!s->lfe; s->xch_present = 0; /* disable further xch processing */ if (s->lfe) { avctx->channel_layout |= AV_CH_LOW_FREQUENCY; s->channel_order_tab = dca_channel_reorder_lfe[s->amode]; } else s->channel_order_tab = dca_channel_reorder_nolfe[s->amode]; } if (channels > !!s->lfe && s->channel_order_tab[channels - 1 - !!s->lfe] < 0) return AVERROR_INVALIDDATA; if (avctx->request_channels == 2 && s->prim_channels > 2) { channels = 2; s->output = DCA_STEREO; avctx->channel_layout = AV_CH_LAYOUT_STEREO; } } else { av_log(avctx, AV_LOG_ERROR, ""Non standard configuration %d !\n"",s->amode); return AVERROR_INVALIDDATA; } /* There is nothing that prevents a dts frame to change channel configuration but Libav doesn't support that so only set the channels if it is previously unset. Ideally during the first probe for channels the crc should be checked and only set avctx->channels when the crc is ok. Right now the decoder could set the channels based on a broken first frame.*/ if (s->is_channels_set == 0) { s->is_channels_set = 1; avctx->channels = channels; } if (avctx->channels != channels) { av_log(avctx, AV_LOG_ERROR, ""DCA decoder does not support number of "" ""channels changing in stream. Skipping frame.\n""); return AVERROR_PATCHWELCOME; } out_size = 256 / 8 * s->sample_blocks * channels * av_get_bytes_per_sample(avctx->sample_fmt); if (*data_size < out_size) return AVERROR(EINVAL); *data_size = out_size; /* filter to get final output */ for (i = 0; i < (s->sample_blocks / 8); i++) { dca_filter_channels(s, i); /* If this was marked as a DTS-ES stream we need to subtract back- */ /* channel from SL & SR to remove matrixed back-channel signal */ if((s->source_pcm_res & 1) && s->xch_present) { float* back_chan = s->samples + s->channel_order_tab[s->xch_base_channel] * 256; float* lt_chan = s->samples + s->channel_order_tab[s->xch_base_channel - 2] * 256; float* rt_chan = s->samples + s->channel_order_tab[s->xch_base_channel - 1] * 256; s->dsp.vector_fmac_scalar(lt_chan, back_chan, -M_SQRT1_2, 256); s->dsp.vector_fmac_scalar(rt_chan, back_chan, -M_SQRT1_2, 256); } if (avctx->sample_fmt == AV_SAMPLE_FMT_FLT) { s->fmt_conv.float_interleave(samples_flt, s->samples_chanptr, 256, channels); samples_flt += 256 * channels; } else { s->fmt_conv.float_to_int16_interleave(samples_s16, s->samples_chanptr, 256, channels); samples_s16 += 256 * channels; } } /* update lfe history */ lfe_samples = 2 * s->lfe * (s->sample_blocks / 8); for (i = 0; i < 2 * s->lfe * 4; i++) { s->lfe_data[i] = s->lfe_data[i + lfe_samples]; } return buf_size; }","No, it is non-vulnerable."10161014,"int spapr_populate_pci_dt(sPAPRPHBState *phb, uint32_t xics_phandle, void *fdt) { int bus_off, i, j; char nodename[256]; uint32_t bus_range[] = { cpu_to_be32(0), cpu_to_be32(0xff) }; struct { uint32_t hi; uint64_t child; uint64_t parent; uint64_t size; } QEMU_PACKED ranges[] = { { cpu_to_be32(b_ss(1)), cpu_to_be64(0), cpu_to_be64(phb->io_win_addr), cpu_to_be64(memory_region_size(&phb->iospace)), }, { cpu_to_be32(b_ss(2)), cpu_to_be64(SPAPR_PCI_MEM_WIN_BUS_OFFSET), cpu_to_be64(phb->mem_win_addr), cpu_to_be64(memory_region_size(&phb->memwindow)), }, }; uint64_t bus_reg[] = { cpu_to_be64(phb->buid), 0 }; uint32_t interrupt_map_mask[] = { cpu_to_be32(b_ddddd(-1)|b_fff(0)), 0x0, 0x0, cpu_to_be32(-1)}; uint32_t interrupt_map[PCI_SLOT_MAX * PCI_NUM_PINS][7]; /* Start populating the FDT */ sprintf(nodename, ""pci@%"" PRIx64, phb->buid); bus_off = fdt_add_subnode(fdt, 0, nodename); if (bus_off < 0) { return bus_off; } #define _FDT(exp) \ do { \ int ret = (exp); \ if (ret < 0) { \ return ret; \ } \ } while (0) /* Write PHB properties */ _FDT(fdt_setprop_string(fdt, bus_off, ""device_type"", ""pci"")); _FDT(fdt_setprop_string(fdt, bus_off, ""compatible"", ""IBM,Logical_PHB"")); _FDT(fdt_setprop_cell(fdt, bus_off, ""#address-cells"", 0x3)); _FDT(fdt_setprop_cell(fdt, bus_off, ""#size-cells"", 0x2)); _FDT(fdt_setprop_cell(fdt, bus_off, ""#interrupt-cells"", 0x1)); _FDT(fdt_setprop(fdt, bus_off, ""used-by-rtas"", NULL, 0)); _FDT(fdt_setprop(fdt, bus_off, ""bus-range"", &bus_range, sizeof(bus_range))); _FDT(fdt_setprop(fdt, bus_off, ""ranges"", &ranges, sizeof(ranges))); _FDT(fdt_setprop(fdt, bus_off, ""reg"", &bus_reg, sizeof(bus_reg))); _FDT(fdt_setprop_cell(fdt, bus_off, ""ibm,pci-config-space-type"", 0x1)); /* Build the interrupt-map, this must matches what is done * in pci_spapr_map_irq */ _FDT(fdt_setprop(fdt, bus_off, ""interrupt-map-mask"", &interrupt_map_mask, sizeof(interrupt_map_mask))); for (i = 0; i < PCI_SLOT_MAX; i++) { for (j = 0; j < PCI_NUM_PINS; j++) { uint32_t *irqmap = interrupt_map[i*PCI_NUM_PINS + j]; int lsi_num = pci_spapr_swizzle(i, j); irqmap[0] = cpu_to_be32(b_ddddd(i)|b_fff(0)); irqmap[1] = 0; irqmap[2] = 0; irqmap[3] = cpu_to_be32(j+1); irqmap[4] = cpu_to_be32(xics_phandle); irqmap[5] = cpu_to_be32(phb->lsi_table[lsi_num].irq); irqmap[6] = cpu_to_be32(0x8); } } /* Write interrupt map */ _FDT(fdt_setprop(fdt, bus_off, ""interrupt-map"", &interrupt_map, sizeof(interrupt_map))); object_child_foreach(OBJECT(phb), spapr_phb_children_dt, &((sPAPRTCEDT){ .fdt = fdt, .node_off = bus_off })); return 0; }","Yes, it is vulnerable."10171015,"void bdrv_set_translation_hint(BlockDriverState *bs, int translation) { bs->translation = translation; }","No, it is non-vulnerable."10181016,"static int coroutine_fn raw_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes, QEMUIOVector *qiov, int flags) { BDRVRawState *s = bs->opaque; if (offset > UINT64_MAX - s->offset) { return -EINVAL; } offset += s->offset; BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO); return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags); }","No, it is non-vulnerable."10191017,static bool balloon_stats_supported(const VirtIOBalloon *s) { VirtIODevice *vdev = VIRTIO_DEVICE(s); return vdev->guest_features & (1 << VIRTIO_BALLOON_F_STATS_VQ); },"No, it is non-vulnerable."10201018,"static void pm_update_sci(PIIX4PMState *s) { int sci_level, pmsts; int64_t expire_time; pmsts = get_pmsts(s); sci_level = (((pmsts & s->pmen) & (RTC_EN | PWRBTN_EN | GBL_EN | TMROF_EN)) != 0); qemu_set_irq(s->irq, sci_level); /* schedule a timer interruption if needed */ if ((s->pmen & TMROF_EN) && !(pmsts & TMROF_EN)) { expire_time = muldiv64(s->tmr_overflow_time, ticks_per_sec, PM_FREQ); qemu_mod_timer(s->tmr_timer, expire_time); s->tmr_overflow_time += 0x800000; } else { qemu_del_timer(s->tmr_timer); } }","Yes, it is vulnerable."10211019,"static int find_slice_quant(AVCodecContext *avctx, const AVFrame *pic, int trellis_node, int x, int y, int mbs_per_slice) { ProresContext *ctx = avctx->priv_data; int i, q, pq, xp, yp; const uint16_t *src; int slice_width_factor = av_log2(mbs_per_slice); int num_cblocks[MAX_PLANES], pwidth; int plane_factor[MAX_PLANES], is_chroma[MAX_PLANES]; const int min_quant = ctx->profile_info->min_quant; const int max_quant = ctx->profile_info->max_quant; int error, bits, bits_limit; int mbs, prev, cur, new_score; int slice_bits[TRELLIS_WIDTH], slice_score[TRELLIS_WIDTH]; mbs = x + mbs_per_slice; for (i = 0; i < ctx->num_planes; i++) { is_chroma[i] = (i == 1 || i == 2); plane_factor[i] = slice_width_factor + 2; if (is_chroma[i]) plane_factor[i] += ctx->chroma_factor - 3; if (!is_chroma[i] || ctx->chroma_factor == CFACTOR_Y444) { xp = x << 4; yp = y << 4; num_cblocks[i] = 4; pwidth = avctx->width; } else { xp = x << 3; yp = y << 4; num_cblocks[i] = 2; pwidth = avctx->width >> 1; } src = (const uint16_t*)(pic->data[i] + yp * pic->linesize[i]) + xp; get_slice_data(ctx, src, pic->linesize[i], xp, yp, pwidth, avctx->height, ctx->blocks[i], mbs_per_slice, num_cblocks[i]); } for (q = min_quant; q <= max_quant; q++) { ctx->nodes[trellis_node + q].prev_node = -1; ctx->nodes[trellis_node + q].quant = q; } // todo: maybe perform coarser quantising to fit into frame size when needed for (q = min_quant; q <= max_quant; q++) { bits = 0; error = 0; for (i = 0; i < ctx->num_planes; i++) { bits += estimate_slice_plane(ctx, &error, i, src, pic->linesize[i], mbs_per_slice, num_cblocks[i], plane_factor[i], ctx->quants[q]); } if (bits > 65000 * 8) { error = SCORE_LIMIT; break; } slice_bits[q] = bits; slice_score[q] = error; } bits_limit = mbs * ctx->bits_per_mb; for (pq = min_quant; pq <= max_quant; pq++) { prev = trellis_node - TRELLIS_WIDTH + pq; for (q = min_quant; q <= max_quant; q++) { cur = trellis_node + q; bits = ctx->nodes[prev].bits + slice_bits[q]; error = slice_score[q]; if (bits > bits_limit) error = SCORE_LIMIT; if (ctx->nodes[prev].score < SCORE_LIMIT && error < SCORE_LIMIT) new_score = ctx->nodes[prev].score + error; else new_score = SCORE_LIMIT; if (ctx->nodes[cur].prev_node == -1 || ctx->nodes[cur].score >= new_score) { ctx->nodes[cur].bits = bits; ctx->nodes[cur].score = new_score; ctx->nodes[cur].prev_node = prev; } } } error = ctx->nodes[trellis_node + min_quant].score; pq = trellis_node + min_quant; for (q = min_quant + 1; q <= max_quant; q++) { if (ctx->nodes[trellis_node + q].score <= error) { error = ctx->nodes[trellis_node + q].score; pq = trellis_node + q; } } return pq; }","No, it is non-vulnerable."10221020,"static int discard_single_l2(BlockDriverState *bs, uint64_t offset, uint64_t nb_clusters, enum qcow2_discard_type type, bool full_discard) { BDRVQcow2State *s = bs->opaque; uint64_t *l2_table; int l2_index; int ret; int i; ret = get_cluster_table(bs, offset, &l2_table, &l2_index); if (ret < 0) { return ret; } /* Limit nb_clusters to one L2 table */ nb_clusters = MIN(nb_clusters, s->l2_size - l2_index); assert(nb_clusters <= INT_MAX); for (i = 0; i < nb_clusters; i++) { uint64_t old_l2_entry; old_l2_entry = be64_to_cpu(l2_table[l2_index + i]); /* * If full_discard is false, make sure that a discarded area reads back * as zeroes for v3 images (we cannot do it for v2 without actually * writing a zero-filled buffer). We can skip the operation if the * cluster is already marked as zero, or if it's unallocated and we * don't have a backing file. * * TODO We might want to use bdrv_get_block_status(bs) here, but we're * holding s->lock, so that doesn't work today. * * If full_discard is true, the sector should not read back as zeroes, * but rather fall through to the backing file. */ switch (qcow2_get_cluster_type(old_l2_entry)) { case QCOW2_CLUSTER_UNALLOCATED: if (full_discard || !bs->backing) { continue; } break; case QCOW2_CLUSTER_ZERO_PLAIN: if (!full_discard) { continue; } break; case QCOW2_CLUSTER_ZERO_ALLOC: case QCOW2_CLUSTER_NORMAL: case QCOW2_CLUSTER_COMPRESSED: break; default: abort(); } /* First remove L2 entries */ qcow2_cache_entry_mark_dirty(bs, s->l2_table_cache, l2_table); if (!full_discard && s->qcow_version >= 3) { l2_table[l2_index + i] = cpu_to_be64(QCOW_OFLAG_ZERO); } else { l2_table[l2_index + i] = cpu_to_be64(0); } /* Then decrease the refcount */ qcow2_free_any_clusters(bs, old_l2_entry, 1, type); } qcow2_cache_put(bs, s->l2_table_cache, (void **) &l2_table); return nb_clusters; }","No, it is non-vulnerable."10231021,"static int alac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame_ptr, AVPacket *avpkt) { ALACContext *alac = avctx->priv_data; enum RawDataBlockType element; int channels; int ch, ret, got_end; init_get_bits(&alac->gb, avpkt->data, avpkt->size * 8); got_end = 0; alac->nb_samples = 0; ch = 0; while (get_bits_left(&alac->gb) >= 3) { element = get_bits(&alac->gb, 3); if (element == TYPE_END) { got_end = 1; break; } if (element > TYPE_CPE && element != TYPE_LFE) { av_log(avctx, AV_LOG_ERROR, ""syntax element unsupported: %d\n"", element); return AVERROR_PATCHWELCOME; } channels = (element == TYPE_CPE) ? 2 : 1; if (ch + channels > alac->channels) { av_log(avctx, AV_LOG_ERROR, ""invalid element channel count\n""); return AVERROR_INVALIDDATA; } ret = decode_element(avctx, data, alac_channel_layout_offsets[alac->channels - 1][ch], channels); if (ret < 0 && get_bits_left(&alac->gb)) return ret; ch += channels; } if (!got_end) { av_log(avctx, AV_LOG_ERROR, ""no end tag found. incomplete packet.\n""); return AVERROR_INVALIDDATA; } if (avpkt->size * 8 - get_bits_count(&alac->gb) > 8) { av_log(avctx, AV_LOG_ERROR, ""Error : %d bits left\n"", avpkt->size * 8 - get_bits_count(&alac->gb)); } *got_frame_ptr = 1; *(AVFrame *)data = alac->frame; return avpkt->size; }","No, it is non-vulnerable."10241022,"static void g364fb_init(DeviceState *dev, G364State *s) { s->vram = g_malloc0(s->vram_size); s->con = graphic_console_init(g364fb_update_display, g364fb_invalidate_display, g364fb_screen_dump, NULL, s); memory_region_init_io(&s->mem_ctrl, &g364fb_ctrl_ops, s, ""ctrl"", 0x180000); memory_region_init_ram_ptr(&s->mem_vram, ""vram"", s->vram_size, s->vram); vmstate_register_ram(&s->mem_vram, dev); memory_region_set_coalescing(&s->mem_vram); }","No, it is non-vulnerable."10251023,"static void ppc_prep_init (int ram_size, int vga_ram_size, const char *boot_device, DisplayState *ds, const char **fd_filename, int snapshot, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model) { CPUState *env, *envs[MAX_CPUS]; char buf[1024]; nvram_t nvram; m48t59_t *m48t59; int PPC_io_memory; int linux_boot, i, nb_nics1, bios_size; unsigned long bios_offset; uint32_t kernel_base, kernel_size, initrd_base, initrd_size; PCIBus *pci_bus; qemu_irq *i8259; int ppc_boot_device = boot_device[0]; sysctrl = qemu_mallocz(sizeof(sysctrl_t)); if (sysctrl == NULL) return; linux_boot = (kernel_filename != NULL); /* init CPUs */ if (cpu_model == NULL) cpu_model = ""default""; for (i = 0; i < smp_cpus; i++) { env = cpu_init(cpu_model); if (!env) { fprintf(stderr, ""Unable to find PowerPC CPU definition\n""); exit(1); } /* Set time-base frequency to 100 Mhz */ cpu_ppc_tb_init(env, 100UL * 1000UL * 1000UL); qemu_register_reset(&cpu_ppc_reset, env); register_savevm(""cpu"", 0, 3, cpu_save, cpu_load, env); envs[i] = env; } /* allocate RAM */ cpu_register_physical_memory(0, ram_size, IO_MEM_RAM); /* allocate and load BIOS */ bios_offset = ram_size + vga_ram_size; if (bios_name == NULL) bios_name = BIOS_FILENAME; snprintf(buf, sizeof(buf), ""%s/%s"", bios_dir, bios_name); bios_size = load_image(buf, phys_ram_base + bios_offset); if (bios_size < 0 || bios_size > BIOS_SIZE) { cpu_abort(env, ""qemu: could not load PPC PREP bios '%s'\n"", buf); exit(1); } if (env->nip < 0xFFF80000 && bios_size < 0x00100000) { cpu_abort(env, ""PowerPC 601 / 620 / 970 need a 1MB BIOS\n""); } bios_size = (bios_size + 0xfff) & ~0xfff; cpu_register_physical_memory((uint32_t)(-bios_size), bios_size, bios_offset | IO_MEM_ROM); if (linux_boot) { kernel_base = KERNEL_LOAD_ADDR; /* now we can load the kernel */ kernel_size = load_image(kernel_filename, phys_ram_base + kernel_base); if (kernel_size < 0) { cpu_abort(env, ""qemu: could not load kernel '%s'\n"", kernel_filename); exit(1); } /* load initrd */ if (initrd_filename) { initrd_base = INITRD_LOAD_ADDR; initrd_size = load_image(initrd_filename, phys_ram_base + initrd_base); if (initrd_size < 0) { cpu_abort(env, ""qemu: could not load initial ram disk '%s'\n"", initrd_filename); exit(1); } } else { initrd_base = 0; initrd_size = 0; } ppc_boot_device = 'm'; } else { kernel_base = 0; kernel_size = 0; initrd_base = 0; initrd_size = 0; } isa_mem_base = 0xc0000000; if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) { cpu_abort(env, ""Only 6xx bus is supported on PREP machine\n""); exit(1); } i8259 = i8259_init(first_cpu->irq_inputs[PPC6xx_INPUT_INT]); pci_bus = pci_prep_init(i8259); // pci_bus = i440fx_init(); /* Register 8 MB of ISA IO space (needed for non-contiguous map) */ PPC_io_memory = cpu_register_io_memory(0, PPC_prep_io_read, PPC_prep_io_write, sysctrl); cpu_register_physical_memory(0x80000000, 0x00800000, PPC_io_memory); /* init basic PC hardware */ pci_vga_init(pci_bus, ds, phys_ram_base + ram_size, ram_size, vga_ram_size, 0, 0); // openpic = openpic_init(0x00000000, 0xF0000000, 1); // pit = pit_init(0x40, i8259[0]); rtc_init(0x70, i8259[8]); serial_init(0x3f8, i8259[4], serial_hds[0]); nb_nics1 = nb_nics; if (nb_nics1 > NE2000_NB_MAX) nb_nics1 = NE2000_NB_MAX; for(i = 0; i < nb_nics1; i++) { if (nd_table[i].model == NULL || strcmp(nd_table[i].model, ""ne2k_isa"") == 0) { isa_ne2000_init(ne2000_io[i], i8259[ne2000_irq[i]], &nd_table[i]); } else { pci_nic_init(pci_bus, &nd_table[i], -1); } } for(i = 0; i < 2; i++) { isa_ide_init(ide_iobase[i], ide_iobase2[i], i8259[ide_irq[i]], bs_table[2 * i], bs_table[2 * i + 1]); } i8042_init(i8259[1], i8259[12], 0x60); DMA_init(1); // AUD_init(); // SB16_init(); fdctrl_init(i8259[6], 2, 0, 0x3f0, fd_table); /* Register speaker port */ register_ioport_read(0x61, 1, 1, speaker_ioport_read, NULL); register_ioport_write(0x61, 1, 1, speaker_ioport_write, NULL); /* Register fake IO ports for PREP */ sysctrl->reset_irq = first_cpu->irq_inputs[PPC6xx_INPUT_HRESET]; register_ioport_read(0x398, 2, 1, &PREP_io_read, sysctrl); register_ioport_write(0x398, 2, 1, &PREP_io_write, sysctrl); /* System control ports */ register_ioport_read(0x0092, 0x01, 1, &PREP_io_800_readb, sysctrl); register_ioport_write(0x0092, 0x01, 1, &PREP_io_800_writeb, sysctrl); register_ioport_read(0x0800, 0x52, 1, &PREP_io_800_readb, sysctrl); register_ioport_write(0x0800, 0x52, 1, &PREP_io_800_writeb, sysctrl); /* PCI intack location */ PPC_io_memory = cpu_register_io_memory(0, PPC_intack_read, PPC_intack_write, NULL); cpu_register_physical_memory(0xBFFFFFF0, 0x4, PPC_io_memory); /* PowerPC control and status register group */ #if 0 PPC_io_memory = cpu_register_io_memory(0, PPC_XCSR_read, PPC_XCSR_write, NULL); cpu_register_physical_memory(0xFEFF0000, 0x1000, PPC_io_memory); #endif if (usb_enabled) { usb_ohci_init_pci(pci_bus, 3, -1); } m48t59 = m48t59_init(i8259[8], 0, 0x0074, NVRAM_SIZE, 59); if (m48t59 == NULL) return; sysctrl->nvram = m48t59; /* Initialise NVRAM */ nvram.opaque = m48t59; nvram.read_fn = &m48t59_read; nvram.write_fn = &m48t59_write; PPC_NVRAM_set_params(&nvram, NVRAM_SIZE, ""PREP"", ram_size, ppc_boot_device, kernel_base, kernel_size, kernel_cmdline, initrd_base, initrd_size, /* XXX: need an option to load a NVRAM image */ 0, graphic_width, graphic_height, graphic_depth); /* Special port to get debug messages from Open-Firmware */ register_ioport_write(0x0F00, 4, 1, &PPC_debug_write, NULL); }","No, it is non-vulnerable."10261024,"void helper_xssqrtqp(CPUPPCState *env, uint32_t opcode) { ppc_vsr_t xb; ppc_vsr_t xt; float_status tstat; getVSR(rB(opcode) + 32, &xb, env); memset(&xt, 0, sizeof(xt)); helper_reset_fpstatus(env); if (unlikely(Rc(opcode) != 0)) { /* TODO: Support xsadddpo after round-to-odd is implemented */ abort(); } tstat = env->fp_status; set_float_exception_flags(0, &tstat); xt.f128 = float128_sqrt(xb.f128, &tstat); env->fp_status.float_exception_flags |= tstat.float_exception_flags; if (unlikely(tstat.float_exception_flags & float_flag_invalid)) { if (float128_is_signaling_nan(xb.f128, &tstat)) { float_invalid_op_excp(env, POWERPC_EXCP_FP_VXSNAN, 1); xt.f128 = float128_snan_to_qnan(xb.f128); } else if (float128_is_quiet_nan(xb.f128, &tstat)) { xt.f128 = xb.f128; } else if (float128_is_neg(xb.f128) && !float128_is_zero(xb.f128)) { float_invalid_op_excp(env, POWERPC_EXCP_FP_VXSQRT, 1); set_snan_bit_is_one(0, &env->fp_status); xt.f128 = float128_default_nan(&env->fp_status); } } helper_compute_fprf_float128(env, xt.f128); putVSR(rD(opcode) + 32, &xt, env); float_check_status(env); }","No, it is non-vulnerable."10271025,"static int is_dup_page(uint8_t *page, uint8_t ch) { uint32_t val = ch << 24 | ch << 16 | ch << 8 | ch; uint32_t *array = (uint32_t *)page; int i; for (i = 0; i < (TARGET_PAGE_SIZE / 4); i++) { if (array[i] != val) return 0; } return 1; }","No, it is non-vulnerable."10281026,"void qxl_log_command(PCIQXLDevice *qxl, const char *ring, QXLCommandExt *ext) { bool compat = ext->flags & QXL_COMMAND_FLAG_COMPAT; void *data; if (!qxl->cmdlog) { return; } fprintf(stderr, ""%"" PRId64 "" qxl-%d/%s:"", qemu_get_clock_ns(vm_clock), qxl->id, ring); fprintf(stderr, "" cmd @ 0x%"" PRIx64 "" %s%s"", ext->cmd.data, qxl_name(qxl_type, ext->cmd.type), compat ? ""(compat)"" : """"); data = qxl_phys2virt(qxl, ext->cmd.data, ext->group_id); switch (ext->cmd.type) { case QXL_CMD_DRAW: if (!compat) { qxl_log_cmd_draw(qxl, data, ext->group_id); } else { qxl_log_cmd_draw_compat(qxl, data, ext->group_id); } break; case QXL_CMD_SURFACE: qxl_log_cmd_surface(qxl, data); break; case QXL_CMD_CURSOR: qxl_log_cmd_cursor(qxl, data, ext->group_id); break; } fprintf(stderr, ""\n""); }","No, it is non-vulnerable."10291027,int vnc_display_disable_login(DisplayState *ds) { VncDisplay *vs = ds ? (VncDisplay *)ds->opaque : vnc_display; if (!vs) { return -1; } if (vs->password) { g_free(vs->password); } vs->password = NULL; vs->auth = VNC_AUTH_VNC; return 0; },"No, it is non-vulnerable."10301028,"static void read_storage_element0_info(SCLPDevice *sclp, SCCB *sccb) { int i, assigned; int subincrement_id = SCLP_STARTING_SUBINCREMENT_ID; ReadStorageElementInfo *storage_info = (ReadStorageElementInfo *) sccb; sclpMemoryHotplugDev *mhd = get_sclp_memory_hotplug_dev(); assert(mhd); if ((ram_size >> mhd->increment_size) >= 0x10000) { sccb->h.response_code = cpu_to_be16(SCLP_RC_SCCB_BOUNDARY_VIOLATION); return; } /* Return information regarding core memory */ storage_info->max_id = cpu_to_be16(mhd->standby_mem_size ? 1 : 0); assigned = ram_size >> mhd->increment_size; storage_info->assigned = cpu_to_be16(assigned); for (i = 0; i < assigned; i++) { storage_info->entries[i] = cpu_to_be32(subincrement_id); subincrement_id += SCLP_INCREMENT_UNIT; } sccb->h.response_code = cpu_to_be16(SCLP_RC_NORMAL_READ_COMPLETION); }","No, it is non-vulnerable."10311029,"void net_rx_pkt_attach_data(struct NetRxPkt *pkt, const void *data, size_t len, bool strip_vlan) { uint16_t tci = 0; uint16_t ploff; assert(pkt); pkt->vlan_stripped = false; if (strip_vlan) { pkt->vlan_stripped = eth_strip_vlan(data, pkt->ehdr_buf, &ploff, &tci); } if (pkt->vlan_stripped) { pkt->vec[0].iov_base = pkt->ehdr_buf; pkt->vec[0].iov_len = ploff - sizeof(struct vlan_header); pkt->vec[1].iov_base = (uint8_t *) data + ploff; pkt->vec[1].iov_len = len - ploff; pkt->vec_len = 2; pkt->tot_len = len - ploff + sizeof(struct eth_header); } else { pkt->vec[0].iov_base = (void *)data; pkt->vec[0].iov_len = len; pkt->vec_len = 1; pkt->tot_len = len; } pkt->tci = tci; }","No, it is non-vulnerable."10321030,"static int subpage_register (subpage_t *mmio, uint32_t start, uint32_t end, ram_addr_t memory, ram_addr_t region_offset) { int idx, eidx; if (start >= TARGET_PAGE_SIZE || end >= TARGET_PAGE_SIZE) return -1; idx = SUBPAGE_IDX(start); eidx = SUBPAGE_IDX(end); #if defined(DEBUG_SUBPAGE) printf(""%s: %p start %08x end %08x idx %08x eidx %08x mem %ld\n"", __func__, mmio, start, end, idx, eidx, memory); #endif memory = (memory >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1); for (; idx <= eidx; idx++) { mmio->sub_io_index[idx] = memory; mmio->region_offset[idx] = region_offset; } return 0; }","Yes, it is vulnerable."10331031,"static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo) { void *fdt = NULL; int size, rc; uint32_t acells, scells; if (binfo->dtb_filename) { char *filename; filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename); if (!filename) { fprintf(stderr, ""Couldn't open dtb file %s\n"", binfo->dtb_filename); goto fail; } fdt = load_device_tree(filename, &size); if (!fdt) { fprintf(stderr, ""Couldn't open dtb file %s\n"", filename); g_free(filename); goto fail; } g_free(filename); } else if (binfo->get_dtb) { fdt = binfo->get_dtb(binfo, &size); if (!fdt) { fprintf(stderr, ""Board was unable to create a dtb blob\n""); goto fail; } } acells = qemu_fdt_getprop_cell(fdt, ""/"", ""#address-cells""); scells = qemu_fdt_getprop_cell(fdt, ""/"", ""#size-cells""); if (acells == 0 || scells == 0) { fprintf(stderr, ""dtb file invalid (#address-cells or #size-cells 0)\n""); goto fail; } if (scells < 2 && binfo->ram_size >= (1ULL << 32)) { /* This is user error so deserves a friendlier error message * than the failure of setprop_sized_cells would provide */ fprintf(stderr, ""qemu: dtb file not compatible with "" ""RAM size > 4GB\n""); goto fail; } rc = qemu_fdt_setprop_sized_cells(fdt, ""/memory"", ""reg"", acells, binfo->loader_start, scells, binfo->ram_size); if (rc < 0) { fprintf(stderr, ""couldn't set /memory/reg\n""); goto fail; } if (binfo->kernel_cmdline && *binfo->kernel_cmdline) { rc = qemu_fdt_setprop_string(fdt, ""/chosen"", ""bootargs"", binfo->kernel_cmdline); if (rc < 0) { fprintf(stderr, ""couldn't set /chosen/bootargs\n""); goto fail; } } if (binfo->initrd_size) { rc = qemu_fdt_setprop_cell(fdt, ""/chosen"", ""linux,initrd-start"", binfo->initrd_start); if (rc < 0) { fprintf(stderr, ""couldn't set /chosen/linux,initrd-start\n""); goto fail; } rc = qemu_fdt_setprop_cell(fdt, ""/chosen"", ""linux,initrd-end"", binfo->initrd_start + binfo->initrd_size); if (rc < 0) { fprintf(stderr, ""couldn't set /chosen/linux,initrd-end\n""); goto fail; } } if (binfo->modify_dtb) { binfo->modify_dtb(binfo, fdt); } qemu_fdt_dumpdtb(fdt, size); /* Put the DTB into the memory map as a ROM image: this will ensure * the DTB is copied again upon reset, even if addr points into RAM. */ rom_add_blob_fixed(""dtb"", fdt, size, addr); g_free(fdt); return 0; fail: g_free(fdt); return -1; }","No, it is non-vulnerable."10341032,"static void onenand_write(void *opaque, hwaddr addr, uint64_t value, unsigned size) { OneNANDState *s = (OneNANDState *) opaque; int offset = addr >> s->shift; int sec; switch (offset) { case 0x0000 ... 0x01ff: case 0x8000 ... 0x800f: if (s->cycle) { s->cycle = 0; if (value == 0x0000) { SETADDR(ONEN_BUF_BLOCK, ONEN_BUF_PAGE) onenand_load_main(s, sec, 1 << (PAGE_SHIFT - 9), s->data[0][0]); s->addr[ONEN_BUF_PAGE] += 4; s->addr[ONEN_BUF_PAGE] &= 0xff; } break; } switch (value) { case 0x00f0: /* Reset OneNAND */ onenand_reset(s, 0); break; case 0x00e0: /* Load Data into Buffer */ s->cycle = 1; break; case 0x0090: /* Read Identification Data */ memset(s->boot[0], 0, 3 << s->shift); s->boot[0][0 << s->shift] = s->id.man & 0xff; s->boot[0][1 << s->shift] = s->id.dev & 0xff; s->boot[0][2 << s->shift] = s->wpstatus & 0xff; break; default: fprintf(stderr, ""%s: unknown OneNAND boot command %""PRIx64""\n"", __FUNCTION__, value); } break; case 0xf100 ... 0xf107: /* Start addresses */ s->addr[offset - 0xf100] = value; break; case 0xf200: /* Start buffer */ s->bufaddr = (value >> 8) & 0xf; if (PAGE_SHIFT == 11) s->count = (value & 3) ?: 4; else if (PAGE_SHIFT == 10) s->count = (value & 1) ?: 2; break; case 0xf220: /* Command */ if (s->intstatus & (1 << 15)) break; s->command = value; onenand_command(s); break; case 0xf221: /* System Configuration 1 */ s->config[0] = value; onenand_intr_update(s); qemu_set_irq(s->rdy, (s->config[0] >> 7) & 1); break; case 0xf222: /* System Configuration 2 */ s->config[1] = value; break; case 0xf241: /* Interrupt */ s->intstatus &= value; if ((1 << 15) & ~s->intstatus) s->status &= ~(ONEN_ERR_CMD | ONEN_ERR_ERASE | ONEN_ERR_PROG | ONEN_ERR_LOAD); onenand_intr_update(s); break; case 0xf24c: /* Unlock Start Block Address */ s->unladdr[0] = value & (s->blocks - 1); /* For some reason we have to set the end address to by default * be same as start because the software forgets to write anything * in there. */ s->unladdr[1] = value & (s->blocks - 1); break; case 0xf24d: /* Unlock End Block Address */ s->unladdr[1] = value & (s->blocks - 1); break; default: fprintf(stderr, ""%s: unknown OneNAND register %x\n"", __FUNCTION__, offset); } }","No, it is non-vulnerable."10351033,"static void qmp_output_type_null(Visitor *v, const char *name, Error **errp) { QmpOutputVisitor *qov = to_qov(v); qmp_output_add_obj(qov, name, qnull()); }","No, it is non-vulnerable."10361034,"static void xhci_child_detach(USBPort *uport, USBDevice *child) { USBBus *bus = usb_bus_from_device(child); XHCIState *xhci = container_of(bus, XHCIState, bus); xhci_detach_slot(xhci, uport); }","No, it is non-vulnerable."10371035,PPC_OP(addme) { T1 = T0; T0 += xer_ca + (-1); if (T1 != 0) xer_ca = 1; RETURN(); },"Yes, it is vulnerable."10381036,"static bool liveness_pass_2(TCGContext *s) { int nb_globals = s->nb_globals; int nb_temps, i, oi, oi_next; bool changes = false; /* Create a temporary for each indirect global. */ for (i = 0; i < nb_globals; ++i) { TCGTemp *its = &s->temps[i]; if (its->indirect_reg) { TCGTemp *dts = tcg_temp_alloc(s); dts->type = its->type; dts->base_type = its->base_type; its->state_ptr = dts; } else { its->state_ptr = NULL; } /* All globals begin dead. */ its->state = TS_DEAD; } for (nb_temps = s->nb_temps; i < nb_temps; ++i) { TCGTemp *its = &s->temps[i]; its->state_ptr = NULL; its->state = TS_DEAD; } for (oi = s->gen_op_buf[0].next; oi != 0; oi = oi_next) { TCGOp *op = &s->gen_op_buf[oi]; TCGOpcode opc = op->opc; const TCGOpDef *def = &tcg_op_defs[opc]; TCGLifeData arg_life = op->life; int nb_iargs, nb_oargs, call_flags; TCGTemp *arg_ts, *dir_ts; oi_next = op->next; if (opc == INDEX_op_call) { nb_oargs = op->callo; nb_iargs = op->calli; call_flags = op->args[nb_oargs + nb_iargs + 1]; } else { nb_iargs = def->nb_iargs; nb_oargs = def->nb_oargs; /* Set flags similar to how calls require. */ if (def->flags & TCG_OPF_BB_END) { /* Like writing globals: save_globals */ call_flags = 0; } else if (def->flags & TCG_OPF_SIDE_EFFECTS) { /* Like reading globals: sync_globals */ call_flags = TCG_CALL_NO_WRITE_GLOBALS; } else { /* No effect on globals. */ call_flags = (TCG_CALL_NO_READ_GLOBALS | TCG_CALL_NO_WRITE_GLOBALS); } } /* Make sure that input arguments are available. */ for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) { arg_ts = arg_temp(op->args[i]); if (arg_ts) { dir_ts = arg_ts->state_ptr; if (dir_ts && arg_ts->state == TS_DEAD) { TCGOpcode lopc = (arg_ts->type == TCG_TYPE_I32 ? INDEX_op_ld_i32 : INDEX_op_ld_i64); TCGOp *lop = tcg_op_insert_before(s, op, lopc, 3); lop->args[0] = temp_arg(dir_ts); lop->args[1] = temp_arg(arg_ts->mem_base); lop->args[2] = arg_ts->mem_offset; /* Loaded, but synced with memory. */ arg_ts->state = TS_MEM; } } } /* Perform input replacement, and mark inputs that became dead. No action is required except keeping temp_state up to date so that we reload when needed. */ for (i = nb_oargs; i < nb_iargs + nb_oargs; i++) { arg_ts = arg_temp(op->args[i]); if (arg_ts) { dir_ts = arg_ts->state_ptr; if (dir_ts) { op->args[i] = temp_arg(dir_ts); changes = true; if (IS_DEAD_ARG(i)) { arg_ts->state = TS_DEAD; } } } } /* Liveness analysis should ensure that the following are all correct, for call sites and basic block end points. */ if (call_flags & TCG_CALL_NO_READ_GLOBALS) { /* Nothing to do */ } else if (call_flags & TCG_CALL_NO_WRITE_GLOBALS) { for (i = 0; i < nb_globals; ++i) { /* Liveness should see that globals are synced back, that is, either TS_DEAD or TS_MEM. */ arg_ts = &s->temps[i]; tcg_debug_assert(arg_ts->state_ptr == 0 || arg_ts->state != 0); } } else { for (i = 0; i < nb_globals; ++i) { /* Liveness should see that globals are saved back, that is, TS_DEAD, waiting to be reloaded. */ arg_ts = &s->temps[i]; tcg_debug_assert(arg_ts->state_ptr == 0 || arg_ts->state == TS_DEAD); } } /* Outputs become available. */ for (i = 0; i < nb_oargs; i++) { arg_ts = arg_temp(op->args[i]); dir_ts = arg_ts->state_ptr; if (!dir_ts) { continue; } op->args[i] = temp_arg(dir_ts); changes = true; /* The output is now live and modified. */ arg_ts->state = 0; /* Sync outputs upon their last write. */ if (NEED_SYNC_ARG(i)) { TCGOpcode sopc = (arg_ts->type == TCG_TYPE_I32 ? INDEX_op_st_i32 : INDEX_op_st_i64); TCGOp *sop = tcg_op_insert_after(s, op, sopc, 3); sop->args[0] = temp_arg(dir_ts); sop->args[1] = temp_arg(arg_ts->mem_base); sop->args[2] = arg_ts->mem_offset; arg_ts->state = TS_MEM; } /* Drop outputs that are dead. */ if (IS_DEAD_ARG(i)) { arg_ts->state = TS_DEAD; } } } return changes; }","Yes, it is vulnerable."10391037,"static void update_stream_timings(AVFormatContext *ic) { int64_t start_time, start_time1, start_time_text, end_time, end_time1; int64_t duration, duration1, filesize; int i; AVStream *st; AVProgram *p; start_time = INT64_MAX; start_time_text = INT64_MAX; end_time = INT64_MIN; duration = INT64_MIN; for (i = 0; i < ic->nb_streams; i++) { st = ic->streams[i]; if (st->start_time != AV_NOPTS_VALUE && st->time_base.den) { start_time1 = av_rescale_q(st->start_time, st->time_base, AV_TIME_BASE_Q); if (st->codec->codec_type == AVMEDIA_TYPE_SUBTITLE || st->codec->codec_type == AVMEDIA_TYPE_DATA) { if (start_time1 < start_time_text) start_time_text = start_time1; } else start_time = FFMIN(start_time, start_time1); end_time1 = AV_NOPTS_VALUE; if (st->duration != AV_NOPTS_VALUE) { end_time1 = start_time1 + av_rescale_q(st->duration, st->time_base, AV_TIME_BASE_Q); end_time = FFMAX(end_time, end_time1); } for (p = NULL; (p = av_find_program_from_stream(ic, p, i)); ) { if (p->start_time == AV_NOPTS_VALUE || p->start_time > start_time1) p->start_time = start_time1; if (p->end_time < end_time1) p->end_time = end_time1; } } if (st->duration != AV_NOPTS_VALUE) { duration1 = av_rescale_q(st->duration, st->time_base, AV_TIME_BASE_Q); duration = FFMAX(duration, duration1); } } if (start_time == INT64_MAX || (start_time > start_time_text && start_time - start_time_text < AV_TIME_BASE)) start_time = start_time_text; else if (start_time > start_time_text) av_log(ic, AV_LOG_VERBOSE, ""Ignoring outlier non primary stream starttime %f\n"", start_time_text / (float)AV_TIME_BASE); if (start_time != INT64_MAX) { ic->start_time = start_time; if (end_time != INT64_MIN) { if (ic->nb_programs) { for (i = 0; i < ic->nb_programs; i++) { p = ic->programs[i]; if (p->start_time != AV_NOPTS_VALUE && p->end_time > p->start_time) duration = FFMAX(duration, p->end_time - p->start_time); } } else duration = FFMAX(duration, end_time - start_time); } } if (duration != INT64_MIN && duration > 0 && ic->duration == AV_NOPTS_VALUE) { ic->duration = duration; } if (ic->pb && (filesize = avio_size(ic->pb)) > 0 && ic->duration != AV_NOPTS_VALUE) { /* compute the bitrate */ double bitrate = (double) filesize * 8.0 * AV_TIME_BASE / (double) ic->duration; if (bitrate >= 0 && (!AV_HAVE_INCOMPATIBLE_LIBAV_ABI || bitrate <= INT_MAX)) ic->bit_rate = bitrate; } }","No, it is non-vulnerable."10401038,"GuestMemoryBlockInfo *qmp_guest_get_memory_block_info(Error **errp) { Error *local_err = NULL; char *dirpath; int dirfd; char *buf; GuestMemoryBlockInfo *info; dirpath = g_strdup_printf(""/sys/devices/system/memory/""); dirfd = open(dirpath, O_RDONLY | O_DIRECTORY); if (dirfd == -1) { error_setg_errno(errp, errno, ""open(\""%s\"")"", dirpath); g_free(dirpath); return NULL; } g_free(dirpath); buf = g_malloc0(20); ga_read_sysfs_file(dirfd, ""block_size_bytes"", buf, 20, &local_err); if (local_err) { g_free(buf); error_propagate(errp, local_err); return NULL; } info = g_new0(GuestMemoryBlockInfo, 1); info->size = strtol(buf, NULL, 16); /* the unit is bytes */ g_free(buf); return info; }","Yes, it is vulnerable."10411039,"AVInputFormat *av_probe_input_format3(AVProbeData *pd, int is_opened, int *score_ret) { AVProbeData lpd = *pd; AVInputFormat *fmt1 = NULL, *fmt; int score, nodat = 0, score_max = 0; const static uint8_t zerobuffer[AVPROBE_PADDING_SIZE]; if (!lpd.buf) lpd.buf = zerobuffer; if (lpd.buf_size > 10 && ff_id3v2_match(lpd.buf, ID3v2_DEFAULT_MAGIC)) { int id3len = ff_id3v2_tag_len(lpd.buf); if (lpd.buf_size > id3len + 16) { lpd.buf += id3len; lpd.buf_size -= id3len; } else nodat = 1; } fmt = NULL; while ((fmt1 = av_iformat_next(fmt1))) { if (!is_opened == !(fmt1->flags & AVFMT_NOFILE)) continue; score = 0; if (fmt1->read_probe) { score = fmt1->read_probe(&lpd); if (fmt1->extensions && av_match_ext(lpd.filename, fmt1->extensions)) score = FFMAX(score, nodat ? AVPROBE_SCORE_EXTENSION / 2 - 1 : 1); } else if (fmt1->extensions) { if (av_match_ext(lpd.filename, fmt1->extensions)) score = AVPROBE_SCORE_EXTENSION; } if (score > score_max) { score_max = score; fmt = fmt1; } else if (score == score_max) fmt = NULL; } if (nodat) score_max = FFMIN(AVPROBE_SCORE_EXTENSION / 2 - 1, score_max); *score_ret = score_max; return fmt; }","No, it is non-vulnerable."10421040,"static int virtio_balloon_init_pci(PCIDevice *pci_dev) { VirtIOPCIProxy *proxy = DO_UPCAST(VirtIOPCIProxy, pci_dev, pci_dev); VirtIODevice *vdev; vdev = virtio_balloon_init(&pci_dev->qdev); virtio_init_pci(proxy, vdev); return 0;","Yes, it is vulnerable."10431041,"static target_ulong h_client_architecture_support(PowerPCCPU *cpu_, sPAPRMachineState *spapr, target_ulong opcode, target_ulong *args) { target_ulong list = ppc64_phys_to_real(args[0]); target_ulong ov_table; PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu_); CPUState *cs; bool cpu_match = false, cpu_update = true; unsigned old_cpu_version = cpu_->cpu_version; unsigned compat_lvl = 0, cpu_version = 0; unsigned max_lvl = get_compat_level(cpu_->max_compat); int counter; sPAPROptionVector *ov5_guest; /* Parse PVR list */ for (counter = 0; counter < 512; ++counter) { uint32_t pvr, pvr_mask; pvr_mask = ldl_be_phys(&address_space_memory, list); list += 4; pvr = ldl_be_phys(&address_space_memory, list); list += 4; trace_spapr_cas_pvr_try(pvr); if (!max_lvl && ((cpu_->env.spr[SPR_PVR] & pvr_mask) == (pvr & pvr_mask))) { cpu_match = true; cpu_version = 0; } else if (pvr == cpu_->cpu_version) { cpu_match = true; cpu_version = cpu_->cpu_version; } else if (!cpu_match) { cas_handle_compat_cpu(pcc, pvr, max_lvl, &compat_lvl, &cpu_version); } /* Terminator record */ if (~pvr_mask & pvr) { break; } } /* Parsing finished */ trace_spapr_cas_pvr(cpu_->cpu_version, cpu_match, cpu_version, pcc->pcr_mask); /* Update CPUs */ if (old_cpu_version != cpu_version) { CPU_FOREACH(cs) { SetCompatState s = { .cpu_version = cpu_version, .err = NULL, }; run_on_cpu(cs, do_set_compat, &s); if (s.err) { error_report_err(s.err); return H_HARDWARE; } } } if (!cpu_version) { cpu_update = false; } /* For the future use: here @ov_table points to the first option vector */ ov_table = list; ov5_guest = spapr_ovec_parse_vector(ov_table, 5); /* NOTE: there are actually a number of ov5 bits where input from the * guest is always zero, and the platform/QEMU enables them independently * of guest input. To model these properly we'd want some sort of mask, * but since they only currently apply to memory migration as defined * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need * to worry about this. */ spapr_ovec_intersect(spapr->ov5_cas, spapr->ov5, ov5_guest); spapr_ovec_cleanup(ov5_guest); if (spapr_h_cas_compose_response(spapr, args[1], args[2], cpu_update)) { qemu_system_reset_request(); } return H_SUCCESS; }","Yes, it is vulnerable."10441042,"int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int bytes) { NBDClientSession *client = nbd_get_client_session(bs); NBDRequest request = { .type = NBD_CMD_TRIM, .from = offset, .len = bytes, }; if (!(client->info.flags & NBD_FLAG_SEND_TRIM)) { return 0; } return nbd_co_request(bs, &request, NULL); }","Yes, it is vulnerable."10451043,"static int rv34_decode_macroblock(RV34DecContext *r, int8_t *intra_types) { MpegEncContext *s = &r->s; GetBitContext *gb = &s->gb; int cbp, cbp2; int i, blknum, blkoff; DCTELEM block16[64]; int luma_dc_quant; int dist; int mb_pos = s->mb_x + s->mb_y * s->mb_stride; // Calculate which neighbours are available. Maybe it's worth optimizing too. memset(r->avail_cache, 0, sizeof(r->avail_cache)); fill_rectangle(r->avail_cache + 5, 2, 2, 4, 1, 4); dist = (s->mb_x - s->resync_mb_x) + (s->mb_y - s->resync_mb_y) * s->mb_width; if(s->mb_x && dist) r->avail_cache[4] = r->avail_cache[8] = s->current_picture_ptr->mb_type[mb_pos - 1]; if(dist >= s->mb_width) r->avail_cache[1] = r->avail_cache[2] = s->current_picture_ptr->mb_type[mb_pos - s->mb_stride]; if(((s->mb_x+1) < s->mb_width) && dist >= s->mb_width - 1) r->avail_cache[3] = s->current_picture_ptr->mb_type[mb_pos - s->mb_stride + 1]; if(s->mb_x && dist > s->mb_width) r->avail_cache[0] = s->current_picture_ptr->mb_type[mb_pos - s->mb_stride - 1]; s->qscale = r->si.quant; cbp = cbp2 = rv34_decode_mb_header(r, intra_types); r->cbp_luma [s->mb_x + s->mb_y * s->mb_stride] = cbp; r->cbp_chroma[s->mb_x + s->mb_y * s->mb_stride] = cbp >> 16; if(s->pict_type == FF_I_TYPE) r->deblock_coefs[mb_pos] = 0; else r->deblock_coefs[mb_pos] = rv34_set_deblock_coef(r); s->current_picture_ptr->qscale_table[s->mb_x + s->mb_y * s->mb_stride] = s->qscale; if(cbp == -1) return -1; luma_dc_quant = r->block_type == RV34_MB_P_MIX16x16 ? r->luma_dc_quant_p[s->qscale] : r->luma_dc_quant_i[s->qscale]; if(r->is16){ memset(block16, 0, sizeof(block16)); rv34_decode_block(block16, gb, r->cur_vlcs, 3, 0); rv34_dequant4x4_16x16(block16, rv34_qscale_tab[luma_dc_quant],rv34_qscale_tab[s->qscale]); rv34_inv_transform_noround(block16); } for(i = 0; i < 16; i++, cbp >>= 1){ if(!r->is16 && !(cbp & 1)) continue; blknum = ((i & 2) >> 1) + ((i & 8) >> 2); blkoff = ((i & 1) << 2) + ((i & 4) << 3); if(cbp & 1) rv34_decode_block(s->block[blknum] + blkoff, gb, r->cur_vlcs, r->luma_vlc, 0); rv34_dequant4x4(s->block[blknum] + blkoff, rv34_qscale_tab[s->qscale],rv34_qscale_tab[s->qscale]); if(r->is16) //FIXME: optimize s->block[blknum][blkoff] = block16[(i & 3) | ((i & 0xC) << 1)]; rv34_inv_transform(s->block[blknum] + blkoff); } if(r->block_type == RV34_MB_P_MIX16x16) r->cur_vlcs = choose_vlc_set(r->si.quant, r->si.vlc_set, 1); for(; i < 24; i++, cbp >>= 1){ if(!(cbp & 1)) continue; blknum = ((i & 4) >> 2) + 4; blkoff = ((i & 1) << 2) + ((i & 2) << 4); rv34_decode_block(s->block[blknum] + blkoff, gb, r->cur_vlcs, r->chroma_vlc, 1); rv34_dequant4x4(s->block[blknum] + blkoff, rv34_qscale_tab[rv34_chroma_quant[1][s->qscale]],rv34_qscale_tab[rv34_chroma_quant[0][s->qscale]]); rv34_inv_transform(s->block[blknum] + blkoff); } if(IS_INTRA(s->current_picture_ptr->mb_type[s->mb_x + s->mb_y*s->mb_stride])) rv34_output_macroblock(r, intra_types, cbp2, r->is16); else rv34_apply_differences(r, cbp2); return 0; }","No, it is non-vulnerable."10461044,"static int index_search_timestamp(AVIndexEntry *entries, int nb_entries, int wanted_timestamp) { int a, b, m; int64_t timestamp; if (nb_entries <= 0) return -1; a = 0; b = nb_entries - 1; while (a <= b) { m = (a + b) >> 1; timestamp = entries[m].timestamp; if (timestamp == wanted_timestamp) goto found; else if (timestamp > wanted_timestamp) { b = m - 1; } else { a = m + 1; } } m = a; if (m > 0) m--; found: return m; }","No, it is non-vulnerable."10471045,"static void vnc_disconnect_finish(VncState *vs) { if (vs->input.buffer) qemu_free(vs->input.buffer); if (vs->output.buffer) qemu_free(vs->output.buffer); #ifdef CONFIG_VNC_TLS vnc_tls_client_cleanup(vs); #endif /* CONFIG_VNC_TLS */ #ifdef CONFIG_VNC_SASL vnc_sasl_client_cleanup(vs); #endif /* CONFIG_VNC_SASL */ audio_del(vs); VncState *p, *parent = NULL; for (p = vs->vd->clients; p != NULL; p = p->next) { if (p == vs) { if (parent) parent->next = p->next; else vs->vd->clients = p->next; break; } parent = p; } if (!vs->vd->clients) dcl->idle = 1; vnc_remove_timer(vs->vd); qemu_free(vs); }","No, it is non-vulnerable."10481046,"static void set_pixel_format(VncState *vs, int bits_per_pixel, int depth, int big_endian_flag, int true_color_flag, int red_max, int green_max, int blue_max, int red_shift, int green_shift, int blue_shift) { if (!true_color_flag) { vs->client_pf.rmax = red_max; vs->client_pf.rbits = hweight_long(red_max); vs->client_pf.rshift = red_shift; vs->client_pf.rmask = red_max << red_shift; vs->client_pf.gmax = green_max; vs->client_pf.gbits = hweight_long(green_max); vs->client_pf.gshift = green_shift; vs->client_pf.gmask = green_max << green_shift; vs->client_pf.bmax = blue_max; vs->client_pf.bbits = hweight_long(blue_max); vs->client_pf.bshift = blue_shift; vs->client_pf.bmask = blue_max << blue_shift; vs->client_pf.bits_per_pixel = bits_per_pixel; vs->client_pf.bytes_per_pixel = bits_per_pixel / 8; vs->client_pf.depth = bits_per_pixel == 32 ? 24 : bits_per_pixel; vs->client_be = big_endian_flag; set_pixel_conversion(vs); graphic_hw_invalidate(NULL); graphic_hw_update(NULL);","Yes, it is vulnerable."10491047,"static uint8_t qpci_pc_config_readb(QPCIBus *bus, int devfn, uint8_t offset) { outl(0xcf8, (1 << 31) | (devfn << 8) | offset); return inb(0xcfc); }","Yes, it is vulnerable."10501048,int kvm_has_xcrs(void) { return kvm_state->xcrs; },"No, it is non-vulnerable."10511049,"static inline void gen_op_eval_bl(TCGv dst, TCGv_i32 src) { gen_mov_reg_V(cpu_tmp0, src); gen_mov_reg_N(dst, src); tcg_gen_xor_tl(dst, dst, cpu_tmp0); }","No, it is non-vulnerable."10521050,"static void tilegx_cpu_initfn(Object *obj) { CPUState *cs = CPU(obj); TileGXCPU *cpu = TILEGX_CPU(obj); CPUTLGState *env = &cpu->env; static bool tcg_initialized; cs->env_ptr = env; cpu_exec_init(cs, &error_abort); if (tcg_enabled() && !tcg_initialized) { tcg_initialized = true; tilegx_tcg_init(); } }","Yes, it is vulnerable."10531051,"getouraddr(void) { char buff[256]; struct hostent *he = NULL; if (gethostname(buff,256) == 0) he = gethostbyname(buff); if (he) our_addr = *(struct in_addr *)he->h_addr; if (our_addr.s_addr == 0) our_addr.s_addr = loopback_addr.s_addr; }","Yes, it is vulnerable."10541052,"void av_aes_crypt(AVAES *a, uint8_t *dst_, const uint8_t *src_, int count, uint8_t *iv_, int decrypt) { av_aes_block *dst = (av_aes_block *) dst_; const av_aes_block *src = (const av_aes_block *) src_; av_aes_block *iv = (av_aes_block *) iv_; while (count--) { addkey(&a->state[1], src, &a->round_key[a->rounds]); if (decrypt) { crypt(a, 0, inv_sbox, dec_multbl); if (iv) { addkey(&a->state[0], &a->state[0], iv); memcpy(iv, src, 16); } addkey(dst, &a->state[0], &a->round_key[0]); } else { if (iv) addkey(&a->state[1], &a->state[1], iv); crypt(a, 2, sbox, enc_multbl); addkey(dst, &a->state[0], &a->round_key[0]); if (iv) memcpy(iv, dst, 16); } src++; dst++; } }","No, it is non-vulnerable."10551053,"static void spapr_cpu_core_realize_child(Object *child, Error **errp) { Error *local_err = NULL; sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine()); CPUState *cs = CPU(child); PowerPCCPU *cpu = POWERPC_CPU(cs); Object *obj; obj = object_new(spapr->icp_type); object_property_add_child(OBJECT(cpu), ""icp"", obj, NULL); object_property_add_const_link(obj, ""xics"", OBJECT(spapr), &error_abort); object_property_set_bool(obj, true, ""realized"", &local_err); if (local_err) { goto error; } object_property_set_bool(child, true, ""realized"", &local_err); if (local_err) { goto error; } spapr_cpu_init(spapr, cpu, &local_err); if (local_err) { goto error; } xics_cpu_setup(XICS_FABRIC(spapr), cpu, ICP(obj)); return; error: object_unparent(obj); error_propagate(errp, local_err); }","Yes, it is vulnerable."10561054,"static int read_diff_float_data(ALSDecContext *ctx, unsigned int ra_frame) { AVCodecContext *avctx = ctx->avctx; GetBitContext *gb = &ctx->gb; SoftFloat_IEEE754 *acf = ctx->acf; int *shift_value = ctx->shift_value; int *last_shift_value = ctx->last_shift_value; int *last_acf_mantissa = ctx->last_acf_mantissa; int **raw_mantissa = ctx->raw_mantissa; int *nbits = ctx->nbits; unsigned char *larray = ctx->larray; int frame_length = ctx->cur_frame_length; SoftFloat_IEEE754 scale = av_int2sf_ieee754(0x1u, 23); unsigned int partA_flag; unsigned int highest_byte; unsigned int shift_amp; uint32_t tmp_32; int use_acf; int nchars; int i; int c; long k; long nbits_aligned; unsigned long acc; unsigned long j; uint32_t sign; uint32_t e; uint32_t mantissa; skip_bits_long(gb, 32); //num_bytes_diff_float use_acf = get_bits1(gb); if (ra_frame) { memset(last_acf_mantissa, 0, avctx->channels * sizeof(*last_acf_mantissa)); memset(last_shift_value, 0, avctx->channels * sizeof(*last_shift_value) ); ff_mlz_flush_dict(ctx->mlz); } for (c = 0; c < avctx->channels; ++c) { if (use_acf) { //acf_flag if (get_bits1(gb)) { tmp_32 = get_bits(gb, 23); last_acf_mantissa[c] = tmp_32; } else { tmp_32 = last_acf_mantissa[c]; } acf[c] = av_bits2sf_ieee754(tmp_32); } else { acf[c] = FLOAT_1; } highest_byte = get_bits(gb, 2); partA_flag = get_bits1(gb); shift_amp = get_bits1(gb); if (shift_amp) { shift_value[c] = get_bits(gb, 8); last_shift_value[c] = shift_value[c]; } else { shift_value[c] = last_shift_value[c]; } if (partA_flag) { if (!get_bits1(gb)) { //uncompressed for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i] == 0) { ctx->raw_mantissa[c][i] = get_bits_long(gb, 32); } } } else { //compressed nchars = 0; for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i] == 0) { nchars += 4; } } tmp_32 = ff_mlz_decompression(ctx->mlz, gb, nchars, larray); if(tmp_32 != nchars) { av_log(ctx->avctx, AV_LOG_ERROR, ""Error in MLZ decompression (%d, %d).\n"", tmp_32, nchars); return AVERROR_INVALIDDATA; } for (i = 0; i < frame_length; ++i) { ctx->raw_mantissa[c][i] = AV_RB32(larray); } } } //decode part B if (highest_byte) { for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i] != 0) { //The following logic is taken from Tabel 14.45 and 14.46 from the ISO spec if (av_cmp_sf_ieee754(acf[c], FLOAT_1)) { nbits[i] = 23 - av_log2(abs(ctx->raw_samples[c][i])); } else { nbits[i] = 23; } nbits[i] = FFMIN(nbits[i], highest_byte*8); } } if (!get_bits1(gb)) { //uncompressed for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i] != 0) { raw_mantissa[c][i] = get_bits(gb, nbits[i]); } } } else { //compressed nchars = 0; for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i]) { nchars += (int) nbits[i] / 8; if (nbits[i] & 7) { ++nchars; } } } tmp_32 = ff_mlz_decompression(ctx->mlz, gb, nchars, larray); if(tmp_32 != nchars) { av_log(ctx->avctx, AV_LOG_ERROR, ""Error in MLZ decompression (%d, %d).\n"", tmp_32, nchars); return AVERROR_INVALIDDATA; } j = 0; for (i = 0; i < frame_length; ++i) { if (ctx->raw_samples[c][i]) { if (nbits[i] & 7) { nbits_aligned = 8 * ((unsigned int)(nbits[i] / 8) + 1); } else { nbits_aligned = nbits[i]; } acc = 0; for (k = 0; k < nbits_aligned/8; ++k) { acc = (acc << 8) + larray[j++]; } acc >>= (nbits_aligned - nbits[i]); raw_mantissa[c][i] = acc; } } } } for (i = 0; i < frame_length; ++i) { SoftFloat_IEEE754 pcm_sf = av_int2sf_ieee754(ctx->raw_samples[c][i], 0); pcm_sf = av_div_sf_ieee754(pcm_sf, scale); if (ctx->raw_samples[c][i] != 0) { if (!av_cmp_sf_ieee754(acf[c], FLOAT_1)) { pcm_sf = multiply(acf[c], pcm_sf); } sign = pcm_sf.sign; e = pcm_sf.exp; mantissa = (pcm_sf.mant | 0x800000) + raw_mantissa[c][i]; while(mantissa >= 0x1000000) { e++; mantissa >>= 1; } if (mantissa) e += (shift_value[c] - 127); mantissa &= 0x007fffffUL; tmp_32 = (sign << 31) | ((e + EXP_BIAS) << 23) | (mantissa); ctx->raw_samples[c][i] = tmp_32; } else { ctx->raw_samples[c][i] = raw_mantissa[c][i] & 0x007fffffUL; } } align_get_bits(gb); } return 0; }","Yes, it is vulnerable."10571055,"static int X264_frame(AVCodecContext *ctx, uint8_t *buf, int bufsize, void *data) { X264Context *x4 = ctx->priv_data; AVFrame *frame = data; x264_nal_t *nal; int nnal, i; x264_picture_t pic_out; x264_picture_init( &x4->pic ); x4->pic.img.i_csp = X264_CSP_I420; x4->pic.img.i_plane = 3; if (frame) { for (i = 0; i < 3; i++) { x4->pic.img.plane[i] = frame->data[i]; x4->pic.img.i_stride[i] = frame->linesize[i]; } x4->pic.i_pts = frame->pts; x4->pic.i_type = frame->pict_type == AV_PICTURE_TYPE_I ? X264_TYPE_KEYFRAME : frame->pict_type == AV_PICTURE_TYPE_P ? X264_TYPE_P : frame->pict_type == AV_PICTURE_TYPE_B ? X264_TYPE_B : X264_TYPE_AUTO; if (x4->params.b_tff != frame->top_field_first) { x4->params.b_tff = frame->top_field_first; x264_encoder_reconfig(x4->enc, &x4->params); } } do { if (x264_encoder_encode(x4->enc, &nal, &nnal, frame? &x4->pic: NULL, &pic_out) < 0) return -1; bufsize = encode_nals(ctx, buf, bufsize, nal, nnal, 0); if (bufsize < 0) return -1; } while (!bufsize && !frame && x264_encoder_delayed_frames(x4->enc)); /* FIXME: libx264 now provides DTS, but AVFrame doesn't have a field for it. */ x4->out_pic.pts = pic_out.i_pts; switch (pic_out.i_type) { case X264_TYPE_IDR: case X264_TYPE_I: x4->out_pic.pict_type = AV_PICTURE_TYPE_I; break; case X264_TYPE_P: x4->out_pic.pict_type = AV_PICTURE_TYPE_P; break; case X264_TYPE_B: case X264_TYPE_BREF: x4->out_pic.pict_type = AV_PICTURE_TYPE_B; break; } x4->out_pic.key_frame = pic_out.b_keyframe; x4->out_pic.quality = (pic_out.i_qpplus1 - 1) * FF_QP2LAMBDA; return bufsize; }","Yes, it is vulnerable."10581056,"static int get_real_id(const char *devpath, const char *idname, uint16_t *val) { FILE *f; char name[128]; long id; snprintf(name, sizeof(name), ""%s%s"", devpath, idname); f = fopen(name, ""r""); if (f == NULL) { error_report(""%s: %s: %m"", __func__, name); return -1; } if (fscanf(f, ""%li\n"", &id) == 1) { *val = id; } else { return -1; } return 0; }","Yes, it is vulnerable."10591057,"static int parse_keyframes_index(AVFormatContext *s, AVIOContext *ioc, AVStream *vstream, int64_t max_pos) { unsigned int timeslen = 0, fileposlen = 0, i; char str_val[256]; int64_t *times = NULL; int64_t *filepositions = NULL; int ret = AVERROR(ENOSYS); int64_t initial_pos = avio_tell(ioc); AVDictionaryEntry *creator = av_dict_get(s->metadata, ""metadatacreator"", NULL, 0); if (creator && !strcmp(creator->value, ""MEGA"")) { /* Files with this metadatacreator tag seem to have filepositions * pointing at the 4 trailer bytes of the previous packet, * which isn't the norm (nor what we expect here, nor what * jwplayer + lighttpd expect, nor what flvtool2 produces). * Just ignore the index in this case, instead of risking trying * to adjust it to something that might or might not work. */ return 0; } if(vstream->nb_index_entries>0){ av_log(s, AV_LOG_WARNING, ""Skiping duplicate index\n""); return 0; } while (avio_tell(ioc) < max_pos - 2 && amf_get_string(ioc, str_val, sizeof(str_val)) > 0) { int64_t** current_array; unsigned int arraylen; // Expect array object in context if (avio_r8(ioc) != AMF_DATA_TYPE_ARRAY) break; arraylen = avio_rb32(ioc); if(arraylen>>28) break; if (!strcmp(KEYFRAMES_TIMESTAMP_TAG , str_val) && !times){ current_array= &times; timeslen= arraylen; }else if (!strcmp(KEYFRAMES_BYTEOFFSET_TAG, str_val) && !filepositions){ current_array= &filepositions; fileposlen= arraylen; }else // unexpected metatag inside keyframes, will not use such metadata for indexing break; if (!(*current_array = av_mallocz(sizeof(**current_array) * arraylen))) { ret = AVERROR(ENOMEM); goto finish; } for (i = 0; i < arraylen && avio_tell(ioc) < max_pos - 1; i++) { if (avio_r8(ioc) != AMF_DATA_TYPE_NUMBER) goto finish; current_array[0][i] = av_int2dbl(avio_rb64(ioc)); } if (times && filepositions) { // All done, exiting at a position allowing amf_parse_object // to finish parsing the object ret = 0; break; } } if (timeslen == fileposlen) { for(i = 0; i < timeslen; i++) av_add_index_entry(vstream, filepositions[i], times[i]*1000, 0, 0, AVINDEX_KEYFRAME); } else av_log(s, AV_LOG_WARNING, ""Invalid keyframes object, skipping.\n""); finish: av_freep(&times); av_freep(&filepositions); avio_seek(ioc, initial_pos, SEEK_SET); return ret; }","No, it is non-vulnerable."10601058,"void avcodec_default_release_buffer(AVCodecContext *s, AVFrame *pic){ int i; InternalBuffer *buf, *last; AVCodecInternal *avci = s->internal; assert(s->codec_type == AVMEDIA_TYPE_VIDEO); assert(pic->type==FF_BUFFER_TYPE_INTERNAL); assert(avci->buffer_count); if (avci->buffer) { buf = NULL; /* avoids warning */ for (i = 0; i < avci->buffer_count; i++) { //just 3-5 checks so is not worth to optimize buf = &avci->buffer[i]; if (buf->data[0] == pic->data[0]) break; } assert(i < avci->buffer_count); avci->buffer_count--; last = &avci->buffer[avci->buffer_count]; FFSWAP(InternalBuffer, *buf, *last); } for (i = 0; i < AV_NUM_DATA_POINTERS; i++) { pic->data[i]=NULL; // pic->base[i]=NULL; } //printf(""R%X\n"", pic->opaque); if(s->debug&FF_DEBUG_BUFFERS) av_log(s, AV_LOG_DEBUG, ""default_release_buffer called on pic %p, %d "" ""buffers used\n"", pic, avci->buffer_count); }","No, it is non-vulnerable."10611059,"static void iv_Decode_Chunk(Indeo3DecodeContext *s, uint8_t *cur, uint8_t *ref, int width, int height, const uint8_t *buf1, int cb_offset, const uint8_t *hdr, const uint8_t *buf2, int min_width_160) { uint8_t bit_buf; unsigned int bit_pos, lv, lv1, lv2; int *width_tbl, width_tbl_arr[10]; const signed char *ref_vectors; uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2; uint32_t *cur_lp, *ref_lp; const uint32_t *correction_lp[2], *correctionloworder_lp[2], *correctionhighorder_lp[2]; uint8_t *correction_type_sp[2]; struct ustr strip_tbl[20], *strip; int i, j, k, lp1, lp2, flag1, cmd, blks_width, blks_height, region_160_width, rle_v1, rle_v2, rle_v3; unsigned short res; bit_buf = 0; ref_vectors = NULL; width_tbl = width_tbl_arr + 1; i = (width < 0 ? width + 3 : width)/4; for(j = -1; j < 8; j++) width_tbl[j] = i * j; strip = strip_tbl; for(region_160_width = 0; region_160_width < (width - min_width_160); region_160_width += min_width_160); strip->ypos = strip->xpos = 0; for(strip->width = min_width_160; width > strip->width; strip->width *= 2); strip->height = height; strip->split_direction = 0; strip->split_flag = 0; strip->usl7 = 0; bit_pos = 0; rle_v1 = rle_v2 = rle_v3 = 0; while(strip >= strip_tbl) { if(bit_pos <= 0) { bit_pos = 8; bit_buf = *buf1++; } bit_pos -= 2; cmd = (bit_buf >> bit_pos) & 0x03; if(cmd == 0) { strip++; if(strip >= strip_tbl + FF_ARRAY_ELEMS(strip_tbl)) { av_log(s->avctx, AV_LOG_WARNING, ""out of range strip\n""); break; } memcpy(strip, strip-1, sizeof(*strip)); strip->split_flag = 1; strip->split_direction = 0; strip->height = (strip->height > 8 ? ((strip->height+8)>>4)<<3 : 4); continue; } else if(cmd == 1) { strip++; if(strip >= strip_tbl + FF_ARRAY_ELEMS(strip_tbl)) { av_log(s->avctx, AV_LOG_WARNING, ""out of range strip\n""); break; } memcpy(strip, strip-1, sizeof(*strip)); strip->split_flag = 1; strip->split_direction = 1; strip->width = (strip->width > 8 ? ((strip->width+8)>>4)<<3 : 4); continue; } else if(cmd == 2) { if(strip->usl7 == 0) { strip->usl7 = 1; ref_vectors = NULL; continue; } } else if(cmd == 3) { if(strip->usl7 == 0) { strip->usl7 = 1; ref_vectors = (const signed char*)buf2 + (*buf1 * 2); buf1++; continue; } } cur_frm_pos = cur + width * strip->ypos + strip->xpos; if((blks_width = strip->width) < 0) blks_width += 3; blks_width >>= 2; blks_height = strip->height; if(ref_vectors != NULL) { ref_frm_pos = ref + (ref_vectors[0] + strip->ypos) * width + ref_vectors[1] + strip->xpos; } else ref_frm_pos = cur_frm_pos - width_tbl[4]; if(cmd == 2) { if(bit_pos <= 0) { bit_pos = 8; bit_buf = *buf1++; } bit_pos -= 2; cmd = (bit_buf >> bit_pos) & 0x03; if(cmd == 0 || ref_vectors != NULL) { for(lp1 = 0; lp1 < blks_width; lp1++) { for(i = 0, j = 0; i < blks_height; i++, j += width_tbl[1]) ((uint32_t *)cur_frm_pos)[j] = ((uint32_t *)ref_frm_pos)[j]; cur_frm_pos += 4; ref_frm_pos += 4; } } else if(cmd != 1) return; } else { k = *buf1 >> 4; j = *buf1 & 0x0f; buf1++; lv = j + cb_offset; if((lv - 8) <= 7 && (k == 0 || k == 3 || k == 10)) { cp2 = s->ModPred + ((lv - 8) << 7); cp = ref_frm_pos; for(i = 0; i < blks_width << 2; i++) { int v = *cp >> 1; *(cp++) = cp2[v]; } } if(k == 1 || k == 4) { lv = (hdr[j] & 0xf) + cb_offset; correction_type_sp[0] = s->corrector_type + (lv << 8); correction_lp[0] = correction + (lv << 8); lv = (hdr[j] >> 4) + cb_offset; correction_lp[1] = correction + (lv << 8); correction_type_sp[1] = s->corrector_type + (lv << 8); } else { correctionloworder_lp[0] = correctionloworder_lp[1] = correctionloworder + (lv << 8); correctionhighorder_lp[0] = correctionhighorder_lp[1] = correctionhighorder + (lv << 8); correction_type_sp[0] = correction_type_sp[1] = s->corrector_type + (lv << 8); correction_lp[0] = correction_lp[1] = correction + (lv << 8); } switch(k) { case 1: case 0: /********** CASE 0 **********/ for( ; blks_height > 0; blks_height -= 4) { for(lp1 = 0; lp1 < blks_width; lp1++) { for(lp2 = 0; lp2 < 4; ) { k = *buf1++; cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2]; ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2]; if ((uint8_t *)cur_lp >= cur_end-3) break; switch(correction_type_sp[0][k]) { case 0: *cur_lp = av_le2ne32(((av_le2ne32(*ref_lp) >> 1) + correction_lp[lp2 & 0x01][k]) << 1); lp2++; break; case 1: res = ((av_le2ne16(((unsigned short *)(ref_lp))[0]) >> 1) + correction_lp[lp2 & 0x01][*buf1]) << 1; ((unsigned short *)cur_lp)[0] = av_le2ne16(res); res = ((av_le2ne16(((unsigned short *)(ref_lp))[1]) >> 1) + correction_lp[lp2 & 0x01][k]) << 1; ((unsigned short *)cur_lp)[1] = av_le2ne16(res); buf1++; lp2++; break; case 2: if(lp2 == 0) { for(i = 0, j = 0; i < 2; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 += 2; } break; case 3: if(lp2 < 2) { for(i = 0, j = 0; i < (3 - lp2); i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 = 3; } break; case 8: if(lp2 == 0) { RLE_V3_CHECK(buf1,rle_v1,rle_v2,rle_v3) if(rle_v1 == 1 || ref_vectors != NULL) { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; } RLE_V2_CHECK(buf1,rle_v2, rle_v3,lp2) break; } else { rle_v1 = 1; rle_v2 = *buf1 - 1; } case 5: LP2_CHECK(buf1,rle_v3,lp2) case 4: for(i = 0, j = 0; i < (4 - lp2); i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 = 4; break; case 7: if(rle_v3 != 0) rle_v3 = 0; else { buf1--; rle_v3 = 1; } case 6: if(ref_vectors != NULL) { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; } lp2 = 4; break; case 9: lv1 = *buf1++; lv = (lv1 & 0x7F) << 1; lv += (lv << 8); lv += (lv << 16); for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = lv; LV1_CHECK(buf1,rle_v3,lv1,lp2) break; default: return; } } cur_frm_pos += 4; ref_frm_pos += 4; } cur_frm_pos += ((width - blks_width) * 4); ref_frm_pos += ((width - blks_width) * 4); } break; case 4: case 3: /********** CASE 3 **********/ if(ref_vectors != NULL) return; flag1 = 1; for( ; blks_height > 0; blks_height -= 8) { for(lp1 = 0; lp1 < blks_width; lp1++) { for(lp2 = 0; lp2 < 4; ) { k = *buf1++; cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2 * 2]; ref_lp = ((uint32_t *)cur_frm_pos) + width_tbl[(lp2 * 2) - 1]; switch(correction_type_sp[lp2 & 0x01][k]) { case 0: cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(*ref_lp) >> 1) + correction_lp[lp2 & 0x01][k]) << 1); if(lp2 > 0 || flag1 == 0 || strip->ypos != 0) cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; else cur_lp[0] = av_le2ne32(((av_le2ne32(*ref_lp) >> 1) + correction_lp[lp2 & 0x01][k]) << 1); lp2++; break; case 1: res = ((av_le2ne16(((unsigned short *)ref_lp)[0]) >> 1) + correction_lp[lp2 & 0x01][*buf1]) << 1; ((unsigned short *)cur_lp)[width_tbl[2]] = av_le2ne16(res); res = ((av_le2ne16(((unsigned short *)ref_lp)[1]) >> 1) + correction_lp[lp2 & 0x01][k]) << 1; ((unsigned short *)cur_lp)[width_tbl[2]+1] = av_le2ne16(res); if(lp2 > 0 || flag1 == 0 || strip->ypos != 0) cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; else cur_lp[0] = cur_lp[width_tbl[1]]; buf1++; lp2++; break; case 2: if(lp2 == 0) { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = *ref_lp; lp2 += 2; } break; case 3: if(lp2 < 2) { for(i = 0, j = 0; i < 6 - (lp2 * 2); i++, j += width_tbl[1]) cur_lp[j] = *ref_lp; lp2 = 3; } break; case 6: lp2 = 4; break; case 7: if(rle_v3 != 0) rle_v3 = 0; else { buf1--; rle_v3 = 1; } lp2 = 4; break; case 8: if(lp2 == 0) { RLE_V3_CHECK(buf1,rle_v1,rle_v2,rle_v3) if(rle_v1 == 1) { for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; } RLE_V2_CHECK(buf1,rle_v2, rle_v3,lp2) break; } else { rle_v2 = (*buf1) - 1; rle_v1 = 1; } case 5: LP2_CHECK(buf1,rle_v3,lp2) case 4: for(i = 0, j = 0; i < 8 - (lp2 * 2); i++, j += width_tbl[1]) cur_lp[j] = *ref_lp; lp2 = 4; break; case 9: av_log(s->avctx, AV_LOG_ERROR, ""UNTESTED.\n""); lv1 = *buf1++; lv = (lv1 & 0x7F) << 1; lv += (lv << 8); lv += (lv << 16); for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = lv; LV1_CHECK(buf1,rle_v3,lv1,lp2) break; default: return; } } cur_frm_pos += 4; } cur_frm_pos += (((width * 2) - blks_width) * 4); flag1 = 0; } break; case 10: /********** CASE 10 **********/ if(ref_vectors == NULL) { flag1 = 1; for( ; blks_height > 0; blks_height -= 8) { for(lp1 = 0; lp1 < blks_width; lp1 += 2) { for(lp2 = 0; lp2 < 4; ) { k = *buf1++; cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2 * 2]; ref_lp = ((uint32_t *)cur_frm_pos) + width_tbl[(lp2 * 2) - 1]; lv1 = ref_lp[0]; lv2 = ref_lp[1]; if(lp2 == 0 && flag1 != 0) { #if HAVE_BIGENDIAN lv1 = lv1 & 0xFF00FF00; lv1 = (lv1 >> 8) | lv1; lv2 = lv2 & 0xFF00FF00; lv2 = (lv2 >> 8) | lv2; #else lv1 = lv1 & 0x00FF00FF; lv1 = (lv1 << 8) | lv1; lv2 = lv2 & 0x00FF00FF; lv2 = (lv2 << 8) | lv2; #endif } switch(correction_type_sp[lp2 & 0x01][k]) { case 0: cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(lv1) >> 1) + correctionloworder_lp[lp2 & 0x01][k]) << 1); cur_lp[width_tbl[1]+1] = av_le2ne32(((av_le2ne32(lv2) >> 1) + correctionhighorder_lp[lp2 & 0x01][k]) << 1); if(lp2 > 0 || strip->ypos != 0 || flag1 == 0) { cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { cur_lp[0] = cur_lp[width_tbl[1]]; cur_lp[1] = cur_lp[width_tbl[1]+1]; } lp2++; break; case 1: cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(lv1) >> 1) + correctionloworder_lp[lp2 & 0x01][*buf1]) << 1); cur_lp[width_tbl[1]+1] = av_le2ne32(((av_le2ne32(lv2) >> 1) + correctionloworder_lp[lp2 & 0x01][k]) << 1); if(lp2 > 0 || strip->ypos != 0 || flag1 == 0) { cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { cur_lp[0] = cur_lp[width_tbl[1]]; cur_lp[1] = cur_lp[width_tbl[1]+1]; } buf1++; lp2++; break; case 2: if(lp2 == 0) { if(flag1 != 0) { for(i = 0, j = width_tbl[1]; i < 3; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } } lp2 += 2; } break; case 3: if(lp2 < 2) { if(lp2 == 0 && flag1 != 0) { for(i = 0, j = width_tbl[1]; i < 5; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { for(i = 0, j = 0; i < 6 - (lp2 * 2); i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } } lp2 = 3; } break; case 8: if(lp2 == 0) { RLE_V3_CHECK(buf1,rle_v1,rle_v2,rle_v3) if(rle_v1 == 1) { if(flag1 != 0) { for(i = 0, j = width_tbl[1]; i < 7; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } } } RLE_V2_CHECK(buf1,rle_v2, rle_v3,lp2) break; } else { rle_v1 = 1; rle_v2 = (*buf1) - 1; } case 5: LP2_CHECK(buf1,rle_v3,lp2) case 4: if(lp2 == 0 && flag1 != 0) { for(i = 0, j = width_tbl[1]; i < 7; i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } cur_lp[0] = ((cur_lp[-width_tbl[1]] >> 1) + (cur_lp[width_tbl[1]] >> 1)) & 0xFEFEFEFE; cur_lp[1] = ((cur_lp[-width_tbl[1]+1] >> 1) + (cur_lp[width_tbl[1]+1] >> 1)) & 0xFEFEFEFE; } else { for(i = 0, j = 0; i < 8 - (lp2 * 2); i++, j += width_tbl[1]) { cur_lp[j] = lv1; cur_lp[j+1] = lv2; } } lp2 = 4; break; case 6: lp2 = 4; break; case 7: if(lp2 == 0) { if(rle_v3 != 0) rle_v3 = 0; else { buf1--; rle_v3 = 1; } lp2 = 4; } break; case 9: av_log(s->avctx, AV_LOG_ERROR, ""UNTESTED.\n""); lv1 = *buf1; lv = (lv1 & 0x7F) << 1; lv += (lv << 8); lv += (lv << 16); for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) cur_lp[j] = lv; LV1_CHECK(buf1,rle_v3,lv1,lp2) break; default: return; } } cur_frm_pos += 8; } cur_frm_pos += (((width * 2) - blks_width) * 4); flag1 = 0; } } else { for( ; blks_height > 0; blks_height -= 8) { for(lp1 = 0; lp1 < blks_width; lp1 += 2) { for(lp2 = 0; lp2 < 4; ) { k = *buf1++; cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2 * 2]; ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2 * 2]; switch(correction_type_sp[lp2 & 0x01][k]) { case 0: lv1 = correctionloworder_lp[lp2 & 0x01][k]; lv2 = correctionhighorder_lp[lp2 & 0x01][k]; cur_lp[0] = av_le2ne32(((av_le2ne32(ref_lp[0]) >> 1) + lv1) << 1); cur_lp[1] = av_le2ne32(((av_le2ne32(ref_lp[1]) >> 1) + lv2) << 1); cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(ref_lp[width_tbl[1]]) >> 1) + lv1) << 1); cur_lp[width_tbl[1]+1] = av_le2ne32(((av_le2ne32(ref_lp[width_tbl[1]+1]) >> 1) + lv2) << 1); lp2++; break; case 1: lv1 = correctionloworder_lp[lp2 & 0x01][*buf1++]; lv2 = correctionloworder_lp[lp2 & 0x01][k]; cur_lp[0] = av_le2ne32(((av_le2ne32(ref_lp[0]) >> 1) + lv1) << 1); cur_lp[1] = av_le2ne32(((av_le2ne32(ref_lp[1]) >> 1) + lv2) << 1); cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(ref_lp[width_tbl[1]]) >> 1) + lv1) << 1); cur_lp[width_tbl[1]+1] = av_le2ne32(((av_le2ne32(ref_lp[width_tbl[1]+1]) >> 1) + lv2) << 1); lp2++; break; case 2: if(lp2 == 0) { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) { cur_lp[j] = ref_lp[j]; cur_lp[j+1] = ref_lp[j+1]; } lp2 += 2; } break; case 3: if(lp2 < 2) { for(i = 0, j = 0; i < 6 - (lp2 * 2); i++, j += width_tbl[1]) { cur_lp[j] = ref_lp[j]; cur_lp[j+1] = ref_lp[j+1]; } lp2 = 3; } break; case 8: if(lp2 == 0) { RLE_V3_CHECK(buf1,rle_v1,rle_v2,rle_v3) for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) { ((uint32_t *)cur_frm_pos)[j] = ((uint32_t *)ref_frm_pos)[j]; ((uint32_t *)cur_frm_pos)[j+1] = ((uint32_t *)ref_frm_pos)[j+1]; } RLE_V2_CHECK(buf1,rle_v2, rle_v3,lp2) break; } else { rle_v1 = 1; rle_v2 = (*buf1) - 1; } case 5: case 7: LP2_CHECK(buf1,rle_v3,lp2) case 6: case 4: for(i = 0, j = 0; i < 8 - (lp2 * 2); i++, j += width_tbl[1]) { cur_lp[j] = ref_lp[j]; cur_lp[j+1] = ref_lp[j+1]; } lp2 = 4; break; case 9: av_log(s->avctx, AV_LOG_ERROR, ""UNTESTED.\n""); lv1 = *buf1; lv = (lv1 & 0x7F) << 1; lv += (lv << 8); lv += (lv << 16); for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) ((uint32_t *)cur_frm_pos)[j] = ((uint32_t *)cur_frm_pos)[j+1] = lv; LV1_CHECK(buf1,rle_v3,lv1,lp2) break; default: return; } } cur_frm_pos += 8; ref_frm_pos += 8; } cur_frm_pos += (((width * 2) - blks_width) * 4); ref_frm_pos += (((width * 2) - blks_width) * 4); } } break; case 11: /********** CASE 11 **********/ if(ref_vectors == NULL) return; for( ; blks_height > 0; blks_height -= 8) { for(lp1 = 0; lp1 < blks_width; lp1++) { for(lp2 = 0; lp2 < 4; ) { k = *buf1++; cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2 * 2]; ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2 * 2]; switch(correction_type_sp[lp2 & 0x01][k]) { case 0: cur_lp[0] = av_le2ne32(((av_le2ne32(*ref_lp) >> 1) + correction_lp[lp2 & 0x01][k]) << 1); cur_lp[width_tbl[1]] = av_le2ne32(((av_le2ne32(ref_lp[width_tbl[1]]) >> 1) + correction_lp[lp2 & 0x01][k]) << 1); lp2++; break; case 1: lv1 = (unsigned short)(correction_lp[lp2 & 0x01][*buf1++]); lv2 = (unsigned short)(correction_lp[lp2 & 0x01][k]); res = (unsigned short)(((av_le2ne16(((unsigned short *)ref_lp)[0]) >> 1) + lv1) << 1); ((unsigned short *)cur_lp)[0] = av_le2ne16(res); res = (unsigned short)(((av_le2ne16(((unsigned short *)ref_lp)[1]) >> 1) + lv2) << 1); ((unsigned short *)cur_lp)[1] = av_le2ne16(res); res = (unsigned short)(((av_le2ne16(((unsigned short *)ref_lp)[width_tbl[2]]) >> 1) + lv1) << 1); ((unsigned short *)cur_lp)[width_tbl[2]] = av_le2ne16(res); res = (unsigned short)(((av_le2ne16(((unsigned short *)ref_lp)[width_tbl[2]+1]) >> 1) + lv2) << 1); ((unsigned short *)cur_lp)[width_tbl[2]+1] = av_le2ne16(res); lp2++; break; case 2: if(lp2 == 0) { for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 += 2; } break; case 3: if(lp2 < 2) { for(i = 0, j = 0; i < 6 - (lp2 * 2); i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 = 3; } break; case 8: if(lp2 == 0) { RLE_V3_CHECK(buf1,rle_v1,rle_v2,rle_v3) for(i = 0, j = 0; i < 8; i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; RLE_V2_CHECK(buf1,rle_v2, rle_v3,lp2) break; } else { rle_v1 = 1; rle_v2 = (*buf1) - 1; } case 5: case 7: LP2_CHECK(buf1,rle_v3,lp2) case 4: case 6: for(i = 0, j = 0; i < 8 - (lp2 * 2); i++, j += width_tbl[1]) cur_lp[j] = ref_lp[j]; lp2 = 4; break; case 9: av_log(s->avctx, AV_LOG_ERROR, ""UNTESTED.\n""); lv1 = *buf1++; lv = (lv1 & 0x7F) << 1; lv += (lv << 8); lv += (lv << 16); for(i = 0, j = 0; i < 4; i++, j += width_tbl[1]) cur_lp[j] = lv; LV1_CHECK(buf1,rle_v3,lv1,lp2) break; default: return; } } cur_frm_pos += 4; ref_frm_pos += 4; } cur_frm_pos += (((width * 2) - blks_width) * 4); ref_frm_pos += (((width * 2) - blks_width) * 4); } break; default: return; } } for( ; strip >= strip_tbl; strip--) { if(strip->split_flag != 0) { strip->split_flag = 0; strip->usl7 = (strip-1)->usl7; if(strip->split_direction) { strip->xpos += strip->width; strip->width = (strip-1)->width - strip->width; if(region_160_width <= strip->xpos && width < strip->width + strip->xpos) strip->width = width - strip->xpos; } else { strip->ypos += strip->height; strip->height = (strip-1)->height - strip->height; } break; } } } }","Yes, it is vulnerable."10621060,"static int bethsoftvid_decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPacket *avpkt) { const uint8_t *buf = avpkt->data; int buf_size = avpkt->size; BethsoftvidContext * vid = avctx->priv_data; char block_type; uint8_t * dst; uint8_t * frame_end; int remaining = avctx->width; // number of bytes remaining on a line const int wrap_to_next_line = vid->frame.linesize[0] - avctx->width; int code; int yoffset; if (avctx->reget_buffer(avctx, &vid->frame)) { av_log(avctx, AV_LOG_ERROR, ""reget_buffer() failed\n""); return -1; } dst = vid->frame.data[0]; frame_end = vid->frame.data[0] + vid->frame.linesize[0] * avctx->height; switch(block_type = *buf++){ case PALETTE_BLOCK: return set_palette(&vid->frame, buf, buf_size); case VIDEO_YOFF_P_FRAME: yoffset = bytestream_get_le16(&buf); if(yoffset >= avctx->height) return -1; dst += vid->frame.linesize[0] * yoffset; } // main code while((code = *buf++)){ int length = code & 0x7f; // copy any bytes starting at the current position, and ending at the frame width while(length > remaining){ if(code < 0x80) bytestream_get_buffer(&buf, dst, remaining); else if(block_type == VIDEO_I_FRAME) memset(dst, buf[0], remaining); length -= remaining; // decrement the number of bytes to be copied dst += remaining + wrap_to_next_line; // skip over extra bytes at end of frame remaining = avctx->width; if(dst == frame_end) goto end; } // copy any remaining bytes after / if line overflows if(code < 0x80) bytestream_get_buffer(&buf, dst, length); else if(block_type == VIDEO_I_FRAME) memset(dst, *buf++, length); remaining -= length; dst += length; } end: *data_size = sizeof(AVFrame); *(AVFrame*)data = vid->frame; return buf_size; }","Yes, it is vulnerable."10631061,"static int get_S2prot(CPUARMState *env, int s2ap, int xn) { int prot = 0; if (s2ap & 1) { prot |= PAGE_READ; } if (s2ap & 2) { prot |= PAGE_WRITE; } if (!xn) { prot |= PAGE_EXEC; } return prot; }","Yes, it is vulnerable."10641062,"void qvirtio_pci_foreach(QPCIBus *bus, uint16_t device_type, void (*func)(QVirtioDevice *d, void *data), void *data) { QVirtioPCIForeachData d = { .func = func, .device_type = device_type, .user_data = data }; qpci_device_foreach(bus, PCI_VENDOR_ID_REDHAT_QUMRANET, -1, qvirtio_pci_foreach_callback, &d); }","Yes, it is vulnerable."10651063,"static void gen_slbmfee(DisasContext *ctx) { #if defined(CONFIG_USER_ONLY) gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG); #else if (unlikely(ctx->pr)) { gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG); return; } gen_helper_load_slb_esid(cpu_gpr[rS(ctx->opcode)], cpu_env, cpu_gpr[rB(ctx->opcode)]); #endif }","Yes, it is vulnerable."10661064,"static int qcow2_make_empty(BlockDriverState *bs) { BDRVQcow2State *s = bs->opaque; uint64_t offset, end_offset; int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size); int l1_clusters, ret = 0; l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t)); if (s->qcow_version >= 3 && !s->snapshots && 3 + l1_clusters <= s->refcount_block_size && s->crypt_method_header != QCOW_CRYPT_LUKS) { /* The following function only works for qcow2 v3 images (it requires * the dirty flag) and only as long as there are no snapshots (because * it completely empties the image). Furthermore, the L1 table and three * additional clusters (image header, refcount table, one refcount * block) have to fit inside one refcount block. It cannot be used * for LUKS (yet) as it throws away the LUKS header cluster(s) */ return make_completely_empty(bs); } /* This fallback code simply discards every active cluster; this is slow, * but works in all cases */ end_offset = bs->total_sectors * BDRV_SECTOR_SIZE; for (offset = 0; offset < end_offset; offset += step) { /* As this function is generally used after committing an external * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the * default action for this kind of discard is to pass the discard, * which will ideally result in an actually smaller image file, as * is probably desired. */ ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset), QCOW2_DISCARD_SNAPSHOT, true); if (ret < 0) { break; } } return ret; }","Yes, it is vulnerable."10671065,"static VncBasicInfoList *qmp_query_server_entry(QIOChannelSocket *ioc, bool websocket, VncBasicInfoList *prev) { VncBasicInfoList *list; VncBasicInfo *info; Error *err = NULL; SocketAddress *addr; addr = qio_channel_socket_get_local_address(ioc, &err); if (!addr) { error_free(err); return prev; } info = g_new0(VncBasicInfo, 1); vnc_init_basic_info(addr, info, &err); qapi_free_SocketAddress(addr); if (err) { qapi_free_VncBasicInfo(info); error_free(err); return prev; } info->websocket = websocket; list = g_new0(VncBasicInfoList, 1); list->value = info; list->next = prev; return list; }","No, it is non-vulnerable."10681066,"uint32_t HELPER(get_cp_reg)(CPUARMState *env, void *rip) { const ARMCPRegInfo *ri = rip; return ri->readfn(env, ri); }","Yes, it is vulnerable."10691067,"static NetSocketState *net_socket_fd_init_dgram(VLANState *vlan, int fd, int is_connected) { struct sockaddr_in saddr; int newfd; socklen_t saddr_len; NetSocketState *s; /* fd passed: multicast: ""learn"" dgram_dst address from bound address and save it * Because this may be ""shared"" socket from a ""master"" process, datagrams would be recv() * by ONLY ONE process: we must ""clone"" this dgram socket --jjo */ if (is_connected) { if (getsockname(fd, (struct sockaddr *) &saddr, &saddr_len) == 0) { /* must be bound */ if (saddr.sin_addr.s_addr==0) { fprintf(stderr, ""qemu: error: init_dgram: fd=%d unbound, cannot setup multicast dst addr\n"", fd); return NULL; } /* clone dgram socket */ newfd = net_socket_mcast_create(&saddr); if (newfd < 0) { /* error already reported by net_socket_mcast_create() */ close(fd); return NULL; } /* clone newfd to fd, close newfd */ dup2(newfd, fd); close(newfd); } else { fprintf(stderr, ""qemu: error: init_dgram: fd=%d failed getsockname(): %s\n"", fd, strerror(errno)); return NULL; } } s = qemu_mallocz(sizeof(NetSocketState)); if (!s) return NULL; s->fd = fd; s->vc = qemu_new_vlan_client(vlan, net_socket_receive_dgram, s); qemu_set_fd_handler(s->fd, net_socket_send_dgram, NULL, s); /* mcast: save bound address as dst */ if (is_connected) s->dgram_dst=saddr; snprintf(s->vc->info_str, sizeof(s->vc->info_str), ""socket: fd=%d (%s mcast=%s:%d)"", fd, is_connected? ""cloned"" : """", inet_ntoa(saddr.sin_addr), ntohs(saddr.sin_port)); return s; }","Yes, it is vulnerable."10701068,"static int filter_frame(AVFilterLink *link, AVFilterBufferRef *picref) { AVFilterContext *ctx = link->dst; YADIFContext *yadif = ctx->priv; av_assert0(picref); if (picref->video->h < 3 || picref->video->w < 3) { av_log(ctx, AV_LOG_ERROR, ""Video of less than 3 columns or lines is not supported\n""); return AVERROR(EINVAL); } if (yadif->frame_pending) return_frame(ctx, 1); if (yadif->prev) avfilter_unref_buffer(yadif->prev); yadif->prev = yadif->cur; yadif->cur = yadif->next; yadif->next = picref; if (!yadif->cur) return 0; if (yadif->auto_enable && !yadif->cur->video->interlaced) { yadif->out = avfilter_ref_buffer(yadif->cur, ~AV_PERM_WRITE); if (!yadif->out) return AVERROR(ENOMEM); avfilter_unref_bufferp(&yadif->prev); if (yadif->out->pts != AV_NOPTS_VALUE) yadif->out->pts *= 2; return ff_filter_frame(ctx->outputs[0], yadif->out); } if (!yadif->prev && !(yadif->prev = avfilter_ref_buffer(yadif->cur, ~AV_PERM_WRITE))) return AVERROR(ENOMEM); yadif->out = ff_get_video_buffer(ctx->outputs[0], PERM_RWP, link->w, link->h); if (!yadif->out) return AVERROR(ENOMEM); avfilter_copy_buffer_ref_props(yadif->out, yadif->cur); yadif->out->video->interlaced = 0; if (yadif->out->pts != AV_NOPTS_VALUE) yadif->out->pts *= 2; return return_frame(ctx, 0); }","Yes, it is vulnerable."10711069,"void ff_put_h264_qpel16_mc23_msa(uint8_t *dst, const uint8_t *src, ptrdiff_t stride) { avc_luma_midv_qrt_16w_msa(src - (2 * stride) - 2, stride, dst, stride, 16, 1); }","No, it is non-vulnerable."10721070,"static int init_duplicate_context(MpegEncContext *s, MpegEncContext *base){ int i; // edge emu needs blocksize + filter length - 1 (=17x17 for halfpel / 21x21 for h264) CHECKED_ALLOCZ(s->allocated_edge_emu_buffer, (s->width+64)*2*21*2); //(width + edge + align)*interlaced*MBsize*tolerance s->edge_emu_buffer= s->allocated_edge_emu_buffer + (s->width+64)*2*21; //FIXME should be linesize instead of s->width*2 but that is not known before get_buffer() CHECKED_ALLOCZ(s->me.scratchpad, (s->width+64)*4*16*2*sizeof(uint8_t)) s->me.temp= s->me.scratchpad; s->rd_scratchpad= s->me.scratchpad; s->b_scratchpad= s->me.scratchpad; s->obmc_scratchpad= s->me.scratchpad + 16; if (s->encoding) { CHECKED_ALLOCZ(s->me.map , ME_MAP_SIZE*sizeof(uint32_t)) CHECKED_ALLOCZ(s->me.score_map, ME_MAP_SIZE*sizeof(uint32_t)) if(s->avctx->noise_reduction){ CHECKED_ALLOCZ(s->dct_error_sum, 2 * 64 * sizeof(int)) } } CHECKED_ALLOCZ(s->blocks, 64*12*2 * sizeof(DCTELEM)) s->block= s->blocks[0]; for(i=0;i<12;i++){ s->pblocks[i] = &s->block[i]; } return 0; fail: return -1; //free() through MPV_common_end() }","No, it is non-vulnerable."10731071,"void ff_put_h264_qpel4_mc31_msa(uint8_t *dst, const uint8_t *src, ptrdiff_t stride) { avc_luma_hv_qrt_4w_msa(src - 2, src - (stride * 2) + sizeof(uint8_t), stride, dst, stride, 4); }","No, it is non-vulnerable."10741072,"yuv2rgb48_1_c_template(SwsContext *c, const uint16_t *buf0, const uint16_t *ubuf0, const uint16_t *ubuf1, const uint16_t *vbuf0, const uint16_t *vbuf1, const uint16_t *abuf0, uint8_t *dest, int dstW, int uvalpha, enum PixelFormat dstFormat, int flags, int y, enum PixelFormat target) { int i; if (uvalpha < 2048) { for (i = 0; i < (dstW >> 1); i++) { int Y1 = buf0[i * 2] >> 7; int Y2 = buf0[i * 2 + 1] >> 7; int U = ubuf1[i] >> 7; int V = vbuf1[i] >> 7; const uint8_t *r = (const uint8_t *) c->table_rV[V], *g = (const uint8_t *)(c->table_gU[U] + c->table_gV[V]), *b = (const uint8_t *) c->table_bU[U]; dest[ 0] = dest[ 1] = r_b[Y1]; dest[ 2] = dest[ 3] = g[Y1]; dest[ 4] = dest[ 5] = b_r[Y1]; dest[ 6] = dest[ 7] = r_b[Y2]; dest[ 8] = dest[ 9] = g[Y2]; dest[10] = dest[11] = b_r[Y2]; dest += 12; } } else { for (i = 0; i < (dstW >> 1); i++) { int Y1 = buf0[i * 2] >> 7; int Y2 = buf0[i * 2 + 1] >> 7; int U = (ubuf0[i] + ubuf1[i]) >> 8; int V = (vbuf0[i] + vbuf1[i]) >> 8; const uint8_t *r = (const uint8_t *) c->table_rV[V], *g = (const uint8_t *)(c->table_gU[U] + c->table_gV[V]), *b = (const uint8_t *) c->table_bU[U]; dest[ 0] = dest[ 1] = r_b[Y1]; dest[ 2] = dest[ 3] = g[Y1]; dest[ 4] = dest[ 5] = b_r[Y1]; dest[ 6] = dest[ 7] = r_b[Y2]; dest[ 8] = dest[ 9] = g[Y2]; dest[10] = dest[11] = b_r[Y2]; dest += 12; } } }","No, it is non-vulnerable."10751073,"int net_init_tap(QemuOpts *opts, Monitor *mon, const char *name, VLANState *vlan) { TAPState *s; int fd, vnet_hdr = 0; if (qemu_opt_get(opts, ""fd"")) { if (qemu_opt_get(opts, ""ifname"") || qemu_opt_get(opts, ""script"") || qemu_opt_get(opts, ""downscript"") || qemu_opt_get(opts, ""vnet_hdr"")) { error_report(""ifname=, script=, downscript= and vnet_hdr= is invalid with fd=""); return -1; } fd = net_handle_fd_param(mon, qemu_opt_get(opts, ""fd"")); if (fd == -1) { return -1; } fcntl(fd, F_SETFL, O_NONBLOCK); vnet_hdr = tap_probe_vnet_hdr(fd); } else { if (!qemu_opt_get(opts, ""script"")) { qemu_opt_set(opts, ""script"", DEFAULT_NETWORK_SCRIPT); } if (!qemu_opt_get(opts, ""downscript"")) { qemu_opt_set(opts, ""downscript"", DEFAULT_NETWORK_DOWN_SCRIPT); } fd = net_tap_init(opts, &vnet_hdr); if (fd == -1) { return -1; } } s = net_tap_fd_init(vlan, ""tap"", name, fd, vnet_hdr); if (!s) { close(fd); return -1; } if (tap_set_sndbuf(s->fd, opts) < 0) { return -1; } if (qemu_opt_get(opts, ""fd"")) { snprintf(s->nc.info_str, sizeof(s->nc.info_str), ""fd=%d"", fd); } else { const char *ifname, *script, *downscript; ifname = qemu_opt_get(opts, ""ifname""); script = qemu_opt_get(opts, ""script""); downscript = qemu_opt_get(opts, ""downscript""); snprintf(s->nc.info_str, sizeof(s->nc.info_str), ""ifname=%s,script=%s,downscript=%s"", ifname, script, downscript); if (strcmp(downscript, ""no"") != 0) { snprintf(s->down_script, sizeof(s->down_script), ""%s"", downscript); snprintf(s->down_script_arg, sizeof(s->down_script_arg), ""%s"", ifname); } } if (qemu_opt_get_bool(opts, ""vhost"", !!qemu_opt_get(opts, ""vhostfd"") || qemu_opt_get_bool(opts, ""vhostforce"", false))) { int vhostfd, r; bool force = qemu_opt_get_bool(opts, ""vhostforce"", false); if (qemu_opt_get(opts, ""vhostfd"")) { r = net_handle_fd_param(mon, qemu_opt_get(opts, ""vhostfd"")); if (r == -1) { return -1; } vhostfd = r; } else { vhostfd = -1; } s->vhost_net = vhost_net_init(&s->nc, vhostfd, force); if (!s->vhost_net) { error_report(""vhost-net requested but could not be initialized""); return -1; } } else if (qemu_opt_get(opts, ""vhostfd"")) { error_report(""vhostfd= is not valid without vhost""); return -1; } return 0; }","Yes, it is vulnerable."10761074,"static int get_uint64_equal(QEMUFile *f, void *pv, size_t size) { uint64_t *v = pv; uint64_t v2; qemu_get_be64s(f, &v2); if (*v == v2) { return 0; } return -EINVAL; }","Yes, it is vulnerable."10771075,"void spapr_drc_detach(sPAPRDRConnector *drc, DeviceState *d, Error **errp) { trace_spapr_drc_detach(spapr_drc_index(drc)); if (drc->isolation_state != SPAPR_DR_ISOLATION_STATE_ISOLATED) { trace_spapr_drc_awaiting_isolated(spapr_drc_index(drc)); drc->awaiting_release = true; return; } if (spapr_drc_type(drc) != SPAPR_DR_CONNECTOR_TYPE_PCI && drc->allocation_state != SPAPR_DR_ALLOCATION_STATE_UNUSABLE) { trace_spapr_drc_awaiting_unusable(spapr_drc_index(drc)); drc->awaiting_release = true; return; } if (drc->awaiting_allocation) { drc->awaiting_release = true; trace_spapr_drc_awaiting_allocation(spapr_drc_index(drc)); return; } spapr_drc_release(drc); }","Yes, it is vulnerable."10781076,"static int vhost_user_set_log_base(struct vhost_dev *dev, uint64_t base, struct vhost_log *log) { int fds[VHOST_MEMORY_MAX_NREGIONS]; size_t fd_num = 0; bool shmfd = virtio_has_feature(dev->protocol_features, VHOST_USER_PROTOCOL_F_LOG_SHMFD); VhostUserMsg msg = { .request = VHOST_USER_SET_LOG_BASE, .flags = VHOST_USER_VERSION, .u64 = base, .size = sizeof(m.u64), }; if (shmfd && log->fd != -1) { fds[fd_num++] = log->fd; } vhost_user_write(dev, &msg, fds, fd_num); if (shmfd) { msg.size = 0; if (vhost_user_read(dev, &msg) < 0) { return 0; } if (msg.request != VHOST_USER_SET_LOG_BASE) { error_report(""Received unexpected msg type. "" ""Expected %d received %d"", VHOST_USER_SET_LOG_BASE, msg.request); return -1; } } return 0; }","Yes, it is vulnerable."10791077,"static void *vmstate_base_addr(void *opaque, VMStateField *field, bool alloc) { void *base_addr = opaque + field->offset; if (field->flags & VMS_POINTER) { if (alloc && (field->flags & VMS_ALLOC)) { gsize size = 0; if (field->flags & VMS_VBUFFER) { size = vmstate_size(opaque, field); } else { int n_elems = vmstate_n_elems(opaque, field); if (n_elems) { size = n_elems * field->size; } } if (size) { *((void **)base_addr + field->start) = g_malloc(size); } } base_addr = *(void **)base_addr + field->start; } return base_addr; }","Yes, it is vulnerable."10801078,"static void add_pixels_clamped_c(const int16_t *block, uint8_t *av_restrict pixels, ptrdiff_t line_size) { int i; /* read the pixels */ for (i = 0; i < 8; i++) { pixels[0] = av_clip_uint8(pixels[0] + block[0]); pixels[1] = av_clip_uint8(pixels[1] + block[1]); pixels[2] = av_clip_uint8(pixels[2] + block[2]); pixels[3] = av_clip_uint8(pixels[3] + block[3]); pixels[4] = av_clip_uint8(pixels[4] + block[4]); pixels[5] = av_clip_uint8(pixels[5] + block[5]); pixels[6] = av_clip_uint8(pixels[6] + block[6]); pixels[7] = av_clip_uint8(pixels[7] + block[7]); pixels += line_size; block += 8; } }","Yes, it is vulnerable."10811079,"const char *avio_enum_protocols(void **opaque, int output) { URLProtocol *p; *opaque = ffurl_protocol_next(*opaque); if (!(p = *opaque)) return NULL; if ((output && p->url_write) || (!output && p->url_read)) return p->name; return avio_enum_protocols(opaque, output); }","No, it is non-vulnerable."10821080,"static int read_highpass(AVCodecContext *avctx, uint8_t *ptr, int plane, AVFrame *frame) { PixletContext *ctx = avctx->priv_data; ptrdiff_t stride = frame->linesize[plane] / 2; int i, ret; for (i = 0; i < ctx->levels * 3; i++) { int32_t a = bytestream2_get_be32(&ctx->gb); int32_t b = bytestream2_get_be32(&ctx->gb); int32_t c = bytestream2_get_be32(&ctx->gb); int32_t d = bytestream2_get_be32(&ctx->gb); int16_t *dest = (int16_t *)frame->data[plane] + ctx->band[plane][i + 1].x + stride * ctx->band[plane][i + 1].y; unsigned size = ctx->band[plane][i + 1].size; uint32_t magic; magic = bytestream2_get_be32(&ctx->gb); if (magic != 0xDEADBEEF) { av_log(avctx, AV_LOG_ERROR, ""wrong magic number: 0x%08""PRIX32 "" for plane %d, band %d\n"", magic, plane, i); } ret = read_high_coeffs(avctx, ptr + bytestream2_tell(&ctx->gb), dest, size, c, (b >= FFABS(a)) ? b : a, d, ctx->band[plane][i + 1].width, stride); if (ret < 0) { av_log(avctx, AV_LOG_ERROR, ""error in highpass coefficients for plane %d, band %d\n"", plane, i); return ret; } bytestream2_skip(&ctx->gb, ret); } return 0; }","Yes, it is vulnerable."10831081,"static int vp9_superframe_split_filter(AVBSFContext *ctx, AVPacket *out) { VP9SFSplitContext *s = ctx->priv_data; AVPacket *in; int i, j, ret, marker; int is_superframe = !!s->buffer_pkt; if (!s->buffer_pkt) { ret = ff_bsf_get_packet(ctx, &s->buffer_pkt); if (ret < 0) return ret; in = s->buffer_pkt; marker = in->data[in->size - 1]; if ((marker & 0xe0) == 0xc0) { int length_size = 1 + ((marker >> 3) & 0x3); int nb_frames = 1 + (marker & 0x7); int idx_size = 2 + nb_frames * length_size; if (in->size >= idx_size && in->data[in->size - idx_size] == marker) { GetByteContext bc; int total_size = 0; bytestream2_init(&bc, in->data + in->size + 1 - idx_size, nb_frames * length_size); for (i = 0; i < nb_frames; i++) { int frame_size = 0; for (j = 0; j < length_size; j++) frame_size |= bytestream2_get_byte(&bc) << (j * 8); total_size += frame_size; if (total_size > in->size - idx_size) { av_log(ctx, AV_LOG_ERROR, ""Invalid frame size in a superframe: %d\n"", frame_size); ret = AVERROR(EINVAL); goto fail; } s->sizes[i] = frame_size; } s->nb_frames = nb_frames; s->next_frame = 0; s->next_frame_offset = 0; is_superframe = 1; } } } if (is_superframe) { GetBitContext gb; int profile, invisible = 0; ret = av_packet_ref(out, s->buffer_pkt); if (ret < 0) goto fail; out->data += s->next_frame_offset; out->size = s->sizes[s->next_frame]; s->next_frame_offset += out->size; s->next_frame++; if (s->next_frame >= s->nb_frames) av_packet_free(&s->buffer_pkt); ret = init_get_bits8(&gb, out->data, out->size); if (ret < 0) goto fail; get_bits(&gb, 2); // frame_marker profile = get_bits1(&gb); profile |= get_bits1(&gb) << 1; if (profile == 3) get_bits1(&gb); if (!get_bits1(&gb)) { get_bits1(&gb); invisible = !get_bits1(&gb); } if (invisible) out->pts = AV_NOPTS_VALUE; } else { av_packet_move_ref(out, s->buffer_pkt); av_packet_free(&s->buffer_pkt); } return 0; fail: av_packet_free(&s->buffer_pkt); return ret; }","Yes, it is vulnerable."10841082,"static int coroutine_fn v9fs_complete_renameat(V9fsPDU *pdu, int32_t olddirfid, V9fsString *old_name, int32_t newdirfid, V9fsString *new_name) { int err = 0; V9fsState *s = pdu->s; V9fsFidState *newdirfidp = NULL, *olddirfidp = NULL; olddirfidp = get_fid(pdu, olddirfid); if (olddirfidp == NULL) { err = -ENOENT; goto out; } if (newdirfid != -1) { newdirfidp = get_fid(pdu, newdirfid); if (newdirfidp == NULL) { err = -ENOENT; goto out; } } else { newdirfidp = get_fid(pdu, olddirfid); } err = v9fs_co_renameat(pdu, &olddirfidp->path, old_name, &newdirfidp->path, new_name); if (err < 0) { goto out; } if (s->ctx.export_flags & V9FS_PATHNAME_FSCONTEXT) { /* Only for path based fid we need to do the below fixup */ v9fs_fix_fid_paths(pdu, &olddirfidp->path, old_name, &newdirfidp->path, new_name); } out: if (olddirfidp) { put_fid(pdu, olddirfidp); } if (newdirfidp) { put_fid(pdu, newdirfidp); } return err; }","Yes, it is vulnerable."10851083,"static int decode_bytes(const uint8_t *input, uint8_t *out, int bytes) { int i, off; uint32_t c; const uint32_t *buf; uint32_t *output = (uint32_t *)out; off = (intptr_t)input & 3; buf = (const uint32_t *)(input - off); c = av_be2ne32((0x537F6103 >> (off * 8)) | (0x537F6103 << (32 - (off * 8)))); bytes += 3 + off; for (i = 0; i < bytes / 4; i++) output[i] = c ^ buf[i]; if (off) avpriv_request_sample(NULL, ""Offset of %d"", off); return off; }","Yes, it is vulnerable."10861084,"static int encode_frame(AVCodecContext *avctx, unsigned char *buf, int buf_size, void *data){ SnowContext *s = avctx->priv_data; CABACContext * const c= &s->c; AVFrame *pict = data; const int width= s->avctx->width; const int height= s->avctx->height; int used_count= 0; int log2_threshold, level, orientation, plane_index, i; ff_init_cabac_encoder(c, buf, buf_size); ff_init_cabac_states(c, ff_h264_lps_range, ff_h264_mps_state, ff_h264_lps_state, 64); s->input_picture = *pict; memset(s->header_state, 0, sizeof(s->header_state)); s->keyframe=avctx->gop_size==0 || avctx->frame_number % avctx->gop_size == 0; pict->pict_type= s->keyframe ? FF_I_TYPE : FF_P_TYPE; if(pict->quality){ s->qlog= rint(QROOT*log(pict->quality / (float)FF_QP2LAMBDA)/log(2)); //<64 >60 s->qlog += 61; }else{ s->qlog= LOSSLESS_QLOG; } for(i=0; i<s->mb_band.stride * s->mb_band.height; i++){ s->mb_band.buf[i]= s->keyframe; } frame_start(s); if(pict->pict_type == P_TYPE){ int block_width = (width +15)>>4; int block_height= (height+15)>>4; int stride= s->current_picture.linesize[0]; uint8_t *src_plane= s->input_picture.data[0]; int src_stride= s->input_picture.linesize[0]; int x,y; assert(s->current_picture.data[0]); assert(s->last_picture.data[0]); s->m.avctx= s->avctx; s->m.current_picture.data[0]= s->current_picture.data[0]; s->m. last_picture.data[0]= s-> last_picture.data[0]; s->m. new_picture.data[0]= s-> input_picture.data[0]; s->m.current_picture_ptr= &s->m.current_picture; s->m. last_picture_ptr= &s->m. last_picture; s->m.linesize= s->m. last_picture.linesize[0]= s->m. new_picture.linesize[0]= s->m.current_picture.linesize[0]= stride; s->m.width = width; s->m.height= height; s->m.mb_width = block_width; s->m.mb_height= block_height; s->m.mb_stride= s->m.mb_width+1; s->m.b8_stride= 2*s->m.mb_width+1; s->m.f_code=1; s->m.pict_type= pict->pict_type; s->m.me_method= s->avctx->me_method; s->m.me.scene_change_score=0; s->m.flags= s->avctx->flags; s->m.quarter_sample= (s->avctx->flags & CODEC_FLAG_QPEL)!=0; s->m.out_format= FMT_H263; s->m.unrestricted_mv= 1; s->m.lambda= pict->quality * 3/2; //FIXME bug somewhere else s->m.qscale= (s->m.lambda*139 + FF_LAMBDA_SCALE*64) >> (FF_LAMBDA_SHIFT + 7); s->m.lambda2= (s->m.lambda*s->m.lambda + FF_LAMBDA_SCALE/2) >> FF_LAMBDA_SHIFT; if(!s->motion_val8){ s->motion_val8 = av_mallocz(s->m.b8_stride*block_height*2*2*sizeof(int16_t)); s->motion_val16= av_mallocz(s->m.mb_stride*block_height*2*sizeof(int16_t)); } s->m.mb_type= s->mb_type; //dummies, to avoid segfaults s->m.current_picture.mb_mean = s->mb_mean; s->m.current_picture.mb_var = (int16_t*)s->dummy; s->m.current_picture.mc_mb_var= (int16_t*)s->dummy; s->m.current_picture.mb_type = s->dummy; s->m.current_picture.motion_val[0]= s->motion_val8; s->m.p_mv_table= s->motion_val16; s->m.dsp= s->dsp; //move ff_init_me(&s->m); s->m.me.pre_pass=1; s->m.me.dia_size= s->avctx->pre_dia_size; s->m.first_slice_line=1; for(y= block_height-1; y >= 0; y--) { uint8_t src[stride*16]; s->m.new_picture.data[0]= src - y*16*stride; //ugly s->m.mb_y= y; for(i=0; i<16 && i + 16*y<height; i++){ memcpy(&src[i*stride], &src_plane[(i+16*y)*src_stride], width); for(x=width; x<16*block_width; x++) src[i*stride+x]= src[i*stride+x-1]; } for(; i<16 && i + 16*y<16*block_height; i++) memcpy(&src[i*stride], &src[(i-1)*stride], 16*block_width); for(x=block_width-1; x >=0 ;x--) { s->m.mb_x= x; ff_init_block_index(&s->m); ff_update_block_index(&s->m); ff_pre_estimate_p_frame_motion(&s->m, x, y); } s->m.first_slice_line=0; } s->m.me.pre_pass=0; s->m.me.dia_size= s->avctx->dia_size; s->m.first_slice_line=1; for (y = 0; y < block_height; y++) { uint8_t src[stride*16]; s->m.new_picture.data[0]= src - y*16*stride; //ugly s->m.mb_y= y; assert(width <= stride); assert(width <= 16*block_width); for(i=0; i<16 && i + 16*y<height; i++){ memcpy(&src[i*stride], &src_plane[(i+16*y)*src_stride], width); for(x=width; x<16*block_width; x++) src[i*stride+x]= src[i*stride+x-1]; } for(; i<16 && i + 16*y<16*block_height; i++) memcpy(&src[i*stride], &src[(i-1)*stride], 16*block_width); for (x = 0; x < block_width; x++) { int mb_xy= x + y*(s->mb_band.stride); s->m.mb_x= x; ff_init_block_index(&s->m); ff_update_block_index(&s->m); ff_estimate_p_frame_motion(&s->m, x, y); s->mb_band .buf[mb_xy]= (s->m.mb_type[x + y*s->m.mb_stride]&CANDIDATE_MB_TYPE_INTER) ? 0 : 2; s->mv_band[0].buf[mb_xy]= s->motion_val16[x + y*s->m.mb_stride][0]; s->mv_band[1].buf[mb_xy]= s->motion_val16[x + y*s->m.mb_stride][1]; if(s->mb_band .buf[x + y*(s->mb_band.stride)]==2 && 0){ int dc0=128, dc1=128, dc, dc2, dir; int offset= (s->avctx->flags & CODEC_FLAG_QPEL) ? 64 : 32; dc =s->mb_mean[x + y *s->m.mb_stride ]; if(x) dc0=s->mb_mean[x + y *s->m.mb_stride - 1]; if(y) dc1=s->mb_mean[x + (y-1)*s->m.mb_stride ]; dc2= (dc0+dc1)>>1; #if 0 if (ABS(dc0 - dc) < ABS(dc1 - dc) && ABS(dc0 - dc) < ABS(dc2 - dc)) dir= 1; else if(ABS(dc0 - dc) >=ABS(dc1 - dc) && ABS(dc1 - dc) < ABS(dc2 - dc)) dir=-1; else dir=0; #endif if(ABS(dc0 - dc) < ABS(dc1 - dc) && x){ s->mv_band[0].buf[mb_xy]= s->mv_band[0].buf[x + y*(s->mb_band.stride)-1] - offset; s->mv_band[1].buf[mb_xy]= s->mv_band[1].buf[x + y*(s->mb_band.stride)-1]; s->mb_mean[x + y *s->m.mb_stride ]= dc0; }else if(y){ s->mv_band[0].buf[mb_xy]= s->mv_band[0].buf[x + (y-1)*(s->mb_band.stride)]; s->mv_band[1].buf[mb_xy]= s->mv_band[1].buf[x + (y-1)*(s->mb_band.stride)] - offset; s->mb_mean[x + y *s->m.mb_stride ]= dc1; } } // s->mb_band .buf[x + y*(s->mb_band.stride)]=1; //FIXME intra only test } s->m.first_slice_line=0; } assert(s->m.pict_type == P_TYPE); if(s->m.me.scene_change_score > s->avctx->scenechange_threshold){ s->m.pict_type= pict->pict_type =I_TYPE; for(i=0; i<s->mb_band.stride * s->mb_band.height; i++){ s->mb_band.buf[i]= 1; s->mv_band[0].buf[i]= s->mv_band[1].buf[i]= 0; } //printf(""Scene change detected, encoding as I Frame %d %d\n"", s->current_picture.mb_var_sum, s->current_picture.mc_mb_var_sum); } } s->m.first_slice_line=1; s->qbias= pict->pict_type == P_TYPE ? 2 : 0; encode_header(s); decorrelate(s, &s->mb_band , s->mb_band .buf, s->mb_band .stride, 0, 1); decorrelate(s, &s->mv_band[0], s->mv_band[0].buf, s->mv_band[0].stride, 0, 1); decorrelate(s, &s->mv_band[1], s->mv_band[1].buf, s->mv_band[1].stride, 0 ,1); encode_subband(s, &s->mb_band , s->mb_band .buf, NULL, s->mb_band .stride, 0); encode_subband(s, &s->mv_band[0], s->mv_band[0].buf, NULL, s->mv_band[0].stride, 0); encode_subband(s, &s->mv_band[1], s->mv_band[1].buf, NULL, s->mv_band[1].stride, 0); //FIXME avoid this correlate(s, &s->mb_band , s->mb_band .buf, s->mb_band .stride, 1, 1); correlate(s, &s->mv_band[0], s->mv_band[0].buf, s->mv_band[0].stride, 1, 1); correlate(s, &s->mv_band[1], s->mv_band[1].buf, s->mv_band[1].stride, 1, 1); for(plane_index=0; plane_index<3; plane_index++){ Plane *p= &s->plane[plane_index]; int w= p->width; int h= p->height; int x, y; int bits= put_bits_count(&s->c.pb); //FIXME optimize if(pict->data[plane_index]) //FIXME gray hack for(y=0; y<h; y++){ for(x=0; x<w; x++){ s->spatial_dwt_buffer[y*w + x]= pict->data[plane_index][y*pict->linesize[plane_index] + x]<<8; } } predict_plane(s, s->spatial_dwt_buffer, plane_index, 0); if(s->qlog == LOSSLESS_QLOG){ for(y=0; y<h; y++){ for(x=0; x<w; x++){ s->spatial_dwt_buffer[y*w + x]= (s->spatial_dwt_buffer[y*w + x] + 127)>>8; } } } ff_spatial_dwt(s->spatial_dwt_buffer, w, h, w, s->spatial_decomposition_type, s->spatial_decomposition_count); for(level=0; level<s->spatial_decomposition_count; level++){ for(orientation=level ? 1 : 0; orientation<4; orientation++){ SubBand *b= &p->band[level][orientation]; quantize(s, b, b->buf, b->stride, s->qbias); if(orientation==0) decorrelate(s, b, b->buf, b->stride, pict->pict_type == P_TYPE, 0); encode_subband(s, b, b->buf, b->parent ? b->parent->buf : NULL, b->stride, orientation); assert(b->parent==NULL || b->parent->stride == b->stride*2); if(orientation==0) correlate(s, b, b->buf, b->stride, 1, 0); } } // av_log(NULL, AV_LOG_DEBUG, ""plane:%d bits:%d\n"", plane_index, put_bits_count(&s->c.pb) - bits); for(level=0; level<s->spatial_decomposition_count; level++){ for(orientation=level ? 1 : 0; orientation<4; orientation++){ SubBand *b= &p->band[level][orientation]; dequantize(s, b, b->buf, b->stride); } } ff_spatial_idwt(s->spatial_dwt_buffer, w, h, w, s->spatial_decomposition_type, s->spatial_decomposition_count); if(s->qlog == LOSSLESS_QLOG){ for(y=0; y<h; y++){ for(x=0; x<w; x++){ s->spatial_dwt_buffer[y*w + x]<<=8; } } } predict_plane(s, s->spatial_dwt_buffer, plane_index, 1); //FIXME optimize for(y=0; y<h; y++){ for(x=0; x<w; x++){ int v= (s->spatial_dwt_buffer[y*w + x]+128)>>8; if(v&(~255)) v= ~(v>>31); s->current_picture.data[plane_index][y*s->current_picture.linesize[plane_index] + x]= v; } } if(s->avctx->flags&CODEC_FLAG_PSNR){ int64_t error= 0; if(pict->data[plane_index]) //FIXME gray hack for(y=0; y<h; y++){ for(x=0; x<w; x++){ int d= s->current_picture.data[plane_index][y*s->current_picture.linesize[plane_index] + x] - pict->data[plane_index][y*pict->linesize[plane_index] + x]; error += d*d; } } s->avctx->error[plane_index] += error; s->avctx->error[3] += error; } } if(s->last_picture.data[0]) avctx->release_buffer(avctx, &s->last_picture); emms_c(); return put_cabac_terminate(c, 1); }","No, it is non-vulnerable."10871085,"static void rtas_ibm_set_eeh_option(PowerPCCPU *cpu, sPAPREnvironment *spapr, uint32_t token, uint32_t nargs, target_ulong args, uint32_t nret, target_ulong rets) { sPAPRPHBState *sphb; sPAPRPHBClass *spc; uint32_t addr, option; uint64_t buid; int ret; if ((nargs != 4) || (nret != 1)) { goto param_error_exit; } buid = ((uint64_t)rtas_ld(args, 1) << 32) | rtas_ld(args, 2); addr = rtas_ld(args, 0); option = rtas_ld(args, 3); sphb = find_phb(spapr, buid); if (!sphb) { goto param_error_exit; } spc = SPAPR_PCI_HOST_BRIDGE_GET_CLASS(sphb); if (!spc->eeh_set_option) { goto param_error_exit; } ret = spc->eeh_set_option(sphb, addr, option); rtas_st(rets, 0, ret); return; param_error_exit: rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR); }","No, it is non-vulnerable."10881086,"static bool nvic_user_access_ok(NVICState *s, hwaddr offset) { /* Return true if unprivileged access to this register is permitted. */ switch (offset) { case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */ return s->cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK; default: /* All other user accesses cause a BusFault unconditionally */ return false; } }","No, it is non-vulnerable."10891087,"static void kvm_arm_gic_realize(DeviceState *dev, Error **errp) { int i; GICState *s = KVM_ARM_GIC(dev); SysBusDevice *sbd = SYS_BUS_DEVICE(dev); KVMARMGICClass *kgc = KVM_ARM_GIC_GET_CLASS(s); Error *local_err = NULL; int ret; kgc->parent_realize(dev, &local_err); if (local_err) { error_propagate(errp, local_err); i = s->num_irq - GIC_INTERNAL; /* For the GIC, also expose incoming GPIO lines for PPIs for each CPU. * GPIO array layout is thus: * [0..N-1] SPIs * [N..N+31] PPIs for CPU 0 * [N+32..N+63] PPIs for CPU 1 * ... */ i += (GIC_INTERNAL * s->num_cpu); qdev_init_gpio_in(dev, kvm_arm_gic_set_irq, i); /* We never use our outbound IRQ/FIQ lines but provide them so that * we maintain the same interface as the non-KVM GIC. */ for (i = 0; i < s->num_cpu; i++) { sysbus_init_irq(sbd, &s->parent_irq[i]); for (i = 0; i < s->num_cpu; i++) { sysbus_init_irq(sbd, &s->parent_fiq[i]); /* Try to create the device via the device control API */ s->dev_fd = -1; ret = kvm_create_device(kvm_state, KVM_DEV_TYPE_ARM_VGIC_V2, false); if (ret >= 0) { s->dev_fd = ret; } else if (ret != -ENODEV && ret != -ENOTSUP) { error_setg_errno(errp, -ret, ""error creating in-kernel VGIC""); if (kvm_gic_supports_attr(s, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0)) { uint32_t numirqs = s->num_irq; kvm_gic_access(s, KVM_DEV_ARM_VGIC_GRP_NR_IRQS, 0, 0, &numirqs, 1); /* Tell the kernel to complete VGIC initialization now */ if (kvm_gic_supports_attr(s, KVM_DEV_ARM_VGIC_GRP_CTRL, KVM_DEV_ARM_VGIC_CTRL_INIT)) { kvm_gic_access(s, KVM_DEV_ARM_VGIC_GRP_CTRL, KVM_DEV_ARM_VGIC_CTRL_INIT, 0, 0, 1); /* Distributor */ memory_region_init_reservation(&s->iomem, OBJECT(s), ""kvm-gic_dist"", 0x1000); sysbus_init_mmio(sbd, &s->iomem); kvm_arm_register_device(&s->iomem, (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT) | KVM_VGIC_V2_ADDR_TYPE_DIST, KVM_DEV_ARM_VGIC_GRP_ADDR, KVM_VGIC_V2_ADDR_TYPE_DIST, s->dev_fd); /* CPU interface for current core. Unlike arm_gic, we don't * provide the ""interface for core #N"" memory regions, because * cores with a VGIC don't have those. */ memory_region_init_reservation(&s->cpuiomem[0], OBJECT(s), ""kvm-gic_cpu"", 0x1000); sysbus_init_mmio(sbd, &s->cpuiomem[0]); kvm_arm_register_device(&s->cpuiomem[0], (KVM_ARM_DEVICE_VGIC_V2 << KVM_ARM_DEVICE_ID_SHIFT) | KVM_VGIC_V2_ADDR_TYPE_CPU, KVM_DEV_ARM_VGIC_GRP_ADDR, KVM_VGIC_V2_ADDR_TYPE_CPU, s->dev_fd);","Yes, it is vulnerable."10901088,"void inter_predict(VP8Context *s, uint8_t *dst[3], VP8Macroblock *mb, int mb_x, int mb_y) { int x_off = mb_x << 4, y_off = mb_y << 4; int width = 16*s->mb_width, height = 16*s->mb_height; AVFrame *ref = s->framep[mb->ref_frame]; VP56mv *bmv = mb->bmv; switch (mb->partitioning) { case VP8_SPLITMVMODE_NONE: vp8_mc_part(s, dst, ref, x_off, y_off, 0, 0, 16, 16, width, height, &mb->mv); break; case VP8_SPLITMVMODE_4x4: { int x, y; VP56mv uvmv; /* Y */ for (y = 0; y < 4; y++) { for (x = 0; x < 4; x++) { vp8_mc(s, 1, dst[0] + 4*y*s->linesize + x*4, ref->data[0], &bmv[4*y + x], 4*x + x_off, 4*y + y_off, 4, 4, width, height, s->linesize, s->put_pixels_tab[2]); } } /* U/V */ x_off >>= 1; y_off >>= 1; width >>= 1; height >>= 1; for (y = 0; y < 2; y++) { for (x = 0; x < 2; x++) { uvmv.x = mb->bmv[ 2*y * 4 + 2*x ].x + mb->bmv[ 2*y * 4 + 2*x+1].x + mb->bmv[(2*y+1) * 4 + 2*x ].x + mb->bmv[(2*y+1) * 4 + 2*x+1].x; uvmv.y = mb->bmv[ 2*y * 4 + 2*x ].y + mb->bmv[ 2*y * 4 + 2*x+1].y + mb->bmv[(2*y+1) * 4 + 2*x ].y + mb->bmv[(2*y+1) * 4 + 2*x+1].y; uvmv.x = (uvmv.x + 2 + (uvmv.x >> (INT_BIT-1))) >> 2; uvmv.y = (uvmv.y + 2 + (uvmv.y >> (INT_BIT-1))) >> 2; if (s->profile == 3) { uvmv.x &= ~7; uvmv.y &= ~7; } vp8_mc(s, 0, dst[1] + 4*y*s->uvlinesize + x*4, ref->data[1], &uvmv, 4*x + x_off, 4*y + y_off, 4, 4, width, height, s->uvlinesize, s->put_pixels_tab[2]); vp8_mc(s, 0, dst[2] + 4*y*s->uvlinesize + x*4, ref->data[2], &uvmv, 4*x + x_off, 4*y + y_off, 4, 4, width, height, s->uvlinesize, s->put_pixels_tab[2]); } } break; } case VP8_SPLITMVMODE_16x8: vp8_mc_part(s, dst, ref, x_off, y_off, 0, 0, 16, 8, width, height, &bmv[0]); vp8_mc_part(s, dst, ref, x_off, y_off, 0, 8, 16, 8, width, height, &bmv[1]); break; case VP8_SPLITMVMODE_8x16: vp8_mc_part(s, dst, ref, x_off, y_off, 0, 0, 8, 16, width, height, &bmv[0]); vp8_mc_part(s, dst, ref, x_off, y_off, 8, 0, 8, 16, width, height, &bmv[1]); break; case VP8_SPLITMVMODE_8x8: vp8_mc_part(s, dst, ref, x_off, y_off, 0, 0, 8, 8, width, height, &bmv[0]); vp8_mc_part(s, dst, ref, x_off, y_off, 8, 0, 8, 8, width, height, &bmv[1]); vp8_mc_part(s, dst, ref, x_off, y_off, 0, 8, 8, 8, width, height, &bmv[2]); vp8_mc_part(s, dst, ref, x_off, y_off, 8, 8, 8, 8, width, height, &bmv[3]); break; } }","No, it is non-vulnerable."10911089,"static int64_t cpu_get_icount_locked(void) { int64_t icount; CPUState *cpu = current_cpu; icount = timers_state.qemu_icount; if (cpu) { if (!cpu_can_do_io(cpu)) { fprintf(stderr, ""Bad clock read\n""); } icount -= (cpu->icount_decr.u16.low + cpu->icount_extra); } return timers_state.qemu_icount_bias + cpu_icount_to_ns(icount); }","No, it is non-vulnerable."10921090,"static void sigp_start(CPUState *cs, run_on_cpu_data arg) { S390CPU *cpu = S390_CPU(cs); SigpInfo *si = arg.host_ptr; if (s390_cpu_get_state(cpu) != CPU_STATE_STOPPED) { si->cc = SIGP_CC_ORDER_CODE_ACCEPTED; return; } s390_cpu_set_state(CPU_STATE_OPERATING, cpu); si->cc = SIGP_CC_ORDER_CODE_ACCEPTED; }","No, it is non-vulnerable."10931091,"static void pchip_write(void *opaque, hwaddr addr, uint64_t v32, unsigned size) { TyphoonState *s = opaque; uint64_t val, oldval; if (addr & 4) { val = v32 << 32 | s->latch_tmp; addr ^= 4; } else { s->latch_tmp = v32; return; } switch (addr) { case 0x0000: /* WSBA0: Window Space Base Address Register. */ s->pchip.win[0].base_addr = val; break; case 0x0040: /* WSBA1 */ s->pchip.win[1].base_addr = val; break; case 0x0080: /* WSBA2 */ s->pchip.win[2].base_addr = val; break; case 0x00c0: /* WSBA3 */ s->pchip.win[3].base_addr = val; break; case 0x0100: /* WSM0: Window Space Mask Register. */ s->pchip.win[0].mask = val; break; case 0x0140: /* WSM1 */ s->pchip.win[1].mask = val; break; case 0x0180: /* WSM2 */ s->pchip.win[2].mask = val; break; case 0x01c0: /* WSM3 */ s->pchip.win[3].mask = val; break; case 0x0200: /* TBA0: Translated Base Address Register. */ s->pchip.win[0].translated_base_pfn = val >> 10; break; case 0x0240: /* TBA1 */ s->pchip.win[1].translated_base_pfn = val >> 10; break; case 0x0280: /* TBA2 */ s->pchip.win[2].translated_base_pfn = val >> 10; break; case 0x02c0: /* TBA3 */ s->pchip.win[3].translated_base_pfn = val >> 10; break; case 0x0300: /* PCTL: Pchip Control Register. */ oldval = s->pchip.ctl; oldval &= ~0x00001cff0fc7ffull; /* RW fields */ oldval |= val & 0x00001cff0fc7ffull; s->pchip.ctl = oldval; break; case 0x0340: /* PLAT: Pchip Master Latency Register. */ break; case 0x03c0: /* PERROR: Pchip Error Register. */ break; case 0x0400: /* PERRMASK: Pchip Error Mask Register. */ break; case 0x0440: /* PERRSET: Pchip Error Set Register. */ break; case 0x0480: /* TLBIV: Translation Buffer Invalidate Virtual Register. */ break; case 0x04c0: /* TLBIA: Translation Buffer Invalidate All Register (WO). */ break; case 0x0500: /* PMONCTL */ case 0x0540: /* PMONCNT */ case 0x0800: /* SPRST */ break; default: cpu_unassigned_access(current_cpu, addr, true, false, 0, size); return; } }","No, it is non-vulnerable."10941092,"static void vga_precise_update_retrace_info(VGAState *s) { int htotal_chars; int hretr_start_char; int hretr_skew_chars; int hretr_end_char; int vtotal_lines; int vretr_start_line; int vretr_end_line; int div2, sldiv2, dots; int clocking_mode; int clock_sel; const int hz[] = {25175000, 28322000, 25175000, 25175000}; int64_t chars_per_sec; struct vga_precise_retrace *r = &s->retrace_info.precise; htotal_chars = s->cr[0x00] + 5; hretr_start_char = s->cr[0x04]; hretr_skew_chars = (s->cr[0x05] >> 5) & 3; hretr_end_char = s->cr[0x05] & 0x1f; vtotal_lines = (s->cr[0x06] | (((s->cr[0x07] & 1) | ((s->cr[0x07] >> 4) & 2)) << 8)) + 2 ; vretr_start_line = s->cr[0x10] | ((((s->cr[0x07] >> 2) & 1) | ((s->cr[0x07] >> 6) & 2)) << 8) ; vretr_end_line = s->cr[0x11] & 0xf; div2 = (s->cr[0x17] >> 2) & 1; sldiv2 = (s->cr[0x17] >> 3) & 1; clocking_mode = (s->sr[0x01] >> 3) & 1; clock_sel = (s->msr >> 2) & 3; dots = (s->msr & 1) ? 8 : 9; chars_per_sec = hz[clock_sel] / dots; htotal_chars <<= clocking_mode; r->total_chars = vtotal_lines * htotal_chars; if (r->freq) { r->ticks_per_char = ticks_per_sec / (r->total_chars * r->freq); } else { r->ticks_per_char = ticks_per_sec / chars_per_sec; } r->vstart = vretr_start_line; r->vend = r->vstart + vretr_end_line + 1; r->hstart = hretr_start_char + hretr_skew_chars; r->hend = r->hstart + hretr_end_char + 1; r->htotal = htotal_chars; #if 0 printf ( ""hz=%f\n"" ""htotal = %d\n"" ""hretr_start = %d\n"" ""hretr_skew = %d\n"" ""hretr_end = %d\n"" ""vtotal = %d\n"" ""vretr_start = %d\n"" ""vretr_end = %d\n"" ""div2 = %d sldiv2 = %d\n"" ""clocking_mode = %d\n"" ""clock_sel = %d %d\n"" ""dots = %d\n"" ""ticks/char = %lld\n"" ""\n"", (double) ticks_per_sec / (r->ticks_per_char * r->total_chars), htotal_chars, hretr_start_char, hretr_skew_chars, hretr_end_char, vtotal_lines, vretr_start_line, vretr_end_line, div2, sldiv2, clocking_mode, clock_sel, hz[clock_sel], dots, r->ticks_per_char ); #endif }","Yes, it is vulnerable."10951093,"int av_probe_input_buffer2(AVIOContext *pb, AVInputFormat **fmt, const char *filename, void *logctx, unsigned int offset, unsigned int max_probe_size) { AVProbeData pd = { filename ? filename : """", NULL, -offset }; uint8_t *buf = NULL; uint8_t *mime_type; int ret = 0, probe_size, buf_offset = 0; int score = 0; if (!max_probe_size) { max_probe_size = PROBE_BUF_MAX; } else if (max_probe_size > PROBE_BUF_MAX) { max_probe_size = PROBE_BUF_MAX; } else if (max_probe_size < PROBE_BUF_MIN) { av_log(logctx, AV_LOG_ERROR, ""Specified probe size value %u cannot be < %u\n"", max_probe_size, PROBE_BUF_MIN); return AVERROR(EINVAL); } if (offset >= max_probe_size) { return AVERROR(EINVAL); } if (!*fmt && pb->av_class && av_opt_get(pb, ""mime_type"", AV_OPT_SEARCH_CHILDREN, &mime_type) >= 0 && mime_type) { if (!av_strcasecmp(mime_type, ""audio/aacp"")) { *fmt = av_find_input_format(""aac""); } av_freep(&mime_type); } for(probe_size= PROBE_BUF_MIN; probe_size<=max_probe_size && !*fmt; probe_size = FFMIN(probe_size<<1, FFMAX(max_probe_size, probe_size+1))) { if (probe_size < offset) { continue; } score = probe_size < max_probe_size ? AVPROBE_SCORE_RETRY : 0; /* read probe data */ if ((ret = av_reallocp(&buf, probe_size + AVPROBE_PADDING_SIZE)) < 0) return ret; if ((ret = avio_read(pb, buf + buf_offset, probe_size - buf_offset)) < 0) { /* fail if error was not end of file, otherwise, lower score */ if (ret != AVERROR_EOF) { av_free(buf); return ret; } score = 0; ret = 0; /* error was end of file, nothing read */ } buf_offset += ret; pd.buf_size = buf_offset - offset; pd.buf = &buf[offset]; memset(pd.buf + pd.buf_size, 0, AVPROBE_PADDING_SIZE); /* guess file format */ *fmt = av_probe_input_format2(&pd, 1, &score); if(*fmt){ if(score <= AVPROBE_SCORE_RETRY){ //this can only be true in the last iteration av_log(logctx, AV_LOG_WARNING, ""Format %s detected only with low score of %d, misdetection possible!\n"", (*fmt)->name, score); }else av_log(logctx, AV_LOG_DEBUG, ""Format %s probed with size=%d and score=%d\n"", (*fmt)->name, probe_size, score); #if 0 FILE *f = fopen(""probestat.tmp"", ""ab""); fprintf(f, ""probe_size:%d format:%s score:%d filename:%s\n"", probe_size, (*fmt)->name, score, filename); fclose(f); #endif } } if (!*fmt) { av_free(buf); return AVERROR_INVALIDDATA; } /* rewind. reuse probe buffer to avoid seeking */ ret = ffio_rewind_with_probe_data(pb, &buf, pd.buf_size); return ret < 0 ? ret : score; }","Yes, it is vulnerable."10961094,"static ssize_t drop_sync(QIOChannel *ioc, size_t size) { ssize_t ret = 0; char small[1024]; char *buffer; buffer = sizeof(small) < size ? small : g_malloc(MIN(65536, size)); while (size > 0) { ssize_t count = read_sync(ioc, buffer, MIN(65536, size)); if (count <= 0) { goto cleanup; } assert(count <= size); size -= count; ret += count; } cleanup: if (buffer != small) { g_free(buffer); } return ret; }","Yes, it is vulnerable."10971095,"void *qemu_get_virtqueue_element(VirtIODevice *vdev, QEMUFile *f, size_t sz) { VirtQueueElement *elem; VirtQueueElementOld data; int i; qemu_get_buffer(f, (uint8_t *)&data, sizeof(VirtQueueElementOld)); /* TODO: teach all callers that this can fail, and return failure instead * of asserting here. * When we do, we might be able to re-enable NDEBUG below. */ #ifdef NDEBUG #error building with NDEBUG is not supported #endif assert(ARRAY_SIZE(data.in_addr) >= data.in_num); assert(ARRAY_SIZE(data.out_addr) >= data.out_num); elem = virtqueue_alloc_element(sz, data.out_num, data.in_num); elem->index = data.index; for (i = 0; i < elem->in_num; i++) { elem->in_addr[i] = data.in_addr[i]; } for (i = 0; i < elem->out_num; i++) { elem->out_addr[i] = data.out_addr[i]; } for (i = 0; i < elem->in_num; i++) { /* Base is overwritten by virtqueue_map. */ elem->in_sg[i].iov_base = 0; elem->in_sg[i].iov_len = data.in_sg[i].iov_len; } for (i = 0; i < elem->out_num; i++) { /* Base is overwritten by virtqueue_map. */ elem->out_sg[i].iov_base = 0; elem->out_sg[i].iov_len = data.out_sg[i].iov_len; } virtqueue_map(vdev, elem); return elem; }","Yes, it is vulnerable."10981096,"static void mirror_read_complete(void *opaque, int ret) { MirrorOp *op = opaque; MirrorBlockJob *s = op->s; if (ret < 0) { BlockDriverState *source = s->common.bs; BlockErrorAction action; bdrv_set_dirty(source, op->sector_num, op->nb_sectors); action = mirror_error_action(s, true, -ret); if (action == BLOCK_ERROR_ACTION_REPORT && s->ret >= 0) { s->ret = ret; } mirror_iteration_done(op, ret); return; } bdrv_aio_writev(s->target, op->sector_num, &op->qiov, op->nb_sectors, mirror_write_complete, op); }","Yes, it is vulnerable."10991097,"static BlockDriverAIOCB *qcow_aio_writev(BlockDriverState *bs, int64_t sector_num, QEMUIOVector *qiov, int nb_sectors, BlockDriverCompletionFunc *cb, void *opaque) { BDRVQcowState *s = bs->opaque; QCowAIOCB *acb; s->cluster_cache_offset = -1; /* disable compressed cache */ acb = qemu_aio_get(bs, cb, opaque); if (!acb) return NULL; acb->hd_aiocb = NULL; acb->sector_num = sector_num; acb->qiov = qiov; if (qiov->niov > 1) { acb->buf = acb->orig_buf = qemu_memalign(512, qiov->size); qemu_iovec_to_buffer(qiov, acb->buf); } else { acb->buf = (uint8_t *)qiov->iov->iov_base; } acb->nb_sectors = nb_sectors; acb->n = 0; qcow_aio_write_cb(acb, 0); return &acb->common; }","No, it is non-vulnerable."11001098,"static uint32_t vmsvga_bios_read(void *opaque, uint32_t address) { printf(""%s: what are we supposed to return?\n"", __FUNCTION__); return 0xcafe; }","No, it is non-vulnerable."11011099,"static int mov_write_ms_tag(AVIOContext *pb, MOVTrack *track) { int64_t pos = avio_tell(pb); avio_wb32(pb, 0); avio_wl32(pb, track->tag); // store it byteswapped track->enc->codec_tag = av_bswap16(track->tag >> 16); ff_put_wav_header(pb, track->enc, 0); return update_size(pb, pos); }","No, it is non-vulnerable."11021100,"static int copy_to_pbr(DCAXllDecoder *s, uint8_t *data, int size, int delay) { if (size > DCA_XLL_PBR_BUFFER_MAX) return AVERROR(ENOSPC); if (!s->pbr_buffer && !(s->pbr_buffer = av_malloc(DCA_XLL_PBR_BUFFER_MAX + DCA_BUFFER_PADDING_SIZE))) return AVERROR(ENOMEM); memcpy(s->pbr_buffer, data, size); s->pbr_length = size; s->pbr_delay = delay; return 0; }","No, it is non-vulnerable."11031101,"static void sigill_handler (int sig) { if (!canjump) { signal (sig, SIG_DFL); raise (sig); } canjump = 0; siglongjmp (jmpbuf, 1); }","No, it is non-vulnerable."11041102,"static void v9fs_lcreate(void *opaque) { int32_t dfid, flags, mode; gid_t gid; ssize_t err = 0; ssize_t offset = 7; V9fsString name; V9fsFidState *fidp; struct stat stbuf; V9fsQID qid; int32_t iounit; V9fsPDU *pdu = opaque; pdu_unmarshal(pdu, offset, ""dsddd"", &dfid, &name, &flags, &mode, &gid); fidp = get_fid(pdu, dfid); if (fidp == NULL) { err = -ENOENT; goto out_nofid; } flags = get_dotl_openflags(pdu->s, flags); err = v9fs_co_open2(pdu, fidp, &name, gid, flags | O_CREAT, mode, &stbuf); if (err < 0) { goto out; } fidp->fid_type = P9_FID_FILE; fidp->open_flags = flags; if (flags & O_EXCL) { /* * We let the host file system do O_EXCL check * We should not reclaim such fd */ fidp->flags |= FID_NON_RECLAIMABLE; } iounit = get_iounit(pdu, &fidp->path); stat_to_qid(&stbuf, &qid); offset += pdu_marshal(pdu, offset, ""Qd"", &qid, iounit); err = offset; out: put_fid(pdu, fidp); out_nofid: trace_v9fs_lcreate_return(pdu->tag, pdu->id, qid.type, qid.version, qid.path, iounit); complete_pdu(pdu->s, pdu, err); v9fs_string_free(&name); }","Yes, it is vulnerable."11051103,"static int hevc_handle_packet(AVFormatContext *ctx, PayloadContext *rtp_hevc_ctx, AVStream *st, AVPacket *pkt, uint32_t *timestamp, const uint8_t *buf, int len, uint16_t seq, int flags) { const uint8_t *rtp_pl = buf; int tid, lid, nal_type; int first_fragment, last_fragment, fu_type; uint8_t new_nal_header[2]; int res = 0; /* sanity check for size of input packet: 1 byte payload at least */ if (len < RTP_HEVC_PAYLOAD_HEADER_SIZE + 1) { av_log(ctx, AV_LOG_ERROR, ""Too short RTP/HEVC packet, got %d bytes\n"", len); return AVERROR_INVALIDDATA; } /* decode the HEVC payload header according to section 4 of draft version 6: 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |F| Type | LayerId | TID | +-------------+-----------------+ Forbidden zero (F): 1 bit NAL unit type (Type): 6 bits NUH layer ID (LayerId): 6 bits NUH temporal ID plus 1 (TID): 3 bits */ nal_type = (buf[0] >> 1) & 0x3f; lid = ((buf[0] << 5) & 0x20) | ((buf[1] >> 3) & 0x1f); tid = buf[1] & 0x07; /* sanity check for correct layer ID */ if (lid) { /* future scalable or 3D video coding extensions */ avpriv_report_missing_feature(ctx, ""Multi-layer HEVC coding\n""); return AVERROR_PATCHWELCOME; } /* sanity check for correct temporal ID */ if (!tid) { av_log(ctx, AV_LOG_ERROR, ""Illegal temporal ID in RTP/HEVC packet\n""); return AVERROR_INVALIDDATA; } /* sanity check for correct NAL unit type */ if (nal_type > 50) { av_log(ctx, AV_LOG_ERROR, ""Unsupported (HEVC) NAL type (%d)\n"", nal_type); return AVERROR_INVALIDDATA; } switch (nal_type) { /* aggregated packets (AP) */ case 48: /* pass the HEVC payload header */ buf += RTP_HEVC_PAYLOAD_HEADER_SIZE; len -= RTP_HEVC_PAYLOAD_HEADER_SIZE; /* pass the HEVC DONL field */ if (rtp_hevc_ctx->using_donl_field) { buf += RTP_HEVC_DONL_FIELD_SIZE; len -= RTP_HEVC_DONL_FIELD_SIZE; } /* fall-through */ /* video parameter set (VPS) */ case 32: /* sequence parameter set (SPS) */ case 33: /* picture parameter set (PPS) */ case 34: /* supplemental enhancement information (SEI) */ case 39: /* single NAL unit packet */ default: /* sanity check for size of input packet: 1 byte payload at least */ if (len < 1) { av_log(ctx, AV_LOG_ERROR, ""Too short RTP/HEVC packet, got %d bytes of NAL unit type %d\n"", len, nal_type); return AVERROR_INVALIDDATA; } /* create A/V packet */ if ((res = av_new_packet(pkt, sizeof(start_sequence) + len)) < 0) return res; /* A/V packet: copy start sequence */ memcpy(pkt->data, start_sequence, sizeof(start_sequence)); /* A/V packet: copy NAL unit data */ memcpy(pkt->data + sizeof(start_sequence), buf, len); break; /* fragmentation unit (FU) */ case 49: /* pass the HEVC payload header */ buf += RTP_HEVC_PAYLOAD_HEADER_SIZE; len -= RTP_HEVC_PAYLOAD_HEADER_SIZE; if (len < 1) return AVERROR_INVALIDDATA; /* decode the FU header 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |S|E| FuType | +---------------+ Start fragment (S): 1 bit End fragment (E): 1 bit FuType: 6 bits */ first_fragment = buf[0] & 0x80; last_fragment = buf[0] & 0x40; fu_type = buf[0] & 0x3f; /* pass the HEVC FU header */ buf += RTP_HEVC_FU_HEADER_SIZE; len -= RTP_HEVC_FU_HEADER_SIZE; /* pass the HEVC DONL field */ if (rtp_hevc_ctx->using_donl_field) { buf += RTP_HEVC_DONL_FIELD_SIZE; len -= RTP_HEVC_DONL_FIELD_SIZE; } av_dlog(ctx, "" FU type %d with %d bytes\n"", fu_type, len); if (len > 0) { new_nal_header[0] = (rtp_pl[0] & 0x81) | (fu_type << 1); new_nal_header[1] = rtp_pl[1]; /* start fragment vs. subsequent fragments */ if (first_fragment) { if (!last_fragment) { /* create A/V packet which is big enough */ if ((res = av_new_packet(pkt, sizeof(start_sequence) + sizeof(new_nal_header) + len)) < 0) return res; /* A/V packet: copy start sequence */ memcpy(pkt->data, start_sequence, sizeof(start_sequence)); /* A/V packet: copy new NAL header */ memcpy(pkt->data + sizeof(start_sequence), new_nal_header, sizeof(new_nal_header)); /* A/V packet: copy NAL unit data */ memcpy(pkt->data + sizeof(start_sequence) + sizeof(new_nal_header), buf, len); } else { av_log(ctx, AV_LOG_ERROR, ""Illegal combination of S and E bit in RTP/HEVC packet\n""); res = AVERROR_INVALIDDATA; } } else { /* create A/V packet */ if ((res = av_new_packet(pkt, len)) < 0) return res; /* A/V packet: copy NAL unit data */ memcpy(pkt->data, buf, len); } } else { /* sanity check for size of input packet: 1 byte payload at least */ av_log(ctx, AV_LOG_ERROR, ""Too short RTP/HEVC packet, got %d bytes of NAL unit type %d\n"", len, nal_type); res = AVERROR_INVALIDDATA; } break; /* PACI packet */ case 50: /* Temporal scalability control information (TSCI) */ avpriv_report_missing_feature(ctx, ""PACI packets for RTP/HEVC\n""); res = AVERROR_PATCHWELCOME; break; } pkt->stream_index = st->index; return res; }","No, it is non-vulnerable."11061104,"static void openpic_cpu_write_internal(void *opaque, hwaddr addr, uint32_t val, int idx) { OpenPICState *opp = opaque; IRQ_src_t *src; IRQ_dst_t *dst; int s_IRQ, n_IRQ; DPRINTF(""%s: cpu %d addr "" TARGET_FMT_plx "" <= %08x\n"", __func__, idx, addr, val); if (idx < 0) { return; } if (addr & 0xF) return; dst = &opp->dst[idx]; addr &= 0xFF0; switch (addr) { case 0x40: /* IPIDR */ case 0x50: case 0x60: case 0x70: idx = (addr - 0x40) >> 4; /* we use IDE as mask which CPUs to deliver the IPI to still. */ write_IRQreg_ide(opp, opp->irq_ipi0 + idx, opp->src[opp->irq_ipi0 + idx].ide | val); openpic_set_irq(opp, opp->irq_ipi0 + idx, 1); openpic_set_irq(opp, opp->irq_ipi0 + idx, 0); break; case 0x80: /* PCTP */ dst->pctp = val & 0x0000000F; break; case 0x90: /* WHOAMI */ /* Read-only register */ break; case 0xA0: /* PIAC */ /* Read-only register */ break; case 0xB0: /* PEOI */ DPRINTF(""PEOI\n""); s_IRQ = IRQ_get_next(opp, &dst->servicing); IRQ_resetbit(&dst->servicing, s_IRQ); dst->servicing.next = -1; /* Set up next servicing IRQ */ s_IRQ = IRQ_get_next(opp, &dst->servicing); /* Check queued interrupts. */ n_IRQ = IRQ_get_next(opp, &dst->raised); src = &opp->src[n_IRQ]; if (n_IRQ != -1 && (s_IRQ == -1 || IPVP_PRIORITY(src->ipvp) > dst->servicing.priority)) { DPRINTF(""Raise OpenPIC INT output cpu %d irq %d\n"", idx, n_IRQ); openpic_irq_raise(opp, idx, src); } break; default: break; } }","Yes, it is vulnerable."11071105,"int kvm_init(void) { static const char upgrade_note[] = ""Please upgrade to at least kernel 2.6.29 or recent kvm-kmod\n"" ""(see http://sourceforge.net/projects/kvm).\n""; KVMState *s; const KVMCapabilityInfo *missing_cap; int ret; int i; s = g_malloc0(sizeof(KVMState)); #ifdef KVM_CAP_SET_GUEST_DEBUG QTAILQ_INIT(&s->kvm_sw_breakpoints); #endif for (i = 0; i < ARRAY_SIZE(s->slots); i++) { s->slots[i].slot = i; } s->vmfd = -1; s->fd = qemu_open(""/dev/kvm"", O_RDWR); if (s->fd == -1) { fprintf(stderr, ""Could not access KVM kernel module: %m\n""); ret = -errno; goto err; } ret = kvm_ioctl(s, KVM_GET_API_VERSION, 0); if (ret < KVM_API_VERSION) { if (ret > 0) { ret = -EINVAL; } fprintf(stderr, ""kvm version too old\n""); goto err; } if (ret > KVM_API_VERSION) { ret = -EINVAL; fprintf(stderr, ""kvm version not supported\n""); goto err; } s->vmfd = kvm_ioctl(s, KVM_CREATE_VM, 0); if (s->vmfd < 0) { #ifdef TARGET_S390X fprintf(stderr, ""Please add the 'switch_amode' kernel parameter to "" ""your host kernel command line\n""); #endif ret = s->vmfd; goto err; } missing_cap = kvm_check_extension_list(s, kvm_required_capabilites); if (!missing_cap) { missing_cap = kvm_check_extension_list(s, kvm_arch_required_capabilities); } if (missing_cap) { ret = -EINVAL; fprintf(stderr, ""kvm does not support %s\n%s"", missing_cap->name, upgrade_note); goto err; } s->coalesced_mmio = kvm_check_extension(s, KVM_CAP_COALESCED_MMIO); s->broken_set_mem_region = 1; ret = kvm_check_extension(s, KVM_CAP_JOIN_MEMORY_REGIONS_WORKS); if (ret > 0) { s->broken_set_mem_region = 0; } #ifdef KVM_CAP_VCPU_EVENTS s->vcpu_events = kvm_check_extension(s, KVM_CAP_VCPU_EVENTS); #endif s->robust_singlestep = kvm_check_extension(s, KVM_CAP_X86_ROBUST_SINGLESTEP); #ifdef KVM_CAP_DEBUGREGS s->debugregs = kvm_check_extension(s, KVM_CAP_DEBUGREGS); #endif #ifdef KVM_CAP_XSAVE s->xsave = kvm_check_extension(s, KVM_CAP_XSAVE); #endif #ifdef KVM_CAP_XCRS s->xcrs = kvm_check_extension(s, KVM_CAP_XCRS); #endif ret = kvm_arch_init(s); if (ret < 0) { goto err; } kvm_state = s; cpu_register_phys_memory_client(&kvm_cpu_phys_memory_client); s->many_ioeventfds = kvm_check_many_ioeventfds(); cpu_interrupt_handler = kvm_handle_interrupt; return 0; err: if (s) { if (s->vmfd >= 0) { close(s->vmfd); } if (s->fd != -1) { close(s->fd); } } g_free(s); return ret; }","Yes, it is vulnerable."11081106,"static int process_line(URLContext *h, char *line, int line_count, int *new_location) { HTTPContext *s = h->priv_data; char *tag, *p, *end; /* end of header */ if (line[0] == '\0') { s->end_header = 1; return 0; } p = line; if (line_count == 0) { while (!isspace(*p) && *p != '\0') p++; while (isspace(*p)) p++; s->http_code = strtol(p, &end, 10); av_dlog(NULL, ""http_code=%d\n"", s->http_code); /* error codes are 4xx and 5xx, but regard 401 as a success, so we * don't abort until all headers have been parsed. */ if (s->http_code >= 400 && s->http_code < 600 && (s->http_code != 401 || s->auth_state.auth_type != HTTP_AUTH_NONE) && (s->http_code != 407 || s->proxy_auth_state.auth_type != HTTP_AUTH_NONE)) { end += strspn(end, SPACE_CHARS); av_log(h, AV_LOG_WARNING, ""HTTP error %d %s\n"", s->http_code, end); return -1; } } else { while (*p != '\0' && *p != ':') p++; if (*p != ':') return 1; *p = '\0'; tag = line; p++; while (isspace(*p)) p++; if (!av_strcasecmp(tag, ""Location"")) { av_strlcpy(s->location, p, sizeof(s->location)); *new_location = 1; } else if (!av_strcasecmp (tag, ""Content-Length"") && s->filesize == -1) { s->filesize = strtoll(p, NULL, 10); } else if (!av_strcasecmp (tag, ""Content-Range"")) { /* ""bytes $from-$to/$document_size"" */ const char *slash; if (!strncmp (p, ""bytes "", 6)) { p += 6; s->off = strtoll(p, NULL, 10); if ((slash = strchr(p, '/')) && strlen(slash) > 0) s->filesize = strtoll(slash+1, NULL, 10); } if (s->seekable == -1 && (!s->is_akamai || s->filesize != 2147483647)) h->is_streamed = 0; /* we _can_ in fact seek */ } else if (!av_strcasecmp(tag, ""Accept-Ranges"") && !strncmp(p, ""bytes"", 5) && s->seekable == -1) { h->is_streamed = 0; } else if (!av_strcasecmp (tag, ""Transfer-Encoding"") && !av_strncasecmp(p, ""chunked"", 7)) { s->filesize = -1; s->chunksize = 0; } else if (!av_strcasecmp (tag, ""WWW-Authenticate"")) { ff_http_auth_handle_header(&s->auth_state, tag, p); } else if (!av_strcasecmp (tag, ""Authentication-Info"")) { ff_http_auth_handle_header(&s->auth_state, tag, p); } else if (!av_strcasecmp (tag, ""Proxy-Authenticate"")) { ff_http_auth_handle_header(&s->proxy_auth_state, tag, p); } else if (!av_strcasecmp (tag, ""Connection"")) { if (!strcmp(p, ""close"")) s->willclose = 1; } else if (!av_strcasecmp (tag, ""Server"") && !av_strcasecmp (p, ""AkamaiGHost"")) { s->is_akamai = 1; } else if (!av_strcasecmp (tag, ""Content-Type"") && p) { av_free(s->mime_type); s->mime_type = av_strdup(p); } } return 1; }","No, it is non-vulnerable."11091107,g_malloc(size_t n_bytes) { void *mem; __coverity_negative_sink__(n_bytes); mem = malloc(n_bytes == 0 ? 1 : n_bytes); if (!mem) __coverity_panic__(); return mem; },"Yes, it is vulnerable."11101108,"void qemu_get_timedate(struct tm *tm, int offset) { time_t ti; time(&ti); ti += offset; if (rtc_date_offset == -1) { if (rtc_utc) gmtime_r(&ti, tm); else localtime_r(&ti, tm); } else { ti -= rtc_date_offset; gmtime_r(&ti, tm); } }","No, it is non-vulnerable."11111109,"static uint64_t omap_lpg_read(void *opaque, target_phys_addr_t addr, unsigned size) { struct omap_lpg_s *s = (struct omap_lpg_s *) opaque; int offset = addr & OMAP_MPUI_REG_MASK; if (size != 1) { return omap_badwidth_read8(opaque, addr); } switch (offset) { case 0x00: /* LCR */ return s->control; case 0x04: /* PMR */ return s->power; } OMAP_BAD_REG(addr); return 0; }","No, it is non-vulnerable."11121110,"static int gif_encode_frame(AVCodecContext *avctx, unsigned char *outbuf, int buf_size, void *data) { GIFContext *s = avctx->priv_data; AVFrame *pict = data; AVFrame *const p = (AVFrame *)&s->picture; uint8_t *outbuf_ptr = outbuf; *p = *pict; p->pict_type = FF_I_TYPE; p->key_frame = 1; gif_image_write_header(&outbuf_ptr, avctx->width, avctx->height, -1, (uint32_t *)pict->data[1]); gif_image_write_image(&outbuf_ptr, 0, 0, avctx->width, avctx->height, pict->data[0], pict->linesize[0], PIX_FMT_PAL8); return outbuf_ptr - outbuf; }","No, it is non-vulnerable."11131111,"static int local_mksock(FsContext *ctx2, const char *path) { struct sockaddr_un addr; int s; addr.sun_family = AF_UNIX; snprintf(addr.sun_path, 108, ""%s"", rpath(ctx2, path)); s = socket(PF_UNIX, SOCK_STREAM, 0); if (s == -1) { return -1; } if (bind(s, (struct sockaddr *)&addr, sizeof(addr))) { close(s); return -1; } close(s); return 0; }","No, it is non-vulnerable."11141112,av_cold int avcodec_close(AVCodecContext *avctx) { int ret = ff_lock_avcodec(avctx); if (ret < 0) return ret; if (avcodec_is_open(avctx)) { FramePool *pool = avctx->internal->pool; int i; if (HAVE_THREADS && avctx->internal->frame_thread_encoder && avctx->thread_count > 1) { ff_unlock_avcodec(); ff_frame_thread_encoder_free(avctx); ff_lock_avcodec(avctx); } if (HAVE_THREADS && avctx->thread_opaque) ff_thread_free(avctx); if (avctx->codec && avctx->codec->close) avctx->codec->close(avctx); avctx->coded_frame = NULL; avctx->internal->byte_buffer_size = 0; av_freep(&avctx->internal->byte_buffer); if (!avctx->refcounted_frames) av_frame_unref(&avctx->internal->to_free); for (i = 0; i < FF_ARRAY_ELEMS(pool->pools); i++) av_buffer_pool_uninit(&pool->pools[i]); av_freep(&avctx->internal->pool); av_freep(&avctx->internal); } if (avctx->priv_data && avctx->codec && avctx->codec->priv_class) av_opt_free(avctx->priv_data); av_opt_free(avctx); av_freep(&avctx->priv_data); if (av_codec_is_encoder(avctx->codec)) av_freep(&avctx->extradata); avctx->codec = NULL; avctx->active_thread_type = 0; ff_unlock_avcodec(); return 0; },"No, it is non-vulnerable."11151113,"static void virtio_device_free_virtqueues(VirtIODevice *vdev) { int i; if (!vdev->vq) { return; } for (i = 0; i < VIRTIO_QUEUE_MAX; i++) { VRingMemoryRegionCaches *caches; if (vdev->vq[i].vring.num == 0) { break; } caches = atomic_read(&vdev->vq[i].vring.caches); atomic_set(&vdev->vq[i].vring.caches, NULL); virtio_free_region_cache(caches); } g_free(vdev->vq); }","Yes, it is vulnerable."11161114,"static void mpeg_decode_picture_coding_extension(Mpeg1Context *s1) { MpegEncContext *s = &s1->mpeg_enc_ctx; s->full_pel[0] = s->full_pel[1] = 0; s->mpeg_f_code[0][0] = get_bits(&s->gb, 4); s->mpeg_f_code[0][1] = get_bits(&s->gb, 4); s->mpeg_f_code[1][0] = get_bits(&s->gb, 4); s->mpeg_f_code[1][1] = get_bits(&s->gb, 4); if (!s->pict_type && s1->mpeg_enc_ctx_allocated) { av_log(s->avctx, AV_LOG_ERROR, ""Missing picture start code, guessing missing values\n""); if (s->mpeg_f_code[1][0] == 15 && s->mpeg_f_code[1][1] == 15) { if (s->mpeg_f_code[0][0] == 15 && s->mpeg_f_code[0][1] == 15) s->pict_type = AV_PICTURE_TYPE_I; else s->pict_type = AV_PICTURE_TYPE_P; } else s->pict_type = AV_PICTURE_TYPE_B; s->current_picture.f->pict_type = s->pict_type; s->current_picture.f->key_frame = s->pict_type == AV_PICTURE_TYPE_I; } s->intra_dc_precision = get_bits(&s->gb, 2); s->picture_structure = get_bits(&s->gb, 2); s->top_field_first = get_bits1(&s->gb); s->frame_pred_frame_dct = get_bits1(&s->gb); s->concealment_motion_vectors = get_bits1(&s->gb); s->q_scale_type = get_bits1(&s->gb); s->intra_vlc_format = get_bits1(&s->gb); s->alternate_scan = get_bits1(&s->gb); s->repeat_first_field = get_bits1(&s->gb); s->chroma_420_type = get_bits1(&s->gb); s->progressive_frame = get_bits1(&s->gb); if (s->progressive_sequence && !s->progressive_frame) { s->progressive_frame = 1; av_log(s->avctx, AV_LOG_ERROR, ""interlaced frame in progressive sequence, ignoring\n""); } if (s->picture_structure == 0 || (s->progressive_frame && s->picture_structure != PICT_FRAME)) { av_log(s->avctx, AV_LOG_ERROR, ""picture_structure %d invalid, ignoring\n"", s->picture_structure); s->picture_structure = PICT_FRAME; } if (s->progressive_sequence && !s->frame_pred_frame_dct) av_log(s->avctx, AV_LOG_WARNING, ""invalid frame_pred_frame_dct\n""); if (s->picture_structure == PICT_FRAME) { s->first_field = 0; s->v_edge_pos = 16 * s->mb_height; } else { s->first_field ^= 1; s->v_edge_pos = 8 * s->mb_height; memset(s->mbskip_table, 0, s->mb_stride * s->mb_height); } if (s->alternate_scan) { ff_init_scantable(s->idsp.idct_permutation, &s->inter_scantable, ff_alternate_vertical_scan); ff_init_scantable(s->idsp.idct_permutation, &s->intra_scantable, ff_alternate_vertical_scan); } else { ff_init_scantable(s->idsp.idct_permutation, &s->inter_scantable, ff_zigzag_direct); ff_init_scantable(s->idsp.idct_permutation, &s->intra_scantable, ff_zigzag_direct); } /* composite display not parsed */ ff_dlog(s->avctx, ""intra_dc_precision=%d\n"", s->intra_dc_precision); ff_dlog(s->avctx, ""picture_structure=%d\n"", s->picture_structure); ff_dlog(s->avctx, ""top field first=%d\n"", s->top_field_first); ff_dlog(s->avctx, ""repeat first field=%d\n"", s->repeat_first_field); ff_dlog(s->avctx, ""conceal=%d\n"", s->concealment_motion_vectors); ff_dlog(s->avctx, ""intra_vlc_format=%d\n"", s->intra_vlc_format); ff_dlog(s->avctx, ""alternate_scan=%d\n"", s->alternate_scan); ff_dlog(s->avctx, ""frame_pred_frame_dct=%d\n"", s->frame_pred_frame_dct); ff_dlog(s->avctx, ""progressive_frame=%d\n"", s->progressive_frame); }","Yes, it is vulnerable."11171115,"static av_always_inline void mc_dir_part(H264Context *h, Picture *pic, int n, int square, int height, int delta, int list, uint8_t *dest_y, uint8_t *dest_cb, uint8_t *dest_cr, int src_x_offset, int src_y_offset, qpel_mc_func *qpix_op, h264_chroma_mc_func chroma_op, int pixel_shift, int chroma_idc) { const int mx = h->mv_cache[list][scan8[n]][0] + src_x_offset * 8; int my = h->mv_cache[list][scan8[n]][1] + src_y_offset * 8; const int luma_xy = (mx & 3) + ((my & 3) << 2); int offset = ((mx >> 2) << pixel_shift) + (my >> 2) * h->mb_linesize; uint8_t *src_y = pic->f.data[0] + offset; uint8_t *src_cb, *src_cr; int extra_width = 0; int extra_height = 0; int emu = 0; const int full_mx = mx >> 2; const int full_my = my >> 2; const int pic_width = 16 * h->mb_width; const int pic_height = 16 * h->mb_height >> MB_FIELD(h); int ysh; if (mx & 7) extra_width -= 3; if (my & 7) extra_height -= 3; if (full_mx < 0 - extra_width || full_my < 0 - extra_height || full_mx + 16 /*FIXME*/ > pic_width + extra_width || full_my + 16 /*FIXME*/ > pic_height + extra_height) { h->vdsp.emulated_edge_mc(h->edge_emu_buffer, src_y - (2 << pixel_shift) - 2 * h->mb_linesize, h->mb_linesize, 16 + 5, 16 + 5 /*FIXME*/, full_mx - 2, full_my - 2, pic_width, pic_height); src_y = h->edge_emu_buffer + (2 << pixel_shift) + 2 * h->mb_linesize; emu = 1; } qpix_op[luma_xy](dest_y, src_y, h->mb_linesize); // FIXME try variable height perhaps? if (!square) qpix_op[luma_xy](dest_y + delta, src_y + delta, h->mb_linesize); if (CONFIG_GRAY && h->flags & CODEC_FLAG_GRAY) return; if (chroma_idc == 3 /* yuv444 */) { src_cb = pic->f.data[1] + offset; if (emu) { h->vdsp.emulated_edge_mc(h->edge_emu_buffer, src_cb - (2 << pixel_shift) - 2 * h->mb_linesize, h->mb_linesize, 16 + 5, 16 + 5 /*FIXME*/, full_mx - 2, full_my - 2, pic_width, pic_height); src_cb = h->edge_emu_buffer + (2 << pixel_shift) + 2 * h->mb_linesize; } qpix_op[luma_xy](dest_cb, src_cb, h->mb_linesize); // FIXME try variable height perhaps? if (!square) qpix_op[luma_xy](dest_cb + delta, src_cb + delta, h->mb_linesize); src_cr = pic->f.data[2] + offset; if (emu) { h->vdsp.emulated_edge_mc(h->edge_emu_buffer, src_cr - (2 << pixel_shift) - 2 * h->mb_linesize, h->mb_linesize, 16 + 5, 16 + 5 /*FIXME*/, full_mx - 2, full_my - 2, pic_width, pic_height); src_cr = h->edge_emu_buffer + (2 << pixel_shift) + 2 * h->mb_linesize; } qpix_op[luma_xy](dest_cr, src_cr, h->mb_linesize); // FIXME try variable height perhaps? if (!square) qpix_op[luma_xy](dest_cr + delta, src_cr + delta, h->mb_linesize); return; } ysh = 3 - (chroma_idc == 2 /* yuv422 */); if (chroma_idc == 1 /* yuv420 */ && MB_FIELD(h)) { // chroma offset when predicting from a field of opposite parity my += 2 * ((h->mb_y & 1) - (pic->reference - 1)); emu |= (my >> 3) < 0 || (my >> 3) + 8 >= (pic_height >> 1); } src_cb = pic->f.data[1] + ((mx >> 3) << pixel_shift) + (my >> ysh) * h->mb_uvlinesize; src_cr = pic->f.data[2] + ((mx >> 3) << pixel_shift) + (my >> ysh) * h->mb_uvlinesize; if (emu) { h->vdsp.emulated_edge_mc(h->edge_emu_buffer, src_cb, h->mb_uvlinesize, 9, 8 * chroma_idc + 1, (mx >> 3), (my >> ysh), pic_width >> 1, pic_height >> (chroma_idc == 1 /* yuv420 */)); src_cb = h->edge_emu_buffer; } chroma_op(dest_cb, src_cb, h->mb_uvlinesize, height >> (chroma_idc == 1 /* yuv420 */), mx & 7, (my << (chroma_idc == 2 /* yuv422 */)) & 7); if (emu) { h->vdsp.emulated_edge_mc(h->edge_emu_buffer, src_cr, h->mb_uvlinesize, 9, 8 * chroma_idc + 1, (mx >> 3), (my >> ysh), pic_width >> 1, pic_height >> (chroma_idc == 1 /* yuv420 */)); src_cr = h->edge_emu_buffer; } chroma_op(dest_cr, src_cr, h->mb_uvlinesize, height >> (chroma_idc == 1 /* yuv420 */), mx & 7, (my << (chroma_idc == 2 /* yuv422 */)) & 7); }","Yes, it is vulnerable."11181116,"static int av_cold libopus_encode_init(AVCodecContext *avctx) { LibopusEncContext *opus = avctx->priv_data; const uint8_t *channel_mapping; OpusMSEncoder *enc; int ret = OPUS_OK; int coupled_stream_count, header_size, frame_size; coupled_stream_count = opus_coupled_streams[avctx->channels - 1]; opus->stream_count = avctx->channels - coupled_stream_count; channel_mapping = libav_libopus_channel_map[avctx->channels - 1]; /* FIXME: Opus can handle up to 255 channels. However, the mapping for * anything greater than 8 is undefined. */ if (avctx->channels > 8) av_log(avctx, AV_LOG_WARNING, ""Channel layout undefined for %d channels.\n"", avctx->channels); if (!avctx->bit_rate) { /* Sane default copied from opusenc */ avctx->bit_rate = 64000 * opus->stream_count + 32000 * coupled_stream_count; av_log(avctx, AV_LOG_WARNING, ""No bit rate set. Defaulting to %d bps.\n"", avctx->bit_rate); } if (avctx->bit_rate < 500 || avctx->bit_rate > 256000 * avctx->channels) { av_log(avctx, AV_LOG_ERROR, ""The bit rate %d bps is unsupported. "" ""Please choose a value between 500 and %d.\n"", avctx->bit_rate, 256000 * avctx->channels); return AVERROR(EINVAL); } frame_size = opus->opts.frame_duration * 48000 / 1000; switch (frame_size) { case 120: case 240: if (opus->opts.application != OPUS_APPLICATION_RESTRICTED_LOWDELAY) av_log(avctx, AV_LOG_WARNING, ""LPC mode cannot be used with a frame duration of less "" ""than 10ms. Enabling restricted low-delay mode.\n"" ""Use a longer frame duration if this is not what you want.\n""); /* Frame sizes less than 10 ms can only use MDCT mode, so switching to * RESTRICTED_LOWDELAY avoids an unnecessary extra 2.5ms lookahead. */ opus->opts.application = OPUS_APPLICATION_RESTRICTED_LOWDELAY; case 480: case 960: case 1920: case 2880: opus->opts.packet_size = avctx->frame_size = frame_size * avctx->sample_rate / 48000; break; default: av_log(avctx, AV_LOG_ERROR, ""Invalid frame duration: %g.\n"" ""Frame duration must be exactly one of: 2.5, 5, 10, 20, 40 or 60.\n"", opus->opts.frame_duration); return AVERROR(EINVAL); } if (avctx->compression_level < 0 || avctx->compression_level > 10) { av_log(avctx, AV_LOG_WARNING, ""Compression level must be in the range 0 to 10. "" ""Defaulting to 10.\n""); opus->opts.complexity = 10; } else { opus->opts.complexity = avctx->compression_level; } if (avctx->cutoff) { switch (avctx->cutoff) { case 4000: opus->opts.max_bandwidth = OPUS_BANDWIDTH_NARROWBAND; break; case 6000: opus->opts.max_bandwidth = OPUS_BANDWIDTH_MEDIUMBAND; break; case 8000: opus->opts.max_bandwidth = OPUS_BANDWIDTH_WIDEBAND; break; case 12000: opus->opts.max_bandwidth = OPUS_BANDWIDTH_SUPERWIDEBAND; break; case 20000: opus->opts.max_bandwidth = OPUS_BANDWIDTH_FULLBAND; break; default: av_log(avctx, AV_LOG_WARNING, ""Invalid frequency cutoff: %d. Using default maximum bandwidth.\n"" ""Cutoff frequency must be exactly one of: 4000, 6000, 8000, 12000 or 20000.\n"", avctx->cutoff); avctx->cutoff = 0; } } enc = opus_multistream_encoder_create(avctx->sample_rate, avctx->channels, opus->stream_count, coupled_stream_count, channel_mapping, opus->opts.application, &ret); if (ret != OPUS_OK) { av_log(avctx, AV_LOG_ERROR, ""Failed to create encoder: %s\n"", opus_strerror(ret)); return ff_opus_error_to_averror(ret); } ret = libopus_configure_encoder(avctx, enc, &opus->opts); if (ret != OPUS_OK) { ret = ff_opus_error_to_averror(ret); goto fail; } header_size = 19 + (avctx->channels > 2 ? 2 + avctx->channels : 0); avctx->extradata = av_malloc(header_size + FF_INPUT_BUFFER_PADDING_SIZE); if (!avctx->extradata) { av_log(avctx, AV_LOG_ERROR, ""Failed to allocate extradata.\n""); ret = AVERROR(ENOMEM); goto fail; } avctx->extradata_size = header_size; opus->samples = av_mallocz(frame_size * avctx->channels * av_get_bytes_per_sample(avctx->sample_fmt)); if (!opus->samples) { av_log(avctx, AV_LOG_ERROR, ""Failed to allocate samples buffer.\n""); ret = AVERROR(ENOMEM); goto fail; } ret = opus_multistream_encoder_ctl(enc, OPUS_GET_LOOKAHEAD(&avctx->initial_padding)); if (ret != OPUS_OK) av_log(avctx, AV_LOG_WARNING, ""Unable to get number of lookahead samples: %s\n"", opus_strerror(ret)); libopus_write_header(avctx, opus->stream_count, coupled_stream_count, opus_vorbis_channel_map[avctx->channels - 1]); ff_af_queue_init(avctx, &opus->afq); opus->enc = enc; return 0; fail: opus_multistream_encoder_destroy(enc); av_freep(&avctx->extradata); return ret; }","Yes, it is vulnerable."11191117,static int common_end(HYuvContext *s) { int i; for(i = 0; i < 3; i++) { av_freep(&s->temp[i]); } return 0; },"Yes, it is vulnerable."11201118,"static int coroutine_fn raw_co_write_zeroes( BlockDriverState *bs, int64_t sector_num, int nb_sectors, BdrvRequestFlags flags) { BDRVRawState *s = bs->opaque; if (!(flags & BDRV_REQ_MAY_UNMAP)) { return -ENOTSUP; } if (!s->discard_zeroes) { return -ENOTSUP; } return paio_submit_co(bs, s->fd, sector_num, NULL, nb_sectors, QEMU_AIO_DISCARD); }","Yes, it is vulnerable."11211119,"static always_inline int dv_rl2vlc(int run, int l, uint32_t* vlc) { *vlc = dv_vlc_map[run][((uint16_t)l)&0x1ff].vlc; return dv_vlc_map[run][((uint16_t)l)&0x1ff].size; }","No, it is non-vulnerable."11221120,"static int dma_buf_prepare(BMDMAState *bm, int is_write) { IDEState *s = bmdma_active_if(bm); struct { uint32_t addr; uint32_t size; } prd; int l, len; qemu_sglist_init(&s->sg, s->nsector / (TARGET_PAGE_SIZE/512) + 1); s->io_buffer_size = 0; for(;;) { if (bm->cur_prd_len == 0) { /* end of table (with a fail safe of one page) */ if (bm->cur_prd_last || (bm->cur_addr - bm->addr) >= 4096) return s->io_buffer_size != 0; cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8); bm->cur_addr += 8; prd.addr = le32_to_cpu(prd.addr); prd.size = le32_to_cpu(prd.size); len = prd.size & 0xfffe; if (len == 0) len = 0x10000; bm->cur_prd_len = len; bm->cur_prd_addr = prd.addr; bm->cur_prd_last = (prd.size & 0x80000000); } l = bm->cur_prd_len; if (l > 0) { qemu_sglist_add(&s->sg, bm->cur_prd_addr, l); bm->cur_prd_addr += l; bm->cur_prd_len -= l; s->io_buffer_size += l; } } return 1; }","No, it is non-vulnerable."11231121,"static int usb_host_claim_interfaces(USBHostDevice *s, int configuration) { USBDevice *udev = USB_DEVICE(s); struct libusb_config_descriptor *conf; int rc, i; for (i = 0; i < USB_MAX_INTERFACES; i++) { udev->altsetting[i] = 0; } udev->ninterfaces = 0; udev->configuration = 0; if (configuration == 0) { /* address state - ignore */ return USB_RET_SUCCESS; } usb_host_detach_kernel(s); rc = libusb_get_active_config_descriptor(s->dev, &conf); if (rc != 0) { return USB_RET_STALL; } for (i = 0; i < conf->bNumInterfaces; i++) { trace_usb_host_claim_interface(s->bus_num, s->addr, configuration, i); rc = libusb_claim_interface(s->dh, i); usb_host_libusb_error(""libusb_claim_interface"", rc); if (rc != 0) { return USB_RET_STALL; } s->ifs[i].claimed = true; } udev->ninterfaces = conf->bNumInterfaces; udev->configuration = configuration; libusb_free_config_descriptor(conf); return USB_RET_SUCCESS; }","No, it is non-vulnerable."11241122,"static void term_completion(void) { int len, i, j, max_width, nb_cols; char *cmdline; nb_completions = 0; cmdline = qemu_malloc(term_cmd_buf_index + 1); if (!cmdline) return; memcpy(cmdline, term_cmd_buf, term_cmd_buf_index); cmdline[term_cmd_buf_index] = '\0'; find_completion(cmdline); qemu_free(cmdline); /* no completion found */ if (nb_completions <= 0) return; if (nb_completions == 1) { len = strlen(completions[0]); for(i = completion_index; i < len; i++) { term_insert_char(completions[0][i]); } /* extra space for next argument. XXX: make it more generic */ if (len > 0 && completions[0][len - 1] != '/') term_insert_char(' '); } else { term_printf(""\n""); max_width = 0; for(i = 0; i < nb_completions; i++) { len = strlen(completions[i]); if (len > max_width) max_width = len; } max_width += 2; if (max_width < 10) max_width = 10; else if (max_width > 80) max_width = 80; nb_cols = 80 / max_width; j = 0; for(i = 0; i < nb_completions; i++) { term_printf(""%-*s"", max_width, completions[i]); if (++j == nb_cols || i == (nb_completions - 1)) { term_printf(""\n""); j = 0; } } term_show_prompt2(); } }","No, it is non-vulnerable."11251123,"static int parse_vdiname(BDRVSheepdogState *s, const char *filename, char *vdi, uint32_t *snapid, char *tag) { char *p, *q, *uri; const char *host_spec, *vdi_spec; int nr_sep, ret; strstart(filename, ""sheepdog:"", &filename); p = q = g_strdup(filename); /* count the number of separators */ nr_sep = 0; while (*p) { if (*p == ':') { nr_sep++; } p++; } p = q; /* use the first two tokens as host_spec. */ if (nr_sep >= 2) { host_spec = p; p = strchr(p, ':'); p++; p = strchr(p, ':'); *p++ = '\0'; } else { host_spec = """"; } vdi_spec = p; p = strchr(vdi_spec, ':'); if (p) { *p++ = '#'; } uri = g_strdup_printf(""sheepdog://%s/%s"", host_spec, vdi_spec); ret = sd_parse_uri(s, uri, vdi, snapid, tag); g_free(q); g_free(uri); return ret; }","Yes, it is vulnerable."11261124,"static int decode_i2_frame(FourXContext *f, const uint8_t *buf, int length){ int x, y, x2, y2; const int width= f->avctx->width; const int height= f->avctx->height; uint16_t *dst= (uint16_t*)f->current_picture.data[0]; const int stride= f->current_picture.linesize[0]>>1; for(y=0; y<height; y+=16){ for(x=0; x<width; x+=16){ unsigned int color[4], bits; memset(color, 0, sizeof(color)); //warning following is purely guessed ... color[0]= bytestream_get_le16(&buf); color[1]= bytestream_get_le16(&buf); if(color[0]&0x8000) av_log(NULL, AV_LOG_ERROR, ""unk bit 1\n""); if(color[1]&0x8000) av_log(NULL, AV_LOG_ERROR, ""unk bit 2\n""); color[2]= mix(color[0], color[1]); color[3]= mix(color[1], color[0]); bits= bytestream_get_le32(&buf); for(y2=0; y2<16; y2++){ for(x2=0; x2<16; x2++){ int index= 2*(x2>>2) + 8*(y2>>2); dst[y2*stride+x2]= color[(bits>>index)&3]; } } dst+=16; } dst += 16 * stride - x; } return 0; }","Yes, it is vulnerable."11271125,"static int apc_read_header(AVFormatContext *s) { AVIOContext *pb = s->pb; AVStream *st; avio_rl32(pb); /* CRYO */ avio_rl32(pb); /* _APC */ avio_rl32(pb); /* 1.20 */ st = avformat_new_stream(s, NULL); if (!st) return AVERROR(ENOMEM); st->codecpar->codec_type = AVMEDIA_TYPE_AUDIO; st->codecpar->codec_id = AV_CODEC_ID_ADPCM_IMA_APC; avio_rl32(pb); /* number of samples */ st->codecpar->sample_rate = avio_rl32(pb); /* initial predictor values for adpcm decoder */ if (ff_get_extradata(s, st->codecpar, pb, 2 * 4) < 0) return AVERROR(ENOMEM); if (avio_rl32(pb)) { st->codecpar->channels = 2; st->codecpar->channel_layout = AV_CH_LAYOUT_STEREO; } else { st->codecpar->channels = 1; st->codecpar->channel_layout = AV_CH_LAYOUT_MONO; } st->codecpar->bits_per_coded_sample = 4; st->codecpar->bit_rate = st->codecpar->bits_per_coded_sample * st->codecpar->channels * st->codecpar->sample_rate; st->codecpar->block_align = 1; return 0; }","Yes, it is vulnerable."11281126,"static inline uint16_t vring_avail_idx(VirtQueue *vq) { hwaddr pa; pa = vq->vring.avail + offsetof(VRingAvail, idx); return virtio_lduw_phys(vq->vdev, pa); }","No, it is non-vulnerable."11291127,"void cpu_x86_update_cr0(CPUX86State *env) { int pg_state, pe_state; #if defined(DEBUG_MMU) printf(""CR0 update: CR0=0x%08x\n"", env->cr[0]); #endif pg_state = env->cr[0] & CR0_PG_MASK; if (pg_state != last_pg_state) { tlb_flush(env); last_pg_state = pg_state; } /* update PE flag in hidden flags */ pe_state = (env->cr[0] & CR0_PE_MASK); env->hflags = (env->hflags & ~HF_PE_MASK) | (pe_state << HF_PE_SHIFT); /* ensure that ADDSEG is always set in real mode */ env->hflags |= ((pe_state ^ 1) << HF_ADDSEG_SHIFT); }","No, it is non-vulnerable."11301128,static void branch(DBDMA_channel *ch) { dbdma_cmd *current = &ch->current; ch->regs[DBDMA_CMDPTR_LO] = current->cmd_dep; ch->regs[DBDMA_STATUS] |= cpu_to_be32(BT); dbdma_cmdptr_load(ch); },"No, it is non-vulnerable."11311129,"void *ff_png_zalloc(void *opaque, unsigned int items, unsigned int size) { if(items >= UINT_MAX / size) return NULL; return av_malloc(items * size); }","Yes, it is vulnerable."11321130,"static int scsi_get_configuration(SCSIDiskState *s, uint8_t *outbuf) { int current; if (s->qdev.type != TYPE_ROM) { return -1; } current = media_is_dvd(s) ? MMC_PROFILE_DVD_ROM : MMC_PROFILE_CD_ROM; memset(outbuf, 0, 40); stl_be_p(&outbuf[0], 36); /* Bytes after the data length field */ stw_be_p(&outbuf[6], current); /* outbuf[8] - outbuf[19]: Feature 0 - Profile list */ outbuf[10] = 0x03; /* persistent, current */ outbuf[11] = 8; /* two profiles */ stw_be_p(&outbuf[12], MMC_PROFILE_DVD_ROM); outbuf[14] = (current == MMC_PROFILE_DVD_ROM); stw_be_p(&outbuf[16], MMC_PROFILE_CD_ROM); outbuf[18] = (current == MMC_PROFILE_CD_ROM); /* outbuf[20] - outbuf[31]: Feature 1 - Core feature */ stw_be_p(&outbuf[20], 1); outbuf[22] = 0x08 | 0x03; /* version 2, persistent, current */ outbuf[23] = 8; stl_be_p(&outbuf[24], 1); /* SCSI */ outbuf[28] = 1; /* DBE = 1, mandatory */ /* outbuf[32] - outbuf[39]: Feature 3 - Removable media feature */ stw_be_p(&outbuf[32], 3); outbuf[34] = 0x08 | 0x03; /* version 2, persistent, current */ outbuf[35] = 4; outbuf[36] = 0x39; /* tray, load=1, eject=1, unlocked at powerup, lock=1 */ /* TODO: Random readable, CD read, DVD read, drive serial number, power management */ return 40; }","Yes, it is vulnerable."11331131,"static void rx_stop_cont_test(const QVirtioBus *bus, QVirtioDevice *dev, QGuestAllocator *alloc, QVirtQueue *vq, int socket) { uint64_t req_addr; uint32_t free_head; char test[] = ""TEST""; char buffer[64]; int len = htonl(sizeof(test)); struct iovec iov[] = { { .iov_base = &len, .iov_len = sizeof(len), }, { .iov_base = test, .iov_len = sizeof(test), }, }; int ret; req_addr = guest_alloc(alloc, 64); free_head = qvirtqueue_add(vq, req_addr, 64, true, false); qvirtqueue_kick(bus, dev, vq, free_head); qmp(""{ 'execute' : 'stop'}""); ret = iov_send(socket, iov, 2, 0, sizeof(len) + sizeof(test)); g_assert_cmpint(ret, ==, sizeof(test) + sizeof(len)); /* We could check the status, but this command is more importantly to * ensure the packet data gets queued in QEMU, before we do 'cont'. */ qmp(""{ 'execute' : 'query-status'}""); qmp(""{ 'execute' : 'cont'}""); qvirtio_wait_queue_isr(bus, dev, vq, QVIRTIO_NET_TIMEOUT_US); memread(req_addr + VNET_HDR_SIZE, buffer, sizeof(test)); g_assert_cmpstr(buffer, ==, ""TEST""); guest_free(alloc, req_addr); }","Yes, it is vulnerable."11341132,"static inline void fill_caches(H264Context *h, int mb_type){ MpegEncContext * const s = &h->s; const int mb_xy= s->mb_x + s->mb_y*s->mb_stride; int topleft_xy, top_xy, topright_xy, left_xy[2]; int topleft_type, top_type, topright_type, left_type[2]; int left_block[4]; int i; //wow what a mess, why didnt they simplify the interlacing&intra stuff, i cant imagine that these complex rules are worth it if(h->sps.mb_aff){ //FIXME topleft_xy = 0; /* avoid warning */ top_xy = 0; /* avoid warning */ topright_xy = 0; /* avoid warning */ }else{ topleft_xy = mb_xy-1 - s->mb_stride; top_xy = mb_xy - s->mb_stride; topright_xy= mb_xy+1 - s->mb_stride; left_xy[0] = mb_xy-1; left_xy[1] = mb_xy-1; left_block[0]= 0; left_block[1]= 1; left_block[2]= 2; left_block[3]= 3; } topleft_type = h->slice_table[topleft_xy ] == h->slice_num ? s->current_picture.mb_type[topleft_xy] : 0; top_type = h->slice_table[top_xy ] == h->slice_num ? s->current_picture.mb_type[top_xy] : 0; topright_type= h->slice_table[topright_xy] == h->slice_num ? s->current_picture.mb_type[topright_xy]: 0; left_type[0] = h->slice_table[left_xy[0] ] == h->slice_num ? s->current_picture.mb_type[left_xy[0]] : 0; left_type[1] = h->slice_table[left_xy[1] ] == h->slice_num ? s->current_picture.mb_type[left_xy[1]] : 0; if(IS_INTRA(mb_type)){ h->topleft_samples_available= h->top_samples_available= h->left_samples_available= 0xFFFF; h->topright_samples_available= 0xEEEA; if(!IS_INTRA(top_type) && (top_type==0 || h->pps.constrained_intra_pred)){ h->topleft_samples_available= 0xB3FF; h->top_samples_available= 0x33FF; h->topright_samples_available= 0x26EA; } for(i=0; i<2; i++){ if(!IS_INTRA(left_type[i]) && (left_type[i]==0 || h->pps.constrained_intra_pred)){ h->topleft_samples_available&= 0xDF5F; h->left_samples_available&= 0x5F5F; } } if(!IS_INTRA(topleft_type) && (topleft_type==0 || h->pps.constrained_intra_pred)) h->topleft_samples_available&= 0x7FFF; if(!IS_INTRA(topright_type) && (topright_type==0 || h->pps.constrained_intra_pred)) h->topright_samples_available&= 0xFBFF; if(IS_INTRA4x4(mb_type)){ if(IS_INTRA4x4(top_type)){ h->intra4x4_pred_mode_cache[4+8*0]= h->intra4x4_pred_mode[top_xy][4]; h->intra4x4_pred_mode_cache[5+8*0]= h->intra4x4_pred_mode[top_xy][5]; h->intra4x4_pred_mode_cache[6+8*0]= h->intra4x4_pred_mode[top_xy][6]; h->intra4x4_pred_mode_cache[7+8*0]= h->intra4x4_pred_mode[top_xy][3]; }else{ int pred; if(IS_INTRA16x16(top_type) || (IS_INTER(top_type) && !h->pps.constrained_intra_pred)) pred= 2; else{ pred= -1; } h->intra4x4_pred_mode_cache[4+8*0]= h->intra4x4_pred_mode_cache[5+8*0]= h->intra4x4_pred_mode_cache[6+8*0]= h->intra4x4_pred_mode_cache[7+8*0]= pred; } for(i=0; i<2; i++){ if(IS_INTRA4x4(left_type[i])){ h->intra4x4_pred_mode_cache[3+8*1 + 2*8*i]= h->intra4x4_pred_mode[left_xy[i]][left_block[0+2*i]]; h->intra4x4_pred_mode_cache[3+8*2 + 2*8*i]= h->intra4x4_pred_mode[left_xy[i]][left_block[1+2*i]]; }else{ int pred; if(IS_INTRA16x16(left_type[i]) || (IS_INTER(left_type[i]) && !h->pps.constrained_intra_pred)) pred= 2; else{ pred= -1; } h->intra4x4_pred_mode_cache[3+8*1 + 2*8*i]= h->intra4x4_pred_mode_cache[3+8*2 + 2*8*i]= pred; } } } } /* 0 . T T. T T T T 1 L . .L . . . . 2 L . .L . . . . 3 . T TL . . . . 4 L . .L . . . . 5 L . .. . . . . */ //FIXME constraint_intra_pred & partitioning & nnz (lets hope this is just a typo in the spec) if(top_type){ h->non_zero_count_cache[4+8*0]= h->non_zero_count[top_xy][10]; h->non_zero_count_cache[5+8*0]= h->non_zero_count[top_xy][11]; h->non_zero_count_cache[6+8*0]= h->non_zero_count[top_xy][14]; h->non_zero_count_cache[7+8*0]= h->non_zero_count[top_xy][15]; h->non_zero_count_cache[1+8*0]= h->non_zero_count[top_xy][18]; h->non_zero_count_cache[2+8*0]= h->non_zero_count[top_xy][19]; h->non_zero_count_cache[1+8*3]= h->non_zero_count[top_xy][22]; h->non_zero_count_cache[2+8*3]= h->non_zero_count[top_xy][23]; }else{ h->non_zero_count_cache[4+8*0]= h->non_zero_count_cache[5+8*0]= h->non_zero_count_cache[6+8*0]= h->non_zero_count_cache[7+8*0]= h->non_zero_count_cache[1+8*0]= h->non_zero_count_cache[2+8*0]= h->non_zero_count_cache[1+8*3]= h->non_zero_count_cache[2+8*3]= 64; } if(left_type[0]){ h->non_zero_count_cache[3+8*1]= h->non_zero_count[left_xy[0]][5]; h->non_zero_count_cache[3+8*2]= h->non_zero_count[left_xy[0]][7]; h->non_zero_count_cache[0+8*1]= h->non_zero_count[left_xy[0]][17]; //FIXME left_block h->non_zero_count_cache[0+8*4]= h->non_zero_count[left_xy[0]][21]; }else{ h->non_zero_count_cache[3+8*1]= h->non_zero_count_cache[3+8*2]= h->non_zero_count_cache[0+8*1]= h->non_zero_count_cache[0+8*4]= 64; } if(left_type[1]){ h->non_zero_count_cache[3+8*3]= h->non_zero_count[left_xy[1]][13]; h->non_zero_count_cache[3+8*4]= h->non_zero_count[left_xy[1]][15]; h->non_zero_count_cache[0+8*2]= h->non_zero_count[left_xy[1]][19]; h->non_zero_count_cache[0+8*5]= h->non_zero_count[left_xy[1]][23]; }else{ h->non_zero_count_cache[3+8*3]= h->non_zero_count_cache[3+8*4]= h->non_zero_count_cache[0+8*2]= h->non_zero_count_cache[0+8*5]= 64; } #if 1 if(IS_INTER(mb_type)){ int list; for(list=0; list<2; list++){ if((!IS_8X8(mb_type)) && !USES_LIST(mb_type, list)){ /*if(!h->mv_cache_clean[list]){ memset(h->mv_cache [list], 0, 8*5*2*sizeof(int16_t)); //FIXME clean only input? clean at all? memset(h->ref_cache[list], PART_NOT_AVAILABLE, 8*5*sizeof(int8_t)); h->mv_cache_clean[list]= 1; }*/ continue; //FIXME direct mode ... } h->mv_cache_clean[list]= 0; if(IS_INTER(topleft_type)){ const int b_xy = h->mb2b_xy[topleft_xy] + 3 + 3*h->b_stride; const int b8_xy= h->mb2b8_xy[topleft_xy] + 1 + h->b8_stride; *(uint32_t*)h->mv_cache[list][scan8[0] - 1 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy]; h->ref_cache[list][scan8[0] - 1 - 1*8]= s->current_picture.ref_index[list][b8_xy]; }else{ *(uint32_t*)h->mv_cache[list][scan8[0] - 1 - 1*8]= 0; h->ref_cache[list][scan8[0] - 1 - 1*8]= topleft_type ? LIST_NOT_USED : PART_NOT_AVAILABLE; } if(IS_INTER(top_type)){ const int b_xy= h->mb2b_xy[top_xy] + 3*h->b_stride; const int b8_xy= h->mb2b8_xy[top_xy] + h->b8_stride; *(uint32_t*)h->mv_cache[list][scan8[0] + 0 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + 0]; *(uint32_t*)h->mv_cache[list][scan8[0] + 1 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + 1]; *(uint32_t*)h->mv_cache[list][scan8[0] + 2 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + 2]; *(uint32_t*)h->mv_cache[list][scan8[0] + 3 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + 3]; h->ref_cache[list][scan8[0] + 0 - 1*8]= h->ref_cache[list][scan8[0] + 1 - 1*8]= s->current_picture.ref_index[list][b8_xy + 0]; h->ref_cache[list][scan8[0] + 2 - 1*8]= h->ref_cache[list][scan8[0] + 3 - 1*8]= s->current_picture.ref_index[list][b8_xy + 1]; }else{ *(uint32_t*)h->mv_cache [list][scan8[0] + 0 - 1*8]= *(uint32_t*)h->mv_cache [list][scan8[0] + 1 - 1*8]= *(uint32_t*)h->mv_cache [list][scan8[0] + 2 - 1*8]= *(uint32_t*)h->mv_cache [list][scan8[0] + 3 - 1*8]= 0; *(uint32_t*)&h->ref_cache[list][scan8[0] + 0 - 1*8]= ((top_type ? LIST_NOT_USED : PART_NOT_AVAILABLE)&0xFF)*0x01010101; } if(IS_INTER(topright_type)){ const int b_xy= h->mb2b_xy[topright_xy] + 3*h->b_stride; const int b8_xy= h->mb2b8_xy[topright_xy] + h->b8_stride; *(uint32_t*)h->mv_cache[list][scan8[0] + 4 - 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy]; h->ref_cache[list][scan8[0] + 4 - 1*8]= s->current_picture.ref_index[list][b8_xy]; }else{ *(uint32_t*)h->mv_cache [list][scan8[0] + 4 - 1*8]= 0; h->ref_cache[list][scan8[0] + 4 - 1*8]= topright_type ? LIST_NOT_USED : PART_NOT_AVAILABLE; } //FIXME unify cleanup or sth if(IS_INTER(left_type[0])){ const int b_xy= h->mb2b_xy[left_xy[0]] + 3; const int b8_xy= h->mb2b8_xy[left_xy[0]] + 1; *(uint32_t*)h->mv_cache[list][scan8[0] - 1 + 0*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + h->b_stride*left_block[0]]; *(uint32_t*)h->mv_cache[list][scan8[0] - 1 + 1*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + h->b_stride*left_block[1]]; h->ref_cache[list][scan8[0] - 1 + 0*8]= h->ref_cache[list][scan8[0] - 1 + 1*8]= s->current_picture.ref_index[list][b8_xy + h->b8_stride*(left_block[0]>>1)]; }else{ *(uint32_t*)h->mv_cache [list][scan8[0] - 1 + 0*8]= *(uint32_t*)h->mv_cache [list][scan8[0] - 1 + 1*8]= 0; h->ref_cache[list][scan8[0] - 1 + 0*8]= h->ref_cache[list][scan8[0] - 1 + 1*8]= left_type[0] ? LIST_NOT_USED : PART_NOT_AVAILABLE; } if(IS_INTER(left_type[1])){ const int b_xy= h->mb2b_xy[left_xy[1]] + 3; const int b8_xy= h->mb2b8_xy[left_xy[1]] + 1; *(uint32_t*)h->mv_cache[list][scan8[0] - 1 + 2*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + h->b_stride*left_block[2]]; *(uint32_t*)h->mv_cache[list][scan8[0] - 1 + 3*8]= *(uint32_t*)s->current_picture.motion_val[list][b_xy + h->b_stride*left_block[3]]; h->ref_cache[list][scan8[0] - 1 + 2*8]= h->ref_cache[list][scan8[0] - 1 + 3*8]= s->current_picture.ref_index[list][b8_xy + h->b8_stride*(left_block[2]>>1)]; }else{ *(uint32_t*)h->mv_cache [list][scan8[0] - 1 + 2*8]= *(uint32_t*)h->mv_cache [list][scan8[0] - 1 + 3*8]= 0; h->ref_cache[list][scan8[0] - 1 + 2*8]= h->ref_cache[list][scan8[0] - 1 + 3*8]= left_type[0] ? LIST_NOT_USED : PART_NOT_AVAILABLE; } h->ref_cache[list][scan8[5 ]+1] = h->ref_cache[list][scan8[7 ]+1] = h->ref_cache[list][scan8[13]+1] = //FIXME remove past 3 (init somewher else) h->ref_cache[list][scan8[4 ]] = h->ref_cache[list][scan8[12]] = PART_NOT_AVAILABLE; *(uint32_t*)h->mv_cache [list][scan8[5 ]+1]= *(uint32_t*)h->mv_cache [list][scan8[7 ]+1]= *(uint32_t*)h->mv_cache [list][scan8[13]+1]= //FIXME remove past 3 (init somewher else) *(uint32_t*)h->mv_cache [list][scan8[4 ]]= *(uint32_t*)h->mv_cache [list][scan8[12]]= 0; } //FIXME } #endif }","No, it is non-vulnerable."11351133,"static void nbd_read(void *opaque) { NBDClient *client = opaque; if (client->recv_coroutine) { qemu_coroutine_enter(client->recv_coroutine, NULL); } else { qemu_coroutine_enter(qemu_coroutine_create(nbd_trip), client); } }","Yes, it is vulnerable."11361134,"int qemu_eventfd(int *fds) { #if defined(SYS_eventfd) int ret; ret = syscall(SYS_eventfd, 0); if (ret >= 0) { fds[0] = fds[1] = ret; return 0; } else if (!(ret == -1 && errno == ENOSYS)) return ret; #endif return pipe(fds); }","Yes, it is vulnerable."11371135,"int64_t ga_get_fd_handle(GAState *s, Error **errp) { int64_t handle; g_assert(s->pstate_filepath); /* we blacklist commands and avoid operations that potentially require * writing to disk when we're in a frozen state. this includes opening * new files, so we should never get here in that situation */ g_assert(!ga_is_frozen(s)); handle = s->pstate.fd_counter++; if (s->pstate.fd_counter < 0) { s->pstate.fd_counter = 0; } if (!write_persistent_state(&s->pstate, s->pstate_filepath)) { error_setg(errp, ""failed to commit persistent state to disk""); } return handle; }","Yes, it is vulnerable."11381136,"static void opt_input_file(const char *filename) { AVFormatContext *ic; AVFormatParameters params, *ap = &params; AVInputFormat *file_iformat = NULL; int err, i, ret, rfps, rfps_base; int64_t timestamp; if (last_asked_format) { if (!(file_iformat = av_find_input_format(last_asked_format))) { fprintf(stderr, ""Unknown input format: '%s'\n"", last_asked_format); ffmpeg_exit(1); } last_asked_format = NULL; } if (!strcmp(filename, ""-"")) filename = ""pipe:""; using_stdin |= !strncmp(filename, ""pipe:"", 5) || !strcmp(filename, ""/dev/stdin""); /* get default parameters from command line */ ic = avformat_alloc_context(); if (!ic) { print_error(filename, AVERROR(ENOMEM)); ffmpeg_exit(1); } memset(ap, 0, sizeof(*ap)); ap->prealloced_context = 1; ap->sample_rate = audio_sample_rate; ap->channels = audio_channels; ap->time_base.den = frame_rate.num; ap->time_base.num = frame_rate.den; ap->width = frame_width; ap->height = frame_height; ap->pix_fmt = frame_pix_fmt; // ap->sample_fmt = audio_sample_fmt; //FIXME:not implemented in libavformat ap->channel = video_channel; ap->standard = video_standard; set_context_opts(ic, avformat_opts, AV_OPT_FLAG_DECODING_PARAM, NULL); ic->video_codec_id = find_codec_or_die(video_codec_name , AVMEDIA_TYPE_VIDEO , 0, avcodec_opts[AVMEDIA_TYPE_VIDEO ]->strict_std_compliance); ic->audio_codec_id = find_codec_or_die(audio_codec_name , AVMEDIA_TYPE_AUDIO , 0, avcodec_opts[AVMEDIA_TYPE_AUDIO ]->strict_std_compliance); ic->subtitle_codec_id= find_codec_or_die(subtitle_codec_name, AVMEDIA_TYPE_SUBTITLE, 0, avcodec_opts[AVMEDIA_TYPE_SUBTITLE]->strict_std_compliance); ic->flags |= AVFMT_FLAG_NONBLOCK; if(pgmyuv_compatibility_hack) ic->video_codec_id= CODEC_ID_PGMYUV; /* open the input file with generic libav function */ err = av_open_input_file(&ic, filename, file_iformat, 0, ap); if (err < 0) { print_error(filename, err); ffmpeg_exit(1); } if(opt_programid) { int i, j; int found=0; for(i=0; i<ic->nb_streams; i++){ ic->streams[i]->discard= AVDISCARD_ALL; } for(i=0; i<ic->nb_programs; i++){ AVProgram *p= ic->programs[i]; if(p->id != opt_programid){ p->discard = AVDISCARD_ALL; }else{ found=1; for(j=0; j<p->nb_stream_indexes; j++){ ic->streams[p->stream_index[j]]->discard= AVDISCARD_DEFAULT; } } } if(!found){ fprintf(stderr, ""Specified program id not found\n""); ffmpeg_exit(1); } opt_programid=0; } ic->loop_input = loop_input; /* If not enough info to get the stream parameters, we decode the first frames to get it. (used in mpeg case for example) */ ret = av_find_stream_info(ic); if (ret < 0 && verbose >= 0) { fprintf(stderr, ""%s: could not find codec parameters\n"", filename); av_close_input_file(ic); ffmpeg_exit(1); } timestamp = start_time; /* add the stream start time */ if (ic->start_time != AV_NOPTS_VALUE) timestamp += ic->start_time; /* if seeking requested, we execute it */ if (start_time != 0) { ret = av_seek_frame(ic, -1, timestamp, AVSEEK_FLAG_BACKWARD); if (ret < 0) { fprintf(stderr, ""%s: could not seek to position %0.3f\n"", filename, (double)timestamp / AV_TIME_BASE); } /* reset seek info */ start_time = 0; } /* update the current parameters so that they match the one of the input stream */ for(i=0;i<ic->nb_streams;i++) { AVStream *st = ic->streams[i]; AVCodecContext *dec = st->codec; avcodec_thread_init(dec, thread_count); input_codecs = grow_array(input_codecs, sizeof(*input_codecs), &nb_input_codecs, nb_input_codecs + 1); switch (dec->codec_type) { case AVMEDIA_TYPE_AUDIO: input_codecs[nb_input_codecs-1] = avcodec_find_decoder_by_name(audio_codec_name); set_context_opts(dec, avcodec_opts[AVMEDIA_TYPE_AUDIO], AV_OPT_FLAG_AUDIO_PARAM | AV_OPT_FLAG_DECODING_PARAM, input_codecs[nb_input_codecs-1]); //fprintf(stderr, ""\nInput Audio channels: %d"", dec->channels); channel_layout = dec->channel_layout; audio_channels = dec->channels; audio_sample_rate = dec->sample_rate; audio_sample_fmt = dec->sample_fmt; if(audio_disable) st->discard= AVDISCARD_ALL; /* Note that av_find_stream_info can add more streams, and we * currently have no chance of setting up lowres decoding * early enough for them. */ if (dec->lowres) audio_sample_rate >>= dec->lowres; break; case AVMEDIA_TYPE_VIDEO: input_codecs[nb_input_codecs-1] = avcodec_find_decoder_by_name(video_codec_name); set_context_opts(dec, avcodec_opts[AVMEDIA_TYPE_VIDEO], AV_OPT_FLAG_VIDEO_PARAM | AV_OPT_FLAG_DECODING_PARAM, input_codecs[nb_input_codecs-1]); frame_height = dec->height; frame_width = dec->width; if(ic->streams[i]->sample_aspect_ratio.num) frame_aspect_ratio=av_q2d(ic->streams[i]->sample_aspect_ratio); else frame_aspect_ratio=av_q2d(dec->sample_aspect_ratio); frame_aspect_ratio *= (float) dec->width / dec->height; frame_pix_fmt = dec->pix_fmt; rfps = ic->streams[i]->r_frame_rate.num; rfps_base = ic->streams[i]->r_frame_rate.den; if (dec->lowres) { dec->flags |= CODEC_FLAG_EMU_EDGE; frame_height >>= dec->lowres; frame_width >>= dec->lowres; } if(me_threshold) dec->debug |= FF_DEBUG_MV; if (dec->time_base.den != rfps*dec->ticks_per_frame || dec->time_base.num != rfps_base) { if (verbose >= 0) fprintf(stderr,""\nSeems stream %d codec frame rate differs from container frame rate: %2.2f (%d/%d) -> %2.2f (%d/%d)\n"", i, (float)dec->time_base.den / dec->time_base.num, dec->time_base.den, dec->time_base.num, (float)rfps / rfps_base, rfps, rfps_base); } /* update the current frame rate to match the stream frame rate */ frame_rate.num = rfps; frame_rate.den = rfps_base; if(video_disable) st->discard= AVDISCARD_ALL; else if(video_discard) st->discard= video_discard; break; case AVMEDIA_TYPE_DATA: break; case AVMEDIA_TYPE_SUBTITLE: input_codecs[nb_input_codecs-1] = avcodec_find_decoder_by_name(subtitle_codec_name); if(subtitle_disable) st->discard = AVDISCARD_ALL; break; case AVMEDIA_TYPE_ATTACHMENT: case AVMEDIA_TYPE_UNKNOWN: break; default: abort(); } } input_files[nb_input_files] = ic; input_files_ts_offset[nb_input_files] = input_ts_offset - (copy_ts ? 0 : timestamp); /* dump the file content */ if (verbose >= 0) dump_format(ic, nb_input_files, filename, 0); nb_input_files++; video_channel = 0; av_freep(&video_codec_name); av_freep(&audio_codec_name); av_freep(&subtitle_codec_name); }","No, it is non-vulnerable."11391137,"static void gen_load_fpr32h(TCGv_i32 t, int reg) { TCGv_i64 t64 = tcg_temp_new_i64(); tcg_gen_shri_i64(t64, fpu_f64[reg], 32); tcg_gen_trunc_i64_i32(t, t64); tcg_temp_free_i64(t64); }","No, it is non-vulnerable."11401138,"void block_job_completed(BlockJob *job, int ret) { BlockDriverState *bs = job->bs; assert(bs->job == job); job->cb(job->opaque, ret); bs->job = NULL; g_free(job); bdrv_set_in_use(bs, 0); }","No, it is non-vulnerable."11411139,"static int alloc_frame_buffer(MpegEncContext *s, Picture *pic) { int r; if (s->avctx->hwaccel) { assert(!pic->hwaccel_data_private); if (s->avctx->hwaccel->priv_data_size) { pic->hwaccel_data_private = av_malloc(s->avctx->hwaccel->priv_data_size); if (!pic->hwaccel_data_private) { av_log(s->avctx, AV_LOG_ERROR, ""alloc_frame_buffer() failed (hwaccel private data allocation)\n""); return -1; } } } r = s->avctx->get_buffer(s->avctx, (AVFrame*)pic); if (r<0 || !pic->age || !pic->type || !pic->data[0]) { av_log(s->avctx, AV_LOG_ERROR, ""get_buffer() failed (%d %d %d %p)\n"", r, pic->age, pic->type, pic->data[0]); av_freep(&pic->hwaccel_data_private); return -1; } if (s->linesize && (s->linesize != pic->linesize[0] || s->uvlinesize != pic->linesize[1])) { av_log(s->avctx, AV_LOG_ERROR, ""get_buffer() failed (stride changed)\n""); free_frame_buffer(s, pic); return -1; } if (pic->linesize[1] != pic->linesize[2]) { av_log(s->avctx, AV_LOG_ERROR, ""get_buffer() failed (uv stride mismatch)\n""); free_frame_buffer(s, pic); return -1; } return 0; }","No, it is non-vulnerable."11421140,"static int asf_parse_packet(AVFormatContext *s, AVIOContext *pb, AVPacket *pkt) { ASFContext *asf = s->priv_data; ASFStream *asf_st = 0; for (;;) { int ret; if (avio_feof(pb)) return AVERROR_EOF; if (asf->packet_size_left < FRAME_HEADER_SIZE || asf->packet_segments < 1 && asf->packet_time_start == 0) { int ret = asf->packet_size_left + asf->packet_padsize; assert(ret >= 0); /* fail safe */ avio_skip(pb, ret); asf->packet_pos = avio_tell(pb); if (asf->data_object_size != (uint64_t)-1 && (asf->packet_pos - asf->data_object_offset >= asf->data_object_size)) return AVERROR_EOF; /* Do not exceed the size of the data object */ return 1; } if (asf->packet_time_start == 0) { if (asf_read_frame_header(s, pb) < 0) { asf->packet_time_start = asf->packet_segments = 0; continue; } if (asf->stream_index < 0 || s->streams[asf->stream_index]->discard >= AVDISCARD_ALL || (!asf->packet_key_frame && (s->streams[asf->stream_index]->discard >= AVDISCARD_NONKEY || asf->streams[s->streams[asf->stream_index]->id].skip_to_key))) { asf->packet_time_start = 0; /* unhandled packet (should not happen) */ avio_skip(pb, asf->packet_frag_size); asf->packet_size_left -= asf->packet_frag_size; if (asf->stream_index < 0) av_log(s, AV_LOG_ERROR, ""ff asf skip %d (unknown stream)\n"", asf->packet_frag_size); continue; } asf->asf_st = &asf->streams[s->streams[asf->stream_index]->id]; asf->asf_st->skip_to_key = 0; } asf_st = asf->asf_st; av_assert0(asf_st); if (!asf_st->frag_offset && asf->packet_frag_offset) { av_dlog(s, ""skipping asf data pkt with fragment offset for "" ""stream:%d, expected:%d but got %d from pkt)\n"", asf->stream_index, asf_st->frag_offset, asf->packet_frag_offset); avio_skip(pb, asf->packet_frag_size); asf->packet_size_left -= asf->packet_frag_size; continue; } if (asf->packet_replic_size == 1) { // frag_offset is here used as the beginning timestamp asf->packet_frag_timestamp = asf->packet_time_start; asf->packet_time_start += asf->packet_time_delta; asf_st->packet_obj_size = asf->packet_frag_size = avio_r8(pb); asf->packet_size_left--; asf->packet_multi_size--; if (asf->packet_multi_size < asf_st->packet_obj_size) { asf->packet_time_start = 0; avio_skip(pb, asf->packet_multi_size); asf->packet_size_left -= asf->packet_multi_size; continue; } asf->packet_multi_size -= asf_st->packet_obj_size; } if (asf_st->pkt.size != asf_st->packet_obj_size || // FIXME is this condition sufficient? asf_st->frag_offset + asf->packet_frag_size > asf_st->pkt.size) { if (asf_st->pkt.data) { av_log(s, AV_LOG_INFO, ""freeing incomplete packet size %d, new %d\n"", asf_st->pkt.size, asf_st->packet_obj_size); asf_st->frag_offset = 0; av_free_packet(&asf_st->pkt); } /* new packet */ av_new_packet(&asf_st->pkt, asf_st->packet_obj_size); asf_st->seq = asf->packet_seq; if (asf->ts_is_pts) { asf_st->pkt.pts = asf->packet_frag_timestamp - asf->hdr.preroll; } else asf_st->pkt.dts = asf->packet_frag_timestamp - asf->hdr.preroll; asf_st->pkt.stream_index = asf->stream_index; asf_st->pkt.pos = asf_st->packet_pos = asf->packet_pos; asf_st->pkt_clean = 0; if (asf_st->pkt.data && asf_st->palette_changed) { uint8_t *pal; pal = av_packet_new_side_data(&asf_st->pkt, AV_PKT_DATA_PALETTE, AVPALETTE_SIZE); if (!pal) { av_log(s, AV_LOG_ERROR, ""Cannot append palette to packet\n""); } else { memcpy(pal, asf_st->palette, AVPALETTE_SIZE); asf_st->palette_changed = 0; } } av_dlog(asf, ""new packet: stream:%d key:%d packet_key:%d audio:%d size:%d\n"", asf->stream_index, asf->packet_key_frame, asf_st->pkt.flags & AV_PKT_FLAG_KEY, s->streams[asf->stream_index]->codec->codec_type == AVMEDIA_TYPE_AUDIO, asf_st->packet_obj_size); if (s->streams[asf->stream_index]->codec->codec_type == AVMEDIA_TYPE_AUDIO) asf->packet_key_frame = 1; if (asf->packet_key_frame) asf_st->pkt.flags |= AV_PKT_FLAG_KEY; } /* read data */ av_dlog(asf, ""READ PACKET s:%d os:%d o:%d,%d l:%d DATA:%p\n"", s->packet_size, asf_st->pkt.size, asf->packet_frag_offset, asf_st->frag_offset, asf->packet_frag_size, asf_st->pkt.data); asf->packet_size_left -= asf->packet_frag_size; if (asf->packet_size_left < 0) continue; if (asf->packet_frag_offset >= asf_st->pkt.size || asf->packet_frag_size > asf_st->pkt.size - asf->packet_frag_offset) { av_log(s, AV_LOG_ERROR, ""packet fragment position invalid %u,%u not in %u\n"", asf->packet_frag_offset, asf->packet_frag_size, asf_st->pkt.size); continue; } if (asf->packet_frag_offset != asf_st->frag_offset && !asf_st->pkt_clean) { memset(asf_st->pkt.data + asf_st->frag_offset, 0, asf_st->pkt.size - asf_st->frag_offset); asf_st->pkt_clean = 1; } ret = avio_read(pb, asf_st->pkt.data + asf->packet_frag_offset, asf->packet_frag_size); if (ret != asf->packet_frag_size) { if (ret < 0 || asf->packet_frag_offset + ret == 0) return ret < 0 ? ret : AVERROR_EOF; if (asf_st->ds_span > 1) { // scrambling, we can either drop it completely or fill the remainder // TODO: should we fill the whole packet instead of just the current // fragment? memset(asf_st->pkt.data + asf->packet_frag_offset + ret, 0, asf->packet_frag_size - ret); ret = asf->packet_frag_size; } else { // no scrambling, so we can return partial packets av_shrink_packet(&asf_st->pkt, asf->packet_frag_offset + ret); } } if (s->key && s->keylen == 20) ff_asfcrypt_dec(s->key, asf_st->pkt.data + asf->packet_frag_offset, ret); asf_st->frag_offset += ret; /* test if whole packet is read */ if (asf_st->frag_offset == asf_st->pkt.size) { // workaround for macroshit radio DVR-MS files if (s->streams[asf->stream_index]->codec->codec_id == AV_CODEC_ID_MPEG2VIDEO && asf_st->pkt.size > 100) { int i; for (i = 0; i < asf_st->pkt.size && !asf_st->pkt.data[i]; i++) ; if (i == asf_st->pkt.size) { av_log(s, AV_LOG_DEBUG, ""discarding ms fart\n""); asf_st->frag_offset = 0; av_free_packet(&asf_st->pkt); continue; } } /* return packet */ if (asf_st->ds_span > 1) { if (asf_st->pkt.size != asf_st->ds_packet_size * asf_st->ds_span) { av_log(s, AV_LOG_ERROR, ""pkt.size != ds_packet_size * ds_span (%d %d %d)\n"", asf_st->pkt.size, asf_st->ds_packet_size, asf_st->ds_span); } else { /* packet descrambling */ AVBufferRef *buf = av_buffer_alloc(asf_st->pkt.size + FF_INPUT_BUFFER_PADDING_SIZE); if (buf) { uint8_t *newdata = buf->data; int offset = 0; memset(newdata + asf_st->pkt.size, 0, FF_INPUT_BUFFER_PADDING_SIZE); while (offset < asf_st->pkt.size) { int off = offset / asf_st->ds_chunk_size; int row = off / asf_st->ds_span; int col = off % asf_st->ds_span; int idx = row + col * asf_st->ds_packet_size / asf_st->ds_chunk_size; assert(offset + asf_st->ds_chunk_size <= asf_st->pkt.size); assert(idx + 1 <= asf_st->pkt.size / asf_st->ds_chunk_size); memcpy(newdata + offset, asf_st->pkt.data + idx * asf_st->ds_chunk_size, asf_st->ds_chunk_size); offset += asf_st->ds_chunk_size; } av_buffer_unref(&asf_st->pkt.buf); asf_st->pkt.buf = buf; asf_st->pkt.data = buf->data; } } } asf_st->frag_offset = 0; *pkt = asf_st->pkt; #if FF_API_DESTRUCT_PACKET FF_DISABLE_DEPRECATION_WARNINGS asf_st->pkt.destruct = NULL; FF_ENABLE_DEPRECATION_WARNINGS #endif asf_st->pkt.buf = 0; asf_st->pkt.size = 0; asf_st->pkt.data = 0; asf_st->pkt.side_data_elems = 0; asf_st->pkt.side_data = NULL; break; // packet completed } } return 0; }","No, it is non-vulnerable."11431141,"static int hls_decode_entry(AVCodecContext *avctxt, void *isFilterThread) { HEVCContext *s = avctxt->priv_data; int ctb_size = 1 << s->ps.sps->log2_ctb_size; int more_data = 1; int x_ctb = 0; int y_ctb = 0; int ctb_addr_ts = s->ps.pps->ctb_addr_rs_to_ts[s->sh.slice_ctb_addr_rs]; if (!ctb_addr_ts && s->sh.dependent_slice_segment_flag) { av_log(s->avctx, AV_LOG_ERROR, ""Impossible initial tile.\n""); return AVERROR_INVALIDDATA; } if (s->sh.dependent_slice_segment_flag) { int prev_rs = s->ps.pps->ctb_addr_ts_to_rs[ctb_addr_ts - 1]; if (s->tab_slice_address[prev_rs] != s->sh.slice_addr) { av_log(s->avctx, AV_LOG_ERROR, ""Previous slice segment missing\n""); return AVERROR_INVALIDDATA; } } while (more_data && ctb_addr_ts < s->ps.sps->ctb_size) { int ctb_addr_rs = s->ps.pps->ctb_addr_ts_to_rs[ctb_addr_ts]; x_ctb = (ctb_addr_rs % ((s->ps.sps->width + ctb_size - 1) >> s->ps.sps->log2_ctb_size)) << s->ps.sps->log2_ctb_size; y_ctb = (ctb_addr_rs / ((s->ps.sps->width + ctb_size - 1) >> s->ps.sps->log2_ctb_size)) << s->ps.sps->log2_ctb_size; hls_decode_neighbour(s, x_ctb, y_ctb, ctb_addr_ts); ff_hevc_cabac_init(s, ctb_addr_ts); hls_sao_param(s, x_ctb >> s->ps.sps->log2_ctb_size, y_ctb >> s->ps.sps->log2_ctb_size); s->deblock[ctb_addr_rs].beta_offset = s->sh.beta_offset; s->deblock[ctb_addr_rs].tc_offset = s->sh.tc_offset; s->filter_slice_edges[ctb_addr_rs] = s->sh.slice_loop_filter_across_slices_enabled_flag; more_data = hls_coding_quadtree(s, x_ctb, y_ctb, s->ps.sps->log2_ctb_size, 0); if (more_data < 0) { s->tab_slice_address[ctb_addr_rs] = -1; return more_data; } ctb_addr_ts++; ff_hevc_save_states(s, ctb_addr_ts); ff_hevc_hls_filters(s, x_ctb, y_ctb, ctb_size); } if (x_ctb + ctb_size >= s->ps.sps->width && y_ctb + ctb_size >= s->ps.sps->height) ff_hevc_hls_filter(s, x_ctb, y_ctb, ctb_size); return ctb_addr_ts; }","Yes, it is vulnerable."11441142,static void reset_packet_state(AVFormatContext *s) { ASFContext *asf = s->priv_data; int i; asf->state = PARSE_PACKET_HEADER; asf->offset = 0; asf->return_subpayload = 0; asf->sub_left = 0; asf->sub_header_offset = 0; asf->packet_offset = asf->first_packet_offset; asf->pad_len = 0; asf->rep_data_len = 0; asf->dts_delta = 0; asf->mult_sub_len = 0; asf->nb_mult_left = 0; asf->nb_sub = 0; asf->prop_flags = 0; asf->sub_dts = 0; asf->dts = 0; for (i = 0; i < asf->nb_streams; i++) { ASFPacket *pkt = &asf->asf_st[i]->pkt; pkt->size_left = 0; pkt->data_size = 0; pkt->duration = 0; pkt->flags = 0; pkt->dts = 0; pkt->duration = 0; av_free_packet(&pkt->avpkt); av_init_packet(&pkt->avpkt); } },"Yes, it is vulnerable."11451143,"static int nbd_parse_offset_hole_payload(NBDStructuredReplyChunk *chunk, uint8_t *payload, uint64_t orig_offset, QEMUIOVector *qiov, Error **errp) { uint64_t offset; uint32_t hole_size; if (chunk->length != sizeof(offset) + sizeof(hole_size)) { error_setg(errp, ""Protocol error: invalid payload for "" ""NBD_REPLY_TYPE_OFFSET_HOLE""); return -EINVAL; } offset = payload_advance64(&payload); hole_size = payload_advance32(&payload); if (offset < orig_offset || hole_size > qiov->size || offset > orig_offset + qiov->size - hole_size) { error_setg(errp, ""Protocol error: server sent chunk exceeding requested"" "" region""); return -EINVAL; } qemu_iovec_memset(qiov, offset - orig_offset, 0, hole_size); return 0; }","Yes, it is vulnerable."11461144,"static int cavs_decode_frame(AVCodecContext * avctx,void *data, int *data_size, const uint8_t * buf, int buf_size) { AVSContext *h = avctx->priv_data; MpegEncContext *s = &h->s; int input_size; const uint8_t *buf_end; const uint8_t *buf_ptr; AVFrame *picture = data; uint32_t stc = -1; s->avctx = avctx; if (buf_size == 0) { if(!s->low_delay && h->DPB[0].data[0]) { *data_size = sizeof(AVPicture); *picture = *(AVFrame *) &h->DPB[0]; } return 0; } buf_ptr = buf; buf_end = buf + buf_size; for(;;) { buf_ptr = ff_find_start_code(buf_ptr,buf_end, &stc); if(stc & 0xFFFFFE00) return FFMAX(0, buf_ptr - buf - s->parse_context.last_index); input_size = (buf_end - buf_ptr)*8; switch(stc) { case CAVS_START_CODE: init_get_bits(&s->gb, buf_ptr, input_size); decode_seq_header(h); break; case PIC_I_START_CODE: if(!h->got_keyframe) { if(h->DPB[0].data[0]) avctx->release_buffer(avctx, (AVFrame *)&h->DPB[0]); if(h->DPB[1].data[0]) avctx->release_buffer(avctx, (AVFrame *)&h->DPB[1]); h->got_keyframe = 1; } case PIC_PB_START_CODE: *data_size = 0; if(!h->got_keyframe) break; init_get_bits(&s->gb, buf_ptr, input_size); h->stc = stc; if(decode_pic(h)) break; *data_size = sizeof(AVPicture); if(h->pic_type != FF_B_TYPE) { if(h->DPB[1].data[0]) { *picture = *(AVFrame *) &h->DPB[1]; } else { *data_size = 0; } } else *picture = *(AVFrame *) &h->picture; break; case EXT_START_CODE: //mpeg_decode_extension(avctx,buf_ptr, input_size); break; case USER_START_CODE: //mpeg_decode_user_data(avctx,buf_ptr, input_size); break; default: if (stc >= SLICE_MIN_START_CODE && stc <= SLICE_MAX_START_CODE) { init_get_bits(&s->gb, buf_ptr, input_size); decode_slice_header(h, &s->gb); } break; } } }","No, it is non-vulnerable."11471145,"AVEvalExpr * ff_parse(const char *s, const char * const *const_name, double (**func1)(void *, double), const char **func1_name, double (**func2)(void *, double, double), const char **func2_name, const char **error){ Parser p; AVEvalExpr * e; char w[strlen(s) + 1], * wp = w; while (*s) if (!isspace(*s++)) *wp++ = s[-1]; *wp++ = 0; p.stack_index=100; p.s= w; p.const_name = const_name; p.func1 = func1; p.func1_name = func1_name; p.func2 = func2; p.func2_name = func2_name; p.error= error; e = parse_expr(&p); if (!verify_expr(e)) { ff_eval_free(e); return NULL; } return e; }","Yes, it is vulnerable."11481146,"static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf, RDMAControlHeader *head) { int ret = 0; RDMAWorkRequestData *wr = &rdma->wr_data[RDMA_WRID_CONTROL]; struct ibv_send_wr *bad_wr; struct ibv_sge sge = { .addr = (uint64_t)(wr->control), .length = head->len + sizeof(RDMAControlHeader), .lkey = wr->control_mr->lkey, }; struct ibv_send_wr send_wr = { .wr_id = RDMA_WRID_SEND_CONTROL, .opcode = IBV_WR_SEND, .send_flags = IBV_SEND_SIGNALED, .sg_list = &sge, .num_sge = 1, }; DDDPRINTF(""CONTROL: sending %s..\n"", control_desc[head->type]); /* * We don't actually need to do a memcpy() in here if we used * the ""sge"" properly, but since we're only sending control messages * (not RAM in a performance-critical path), then its OK for now. * * The copy makes the RDMAControlHeader simpler to manipulate * for the time being. */ assert(head->len <= RDMA_CONTROL_MAX_BUFFER - sizeof(*head)); memcpy(wr->control, head, sizeof(RDMAControlHeader)); control_to_network((void *) wr->control); if (buf) { memcpy(wr->control + sizeof(RDMAControlHeader), buf, head->len); } ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr); if (ret > 0) { fprintf(stderr, ""Failed to use post IB SEND for control!\n""); return -ret; } ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_SEND_CONTROL, NULL); if (ret < 0) { fprintf(stderr, ""rdma migration: send polling control error!\n""); } return ret; }","Yes, it is vulnerable."11491147,"static void pci_ich9_ahci_realize(PCIDevice *dev, Error **errp) { struct AHCIPCIState *d; int sata_cap_offset; uint8_t *sata_cap; d = ICH_AHCI(dev); ahci_realize(&d->ahci, DEVICE(dev), pci_get_address_space(dev), 6); pci_config_set_prog_interface(dev->config, AHCI_PROGMODE_MAJOR_REV_1); dev->config[PCI_CACHE_LINE_SIZE] = 0x08; /* Cache line size */ dev->config[PCI_LATENCY_TIMER] = 0x00; /* Latency timer */ pci_config_set_interrupt_pin(dev->config, 1); /* XXX Software should program this register */ dev->config[0x90] = 1 << 6; /* Address Map Register - AHCI mode */ d->ahci.irq = pci_allocate_irq(dev); pci_register_bar(dev, ICH9_IDP_BAR, PCI_BASE_ADDRESS_SPACE_IO, &d->ahci.idp); pci_register_bar(dev, ICH9_MEM_BAR, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->ahci.mem); sata_cap_offset = pci_add_capability2(dev, PCI_CAP_ID_SATA, ICH9_SATA_CAP_OFFSET, SATA_CAP_SIZE, errp); if (sata_cap_offset < 0) { return; } sata_cap = dev->config + sata_cap_offset; pci_set_word(sata_cap + SATA_CAP_REV, 0x10); pci_set_long(sata_cap + SATA_CAP_BAR, (ICH9_IDP_BAR + 0x4) | (ICH9_IDP_INDEX_LOG2 << 4)); d->ahci.idp_offset = ICH9_IDP_INDEX; /* Although the AHCI 1.3 specification states that the first capability * should be PMCAP, the Intel ICH9 data sheet specifies that the ICH9 * AHCI device puts the MSI capability first, pointing to 0x80. */ msi_init(dev, ICH9_MSI_CAP_OFFSET, 1, true, false); }","Yes, it is vulnerable."11501148,"static void parse_cmdline(const char *cmdline, int *pnb_args, char **args) { const char *p; int nb_args, ret; char buf[1024]; p = cmdline; nb_args = 0; for (;;) { while (qemu_isspace(*p)) { p++; } if (*p == '\0') { break; } if (nb_args >= MAX_ARGS) { break; } ret = get_str(buf, sizeof(buf), &p); args[nb_args] = g_strdup(buf); nb_args++; if (ret < 0) { break; } } *pnb_args = nb_args; }","Yes, it is vulnerable."11511149,"static void mpc8544ds_init(ram_addr_t ram_size, const char *boot_device, const char *kernel_filename, const char *kernel_cmdline, const char *initrd_filename, const char *cpu_model) { PCIBus *pci_bus; CPUState *env; uint64_t elf_entry; uint64_t elf_lowaddr; target_phys_addr_t entry=0; target_phys_addr_t loadaddr=UIMAGE_LOAD_BASE; target_long kernel_size=0; target_ulong dt_base=DTB_LOAD_BASE; target_ulong initrd_base=INITRD_LOAD_BASE; target_long initrd_size=0; void *fdt; int i=0; unsigned int pci_irq_nrs[4] = {1, 2, 3, 4}; qemu_irq *irqs, *mpic, *pci_irqs; SerialState * serial[2]; /* Setup CPU */ env = cpu_ppc_init(""e500v2_v30""); if (!env) { fprintf(stderr, ""Unable to initialize CPU!\n""); exit(1); } /* Fixup Memory size on a alignment boundary */ ram_size &= ~(RAM_SIZES_ALIGN - 1); /* Register Memory */ cpu_register_physical_memory(0, ram_size, qemu_ram_alloc(ram_size)); /* MPIC */ irqs = qemu_mallocz(sizeof(qemu_irq) * OPENPIC_OUTPUT_NB); irqs[OPENPIC_OUTPUT_INT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_INT]; irqs[OPENPIC_OUTPUT_CINT] = ((qemu_irq *)env->irq_inputs)[PPCE500_INPUT_CINT]; mpic = mpic_init(MPC8544_MPIC_REGS_BASE, 1, &irqs, NULL); /* Serial */ if (serial_hds[0]) serial[0] = serial_mm_init(MPC8544_SERIAL0_REGS_BASE, 0, mpic[12+26], 399193, serial_hds[0], 1); if (serial_hds[1]) serial[0] = serial_mm_init(MPC8544_SERIAL1_REGS_BASE, 0, mpic[12+26], 399193, serial_hds[0], 1); /* PCI */ pci_irqs = qemu_malloc(sizeof(qemu_irq) * 4); pci_irqs[0] = mpic[pci_irq_nrs[0]]; pci_irqs[1] = mpic[pci_irq_nrs[1]]; pci_irqs[2] = mpic[pci_irq_nrs[2]]; pci_irqs[3] = mpic[pci_irq_nrs[3]]; pci_bus = ppce500_pci_init(pci_irqs, MPC8544_PCI_REGS_BASE); if (!pci_bus) printf(""couldn't create PCI controller!\n""); isa_mmio_init(MPC8544_PCI_IO, MPC8544_PCI_IOLEN); if (pci_bus) { /* Register network interfaces. */ for (i = 0; i < nb_nics; i++) { pci_nic_init(&nd_table[i], ""virtio"", NULL); } } /* Load kernel. */ if (kernel_filename) { kernel_size = load_uimage(kernel_filename, &entry, &loadaddr, NULL); if (kernel_size < 0) { kernel_size = load_elf(kernel_filename, 0, &elf_entry, &elf_lowaddr, NULL, 1, ELF_MACHINE, 0); entry = elf_entry; loadaddr = elf_lowaddr; } /* XXX try again as binary */ if (kernel_size < 0) { fprintf(stderr, ""qemu: could not load kernel '%s'\n"", kernel_filename); exit(1); } } /* Load initrd. */ if (initrd_filename) { initrd_size = load_image_targphys(initrd_filename, initrd_base, ram_size - initrd_base); if (initrd_size < 0) { fprintf(stderr, ""qemu: could not load initial ram disk '%s'\n"", initrd_filename); exit(1); } } /* If we're loading a kernel directly, we must load the device tree too. */ if (kernel_filename) { fdt = mpc8544_load_device_tree(dt_base, ram_size, initrd_base, initrd_size, kernel_cmdline); if (fdt == NULL) { fprintf(stderr, ""couldn't load device tree\n""); exit(1); } /* Set initial guest state. */ env->gpr[1] = (16<<20) - 8; env->gpr[3] = dt_base; env->nip = entry; /* XXX we currently depend on KVM to create some initial TLB entries. */ } if (kvm_enabled()) kvmppc_init(); return; }","Yes, it is vulnerable."11521150,"static void read_packets(WriterContext *w, AVFormatContext *fmt_ctx) { int i, ret = 0; int64_t cur_ts = fmt_ctx->start_time; if (read_intervals_nb == 0) { ReadInterval interval = (ReadInterval) { .has_start = 0, .has_end = 0 }; ret = read_interval_packets(w, fmt_ctx, &interval, &cur_ts); } else { for (i = 0; i < read_intervals_nb; i++) { ret = read_interval_packets(w, fmt_ctx, &read_intervals[i], &cur_ts); if (ret < 0) break; } } }","No, it is non-vulnerable."11531151,"static void vga_update_memory_access(VGACommonState *s) { hwaddr base, offset, size; if (s->legacy_address_space == NULL) { return; } if (s->has_chain4_alias) { memory_region_del_subregion(s->legacy_address_space, &s->chain4_alias); object_unparent(OBJECT(&s->chain4_alias)); s->has_chain4_alias = false; s->plane_updated = 0xf; } if ((s->sr[VGA_SEQ_PLANE_WRITE] & VGA_SR02_ALL_PLANES) == VGA_SR02_ALL_PLANES && s->sr[VGA_SEQ_MEMORY_MODE] & VGA_SR04_CHN_4M) { offset = 0; switch ((s->gr[VGA_GFX_MISC] >> 2) & 3) { case 0: base = 0xa0000; size = 0x20000; break; case 1: base = 0xa0000; size = 0x10000; offset = s->bank_offset; break; case 2: base = 0xb0000; size = 0x8000; break; case 3: default: base = 0xb8000; size = 0x8000; break; } assert(offset + size <= s->vram_size); memory_region_init_alias(&s->chain4_alias, memory_region_owner(&s->vram), ""vga.chain4"", &s->vram, offset, size); memory_region_add_subregion_overlap(s->legacy_address_space, base, &s->chain4_alias, 2); s->has_chain4_alias = true; } }","Yes, it is vulnerable."11541152,"int av_opt_set_from_string(void *ctx, const char *opts, const char *const *shorthand, const char *key_val_sep, const char *pairs_sep) { int ret, count = 0; const char *dummy_shorthand = NULL; char key_buf[68], *value; const char *key; if (!opts) return 0; if (!shorthand) shorthand = &dummy_shorthand; while (*opts) { if ((ret = get_key(&opts, key_val_sep, key_buf, sizeof(key_buf))) < 0) { if (*shorthand) { key = *(shorthand++); } else { av_log(ctx, AV_LOG_ERROR, ""No option name near '%s'\n"", opts); return AVERROR(EINVAL); } } else { key = key_buf; while (*shorthand) /* discard all remaining shorthand */ shorthand++; } if (!(value = av_get_token(&opts, pairs_sep))) return AVERROR(ENOMEM); if (*opts && strchr(pairs_sep, *opts)) opts++; av_log(ctx, AV_LOG_DEBUG, ""Setting '%s' to value '%s'\n"", key, value); if ((ret = av_opt_set(ctx, key, value, 0)) < 0) { if (ret == AVERROR_OPTION_NOT_FOUND) av_log(ctx, AV_LOG_ERROR, ""Option '%s' not found\n"", key); av_free(value); return ret; } av_free(value); count++; } return count; }","No, it is non-vulnerable."11551153,"void helper_sysexit(void) { int cpl; cpl = env->hflags & HF_CPL_MASK; if (env->sysenter_cs == 0 || cpl != 0) { raise_exception_err(EXCP0D_GPF, 0); } cpu_x86_set_cpl(env, 3); cpu_x86_load_seg_cache(env, R_CS, ((env->sysenter_cs + 16) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK); cpu_x86_load_seg_cache(env, R_SS, ((env->sysenter_cs + 24) & 0xfffc) | 3, 0, 0xffffffff, DESC_G_MASK | DESC_B_MASK | DESC_P_MASK | DESC_S_MASK | (3 << DESC_DPL_SHIFT) | DESC_W_MASK | DESC_A_MASK); ESP = ECX; EIP = EDX; #ifdef USE_KQEMU if (kqemu_is_ok(env)) { env->exception_index = -1; cpu_loop_exit(); } #endif }","No, it is non-vulnerable."11561154,"static inline void gen_efsnabs(DisasContext *ctx) { if (unlikely(!ctx->spe_enabled)) { gen_exception(ctx, POWERPC_EXCP_APU); return; } tcg_gen_ori_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)], 0x80000000); }","No, it is non-vulnerable."11571155,"static int pte64_check(struct mmu_ctx_hash64 *ctx, target_ulong pte0, target_ulong pte1, int h, int rwx) { target_ulong mmask; int access, ret, pp; ret = -1; /* Check validity and table match */ if ((pte0 & HPTE64_V_VALID) && (h == !!(pte0 & HPTE64_V_SECONDARY))) { bool nx; /* Check vsid & api */ mmask = PTE64_CHECK_MASK; pp = (pte1 & HPTE64_R_PP) | ((pte1 & HPTE64_R_PP0) >> 61); /* No execute if either noexec or guarded bits set */ nx = (pte1 & HPTE64_R_N) || (pte1 & HPTE64_R_G); if (HPTE64_V_COMPARE(pte0, ctx->ptem)) { if (ctx->raddr != (hwaddr)-1ULL) { /* all matches should have equal RPN, WIMG & PP */ if ((ctx->raddr & mmask) != (pte1 & mmask)) { qemu_log(""Bad RPN/WIMG/PP\n""); return -3; } } /* Compute access rights */ access = ppc_hash64_pp_check(ctx->key, pp, nx); /* Keep the matching PTE informations */ ctx->raddr = pte1; ctx->prot = access; ret = ppc_hash64_check_prot(ctx->prot, rwx); if (ret == 0) { /* Access granted */ LOG_MMU(""PTE access granted !\n""); } else { /* Access right violation */ LOG_MMU(""PTE access rejected\n""); } } } return ret; }","No, it is non-vulnerable."11581156,"static uint64_t bmdma_addr_read(void *opaque, target_phys_addr_t addr, unsigned width) { BMDMAState *bm = opaque; uint32_t mask = (1ULL << (width * 8)) - 1; uint64_t data; data = (bm->addr >> (addr * 8)) & mask; #ifdef DEBUG_IDE printf(""%s: 0x%08x\n"", __func__, (unsigned)*data); #endif return data; }","No, it is non-vulnerable."11591157,"static void qerror_abort(const QError *qerr, const char *fmt, ...) { va_list ap; fprintf(stderr, ""qerror: bad call in function '%s':\n"", qerr->func); fprintf(stderr, ""qerror: -> ""); va_start(ap, fmt); vfprintf(stderr, fmt, ap); va_end(ap); fprintf(stderr, ""\nqerror: call at %s:%d\n"", qerr->file, qerr->linenr); abort(); }","No, it is non-vulnerable."11601158,"static void gen_nabs(DisasContext *ctx) { int l1 = gen_new_label(); int l2 = gen_new_label(); tcg_gen_brcondi_tl(TCG_COND_GT, cpu_gpr[rA(ctx->opcode)], 0, l1); tcg_gen_mov_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]); tcg_gen_br(l2); gen_set_label(l1); tcg_gen_neg_tl(cpu_gpr[rD(ctx->opcode)], cpu_gpr[rA(ctx->opcode)]); gen_set_label(l2); if (unlikely(Rc(ctx->opcode) != 0)) gen_set_Rc0(ctx, cpu_gpr[rD(ctx->opcode)]); }","No, it is non-vulnerable."11611159,"static void vtd_iotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id, hwaddr addr, uint8_t am) { VTDIOTLBPageInvInfo info; assert(am <= VTD_MAMV); info.domain_id = domain_id; info.gfn = addr >> VTD_PAGE_SHIFT_4K; info.mask = ~((1 << am) - 1); g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_page, &info); }","No, it is non-vulnerable."11621160,"static void sh_serial_write(void *opaque, hwaddr offs, uint64_t val, unsigned size) { sh_serial_state *s = opaque; unsigned char ch; #ifdef DEBUG_SERIAL printf(""sh_serial: write offs=0x%02x val=0x%02x\n"", offs, val); #endif switch(offs) { case 0x00: /* SMR */ s->smr = val & ((s->feat & SH_SERIAL_FEAT_SCIF) ? 0x7b : 0xff); return; case 0x04: /* BRR */ s->brr = val; return; case 0x08: /* SCR */ /* TODO : For SH7751, SCIF mask should be 0xfb. */ s->scr = val & ((s->feat & SH_SERIAL_FEAT_SCIF) ? 0xfa : 0xff); if (!(val & (1 << 5))) s->flags |= SH_SERIAL_FLAG_TEND; if ((s->feat & SH_SERIAL_FEAT_SCIF) && s->txi) { qemu_set_irq(s->txi, val & (1 << 7)); } if (!(val & (1 << 6))) { qemu_set_irq(s->rxi, 0); } return; case 0x0c: /* FTDR / TDR */ if (s->chr) { ch = val; qemu_chr_fe_write(s->chr, &ch, 1); } s->dr = val; s->flags &= ~SH_SERIAL_FLAG_TDE; return; #if 0 case 0x14: /* FRDR / RDR */ ret = 0; break; #endif } if (s->feat & SH_SERIAL_FEAT_SCIF) { switch(offs) { case 0x10: /* FSR */ if (!(val & (1 << 6))) s->flags &= ~SH_SERIAL_FLAG_TEND; if (!(val & (1 << 5))) s->flags &= ~SH_SERIAL_FLAG_TDE; if (!(val & (1 << 4))) s->flags &= ~SH_SERIAL_FLAG_BRK; if (!(val & (1 << 1))) s->flags &= ~SH_SERIAL_FLAG_RDF; if (!(val & (1 << 0))) s->flags &= ~SH_SERIAL_FLAG_DR; if (!(val & (1 << 1)) || !(val & (1 << 0))) { if (s->rxi) { qemu_set_irq(s->rxi, 0); } } return; case 0x18: /* FCR */ s->fcr = val; switch ((val >> 6) & 3) { case 0: s->rtrg = 1; break; case 1: s->rtrg = 4; break; case 2: s->rtrg = 8; break; case 3: s->rtrg = 14; break; } if (val & (1 << 1)) { sh_serial_clear_fifo(s); s->sr &= ~(1 << 1); } return; case 0x20: /* SPTR */ s->sptr = val & 0xf3; return; case 0x24: /* LSR */ return; } } else { switch(offs) { #if 0 case 0x0c: ret = s->dr; break; case 0x10: ret = 0; break; #endif case 0x1c: s->sptr = val & 0x8f; return; } } fprintf(stderr, ""sh_serial: unsupported write to 0x%02"" HWADDR_PRIx ""\n"", offs); abort(); }","Yes, it is vulnerable."11631161,"void qmp_x_input_send_event(bool has_console, int64_t console, InputEventList *events, Error **errp) { InputEventList *e; QemuConsole *con; con = NULL; if (has_console) { con = qemu_console_lookup_by_index(console); if (!con) { error_setg(errp, ""console %"" PRId64 "" not found"", console); return; } } if (!runstate_is_running() && !runstate_check(RUN_STATE_SUSPENDED)) { error_setg(errp, ""VM not running""); return; } for (e = events; e != NULL; e = e->next) { InputEvent *event = e->value; if (!qemu_input_find_handler(1 << event->kind, con)) { error_setg(errp, ""Input handler not found for "" ""event type %s"", InputEventKind_lookup[event->kind]); return; } } for (e = events; e != NULL; e = e->next) { InputEvent *event = e->value; qemu_input_event_send(con, event); } qemu_input_event_sync(); }","No, it is non-vulnerable."11641162,"static int scsi_event_status_media(SCSIDiskState *s, uint8_t *outbuf) { uint8_t event_code, media_status; media_status = 0; if (s->tray_open) { media_status = MS_TRAY_OPEN; } else if (bdrv_is_inserted(s->qdev.conf.bs)) { media_status = MS_MEDIA_PRESENT; } /* Event notification descriptor */ event_code = MEC_NO_CHANGE; if (media_status != MS_TRAY_OPEN) { if (s->media_event) { event_code = MEC_NEW_MEDIA; s->media_event = false; } else if (s->eject_request) { event_code = MEC_EJECT_REQUESTED; s->eject_request = false; } } outbuf[0] = event_code; outbuf[1] = media_status; /* These fields are reserved, just clear them. */ outbuf[2] = 0; outbuf[3] = 0; return 4; }","No, it is non-vulnerable."11651163,static av_cold int targa_encode_init(AVCodecContext *avctx) { avctx->coded_frame = av_frame_alloc(); if (!avctx->coded_frame) return AVERROR(ENOMEM); avctx->coded_frame->key_frame = 1; avctx->coded_frame->pict_type = AV_PICTURE_TYPE_I; return 0; },"No, it is non-vulnerable."11661164,void qapi_dealloc_visitor_cleanup(QapiDeallocVisitor *v) { g_free(v); },"No, it is non-vulnerable."11671165,"static void imx25_pdk_init(MachineState *machine) { IMX25PDK *s = g_new0(IMX25PDK, 1); unsigned int ram_size; unsigned int alias_offset; int i; object_initialize(&s->soc, sizeof(s->soc), TYPE_FSL_IMX25); object_property_add_child(OBJECT(machine), ""soc"", OBJECT(&s->soc), &error_abort); object_property_set_bool(OBJECT(&s->soc), true, ""realized"", &error_fatal); /* We need to initialize our memory */ if (machine->ram_size > (FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE)) { error_report(""WARNING: RAM size "" RAM_ADDR_FMT "" above max supported, "" ""reduced to %x"", machine->ram_size, FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE); machine->ram_size = FSL_IMX25_SDRAM0_SIZE + FSL_IMX25_SDRAM1_SIZE; } memory_region_allocate_system_memory(&s->ram, NULL, ""imx25.ram"", machine->ram_size); memory_region_add_subregion(get_system_memory(), FSL_IMX25_SDRAM0_ADDR, &s->ram); /* initialize the alias memory if any */ for (i = 0, ram_size = machine->ram_size, alias_offset = 0; (i < 2) && ram_size; i++) { unsigned int size; static const struct { hwaddr addr; unsigned int size; } ram[2] = { { FSL_IMX25_SDRAM0_ADDR, FSL_IMX25_SDRAM0_SIZE }, { FSL_IMX25_SDRAM1_ADDR, FSL_IMX25_SDRAM1_SIZE }, }; size = MIN(ram_size, ram[i].size); ram_size -= size; if (size < ram[i].size) { memory_region_init_alias(&s->ram_alias, NULL, ""ram.alias"", &s->ram, alias_offset, ram[i].size - size); memory_region_add_subregion(get_system_memory(), ram[i].addr + size, &s->ram_alias); } alias_offset += ram[i].size; } imx25_pdk_binfo.ram_size = machine->ram_size; imx25_pdk_binfo.kernel_filename = machine->kernel_filename; imx25_pdk_binfo.kernel_cmdline = machine->kernel_cmdline; imx25_pdk_binfo.initrd_filename = machine->initrd_filename; imx25_pdk_binfo.loader_start = FSL_IMX25_SDRAM0_ADDR; imx25_pdk_binfo.board_id = 1771, imx25_pdk_binfo.nb_cpus = 1; /* * We test explicitly for qtest here as it is not done (yet?) in * arm_load_kernel(). Without this the ""make check"" command would * fail. */ if (!qtest_enabled()) { arm_load_kernel(&s->soc.cpu, &imx25_pdk_binfo); } else { /* * This I2C device doesn't exist on the real board. * We add it here (only on qtest usage) to be able to do a bit * of simple qtest. See ""make check"" for details. */ i2c_create_slave((I2CBus *)qdev_get_child_bus(DEVICE(&s->soc.i2c[0]), ""i2c-bus.0""), ""ds1338"", 0x68); } }","No, it is non-vulnerable."11681166,"static void gd_ungrab_pointer(GtkDisplayState *s) { #if GTK_CHECK_VERSION(3, 0, 0) GdkDisplay *display = gtk_widget_get_display(s->drawing_area); GdkDeviceManager *mgr = gdk_display_get_device_manager(display); GList *devices = gdk_device_manager_list_devices(mgr, GDK_DEVICE_TYPE_MASTER); GList *tmp = devices; while (tmp) { GdkDevice *dev = tmp->data; if (gdk_device_get_source(dev) == GDK_SOURCE_MOUSE) { gdk_device_ungrab(dev, GDK_CURRENT_TIME); } tmp = tmp->next; } g_list_free(devices); #else gdk_pointer_ungrab(GDK_CURRENT_TIME); #endif }","No, it is non-vulnerable."11691167,"void machine_register_compat_props(MachineState *machine) { MachineClass *mc = MACHINE_GET_CLASS(machine); int i; GlobalProperty *p; if (!mc->compat_props) { return; } for (i = 0; i < mc->compat_props->len; i++) { p = g_array_index(mc->compat_props, GlobalProperty *, i); qdev_prop_register_global(p); } }","Yes, it is vulnerable."11701168,"static int y216_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPacket *avpkt) { AVFrame *pic = data; const uint16_t *src = (uint16_t *)avpkt->data; uint16_t *y, *u, *v, aligned_width = FFALIGN(avctx->width, 4); int i, j, ret; if (avpkt->size < 4 * avctx->height * aligned_width) { av_log(avctx, AV_LOG_ERROR, ""Insufficient input data.\n""); return AVERROR(EINVAL); } if ((ret = ff_get_buffer(avctx, pic, 0)) < 0) return ret; pic->key_frame = 1; pic->pict_type = AV_PICTURE_TYPE_I; y = (uint16_t *)pic->data[0]; u = (uint16_t *)pic->data[1]; v = (uint16_t *)pic->data[2]; for (i = 0; i < avctx->height; i++) { for (j = 0; j < avctx->width >> 1; j++) { u[ j ] = src[4 * j ] << 2 | src[4 * j ] >> 14; y[2 * j ] = src[4 * j + 1] << 2 | src[4 * j + 1] >> 14; v[ j ] = src[4 * j + 2] << 2 | src[4 * j + 2] >> 14; y[2 * j + 1] = src[4 * j + 3] << 2 | src[4 * j + 3] >> 14; } y += pic->linesize[0] >> 1; u += pic->linesize[1] >> 1; v += pic->linesize[2] >> 1; src += aligned_width << 1; } *got_frame = 1; return avpkt->size; }","Yes, it is vulnerable."11711169,void do_addo (void) { T2 = T0; T0 += T1; if (likely(!((T2 ^ T1 ^ (-1)) & (T2 ^ T0) & (1 << 31)))) { xer_ov = 0; } else { xer_so = 1; xer_ov = 1; } },"Yes, it is vulnerable."11721170,"static void nbd_coroutine_start(NbdClientSession *s, struct nbd_request *request) { /* Poor man semaphore. The free_sema is locked when no other request * can be accepted, and unlocked after receiving one reply. */ if (s->in_flight >= MAX_NBD_REQUESTS - 1) { qemu_co_mutex_lock(&s->free_sema); assert(s->in_flight < MAX_NBD_REQUESTS); } s->in_flight++; /* s->recv_coroutine[i] is set as soon as we get the send_lock. */ }","Yes, it is vulnerable."11731171,"void vga_init(VGAState *s) { int vga_io_memory; register_savevm(""vga"", 0, 2, vga_save, vga_load, s); register_ioport_write(0x3c0, 16, 1, vga_ioport_write, s); register_ioport_write(0x3b4, 2, 1, vga_ioport_write, s); register_ioport_write(0x3d4, 2, 1, vga_ioport_write, s); register_ioport_write(0x3ba, 1, 1, vga_ioport_write, s); register_ioport_write(0x3da, 1, 1, vga_ioport_write, s); register_ioport_read(0x3c0, 16, 1, vga_ioport_read, s); register_ioport_read(0x3b4, 2, 1, vga_ioport_read, s); register_ioport_read(0x3d4, 2, 1, vga_ioport_read, s); register_ioport_read(0x3ba, 1, 1, vga_ioport_read, s); register_ioport_read(0x3da, 1, 1, vga_ioport_read, s); s->bank_offset = 0; #ifdef CONFIG_BOCHS_VBE s->vbe_regs[VBE_DISPI_INDEX_ID] = VBE_DISPI_ID0; s->vbe_bank_mask = ((s->vram_size >> 16) - 1); #if defined (TARGET_I386) register_ioport_read(0x1ce, 1, 2, vbe_ioport_read_index, s); register_ioport_read(0x1cf, 1, 2, vbe_ioport_read_data, s); register_ioport_write(0x1ce, 1, 2, vbe_ioport_write_index, s); register_ioport_write(0x1cf, 1, 2, vbe_ioport_write_data, s); /* old Bochs IO ports */ register_ioport_read(0xff80, 1, 2, vbe_ioport_read_index, s); register_ioport_read(0xff81, 1, 2, vbe_ioport_read_data, s); register_ioport_write(0xff80, 1, 2, vbe_ioport_write_index, s); register_ioport_write(0xff81, 1, 2, vbe_ioport_write_data, s); #else register_ioport_read(0x1ce, 1, 2, vbe_ioport_read_index, s); register_ioport_read(0x1d0, 1, 2, vbe_ioport_read_data, s); register_ioport_write(0x1ce, 1, 2, vbe_ioport_write_index, s); register_ioport_write(0x1d0, 1, 2, vbe_ioport_write_data, s); #endif #endif /* CONFIG_BOCHS_VBE */ vga_io_memory = cpu_register_io_memory(0, vga_mem_read, vga_mem_write, s); cpu_register_physical_memory(isa_mem_base + 0x000a0000, 0x20000, vga_io_memory); }","Yes, it is vulnerable."11741172,"void audio_decode_example(const char *outfilename, const char *filename) { AVCodec *codec; AVCodecContext *c= NULL; int out_size, size, len; FILE *f, *outfile; uint8_t *outbuf; uint8_t inbuf[INBUF_SIZE + FF_INPUT_BUFFER_PADDING_SIZE], *inbuf_ptr; printf(""Audio decoding\n""); /* set end of buffer to 0 (this ensures that no overreading happens for damaged mpeg streams) */ memset(inbuf + INBUF_SIZE, 0, FF_INPUT_BUFFER_PADDING_SIZE); /* find the mpeg audio decoder */ codec = avcodec_find_decoder(CODEC_ID_MP2); if (!codec) { fprintf(stderr, ""codec not found\n""); exit(1); } c= avcodec_alloc_context(); /* open it */ if (avcodec_open(c, codec) < 0) { fprintf(stderr, ""could not open codec\n""); exit(1); } outbuf = malloc(AVCODEC_MAX_AUDIO_FRAME_SIZE); f = fopen(filename, ""r""); if (!f) { fprintf(stderr, ""could not open %s\n"", filename); exit(1); } outfile = fopen(outfilename, ""w""); if (!outfile) { free(c); exit(1); } /* decode until eof */ inbuf_ptr = inbuf; for(;;) { size = fread(inbuf, 1, INBUF_SIZE, f); if (size == 0) break; inbuf_ptr = inbuf; while (size > 0) { len = avcodec_decode_audio(c, (short *)outbuf, &out_size, inbuf_ptr, size); if (len < 0) { fprintf(stderr, ""Error while decoding\n""); exit(1); } if (out_size > 0) { /* if a frame has been decoded, output it */ fwrite(outbuf, 1, out_size, outfile); } size -= len; inbuf_ptr += len; } } fclose(outfile); fclose(f); free(outbuf); avcodec_close(c); free(c); }","Yes, it is vulnerable."11751173,"static int nprobe(AVFormatContext *s, uint8_t *enc_header, const uint8_t *n_val) { OMAContext *oc = s->priv_data; uint32_t pos, taglen, datalen; struct AVDES av_des; if (!enc_header || !n_val) return -1; pos = OMA_ENC_HEADER_SIZE + oc->k_size; if (!memcmp(&enc_header[pos], ""EKB "", 4)) pos += 32; if (AV_RB32(&enc_header[pos]) != oc->rid) av_log(s, AV_LOG_DEBUG, ""Mismatching RID\n""); taglen = AV_RB32(&enc_header[pos+32]); datalen = AV_RB32(&enc_header[pos+36]) >> 4; pos += 44 + taglen; av_des_init(&av_des, n_val, 192, 1); while (datalen-- > 0) { av_des_crypt(&av_des, oc->r_val, &enc_header[pos], 2, NULL, 1); kset(s, oc->r_val, NULL, 16); if (!rprobe(s, enc_header, oc->r_val)) return 0; pos += 16; } return -1; }","No, it is non-vulnerable."11761174,"static void ide_sector_start_dma(IDEState *s, enum ide_dma_cmd dma_cmd) { s->status = READY_STAT | SEEK_STAT | DRQ_STAT | BUSY_STAT; s->io_buffer_index = 0; s->io_buffer_size = 0; s->dma_cmd = dma_cmd; switch (dma_cmd) { case IDE_DMA_READ: block_acct_start(bdrv_get_stats(s->bs), &s->acct, s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ); break; case IDE_DMA_WRITE: block_acct_start(bdrv_get_stats(s->bs), &s->acct, s->nsector * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE); break; default: break; } ide_start_dma(s, ide_dma_cb); }","No, it is non-vulnerable."11771175,"void s390_feat_bitmap_to_ascii(const S390FeatBitmap bitmap, void *opaque, void (*fn)(const char *name, void *opaque)) { S390Feat feat; feat = find_first_bit(bitmap, S390_FEAT_MAX); while (feat < S390_FEAT_MAX) { fn(s390_feat_def(feat)->name, opaque); feat = find_next_bit(bitmap, S390_FEAT_MAX, feat + 1); }; }","No, it is non-vulnerable."11781176,static uint64_t hpet_get_ticks(void) { uint64_t ticks; ticks = ns_to_ticks(qemu_get_clock(vm_clock) + hpet_statep->hpet_offset); return ticks; },"Yes, it is vulnerable."11791177,"static void compute_pkt_fields(AVFormatContext *s, AVStream *st, AVCodecParserContext *pc, AVPacket *pkt) { int num, den, presentation_delayed, delay, i; int64_t offset; if (s->flags & AVFMT_FLAG_NOFILLIN) return; if((s->flags & AVFMT_FLAG_IGNDTS) && pkt->pts != AV_NOPTS_VALUE) pkt->dts= AV_NOPTS_VALUE; if (st->codec->codec_id != CODEC_ID_H264 && pc && pc->pict_type == FF_B_TYPE) //FIXME Set low_delay = 0 when has_b_frames = 1 st->codec->has_b_frames = 1; /* do we have a video B-frame ? */ delay= st->codec->has_b_frames; presentation_delayed = 0; /* XXX: need has_b_frame, but cannot get it if the codec is not initialized */ if (delay && pc && pc->pict_type != FF_B_TYPE) presentation_delayed = 1; if(pkt->pts != AV_NOPTS_VALUE && pkt->dts != AV_NOPTS_VALUE && pkt->dts > pkt->pts && st->pts_wrap_bits<63 /*&& pkt->dts-(1LL<<st->pts_wrap_bits) < pkt->pts*/){ pkt->dts -= 1LL<<st->pts_wrap_bits; } // some mpeg2 in mpeg-ps lack dts (issue171 / input_file.mpg) // we take the conservative approach and discard both // Note, if this is misbehaving for a H.264 file then possibly presentation_delayed is not set correctly. if(delay==1 && pkt->dts == pkt->pts && pkt->dts != AV_NOPTS_VALUE && presentation_delayed){ av_log(s, AV_LOG_WARNING, ""invalid dts/pts combination\n""); pkt->dts= pkt->pts= AV_NOPTS_VALUE; } if (pkt->duration == 0) { compute_frame_duration(&num, &den, st, pc, pkt); if (den && num) { pkt->duration = av_rescale_rnd(1, num * (int64_t)st->time_base.den, den * (int64_t)st->time_base.num, AV_ROUND_DOWN); if(pkt->duration != 0 && s->packet_buffer) update_initial_durations(s, st, pkt); } } /* correct timestamps with byte offset if demuxers only have timestamps on packet boundaries */ if(pc && st->need_parsing == AVSTREAM_PARSE_TIMESTAMPS && pkt->size){ /* this will estimate bitrate based on this frame's duration and size */ offset = av_rescale(pc->offset, pkt->duration, pkt->size); if(pkt->pts != AV_NOPTS_VALUE) pkt->pts += offset; if(pkt->dts != AV_NOPTS_VALUE) pkt->dts += offset; } if (pc && pc->dts_sync_point >= 0) { // we have synchronization info from the parser int64_t den = st->codec->time_base.den * (int64_t) st->time_base.num; if (den > 0) { int64_t num = st->codec->time_base.num * (int64_t) st->time_base.den; if (pkt->dts != AV_NOPTS_VALUE) { // got DTS from the stream, update reference timestamp st->reference_dts = pkt->dts - pc->dts_ref_dts_delta * num / den; pkt->pts = pkt->dts + pc->pts_dts_delta * num / den; } else if (st->reference_dts != AV_NOPTS_VALUE) { // compute DTS based on reference timestamp pkt->dts = st->reference_dts + pc->dts_ref_dts_delta * num / den; pkt->pts = pkt->dts + pc->pts_dts_delta * num / den; } if (pc->dts_sync_point > 0) st->reference_dts = pkt->dts; // new reference } } /* This may be redundant, but it should not hurt. */ if(pkt->dts != AV_NOPTS_VALUE && pkt->pts != AV_NOPTS_VALUE && pkt->pts > pkt->dts) presentation_delayed = 1; // av_log(NULL, AV_LOG_DEBUG, ""IN delayed:%d pts:%""PRId64"", dts:%""PRId64"" cur_dts:%""PRId64"" st:%d pc:%p\n"", presentation_delayed, pkt->pts, pkt->dts, st->cur_dts, pkt->stream_index, pc); /* interpolate PTS and DTS if they are not present */ //We skip H264 currently because delay and has_b_frames are not reliably set if((delay==0 || (delay==1 && pc)) && st->codec->codec_id != CODEC_ID_H264){ if (presentation_delayed) { /* DTS = decompression timestamp */ /* PTS = presentation timestamp */ if (pkt->dts == AV_NOPTS_VALUE) pkt->dts = st->last_IP_pts; update_initial_timestamps(s, pkt->stream_index, pkt->dts, pkt->pts); if (pkt->dts == AV_NOPTS_VALUE) pkt->dts = st->cur_dts; /* this is tricky: the dts must be incremented by the duration of the frame we are displaying, i.e. the last I- or P-frame */ if (st->last_IP_duration == 0) st->last_IP_duration = pkt->duration; if(pkt->dts != AV_NOPTS_VALUE) st->cur_dts = pkt->dts + st->last_IP_duration; st->last_IP_duration = pkt->duration; st->last_IP_pts= pkt->pts; /* cannot compute PTS if not present (we can compute it only by knowing the future */ } else if(pkt->pts != AV_NOPTS_VALUE || pkt->dts != AV_NOPTS_VALUE || pkt->duration){ if(pkt->pts != AV_NOPTS_VALUE && pkt->duration){ int64_t old_diff= FFABS(st->cur_dts - pkt->duration - pkt->pts); int64_t new_diff= FFABS(st->cur_dts - pkt->pts); if(old_diff < new_diff && old_diff < (pkt->duration>>3)){ pkt->pts += pkt->duration; // av_log(NULL, AV_LOG_DEBUG, ""id:%d old:%""PRId64"" new:%""PRId64"" dur:%d cur:%""PRId64"" size:%d\n"", pkt->stream_index, old_diff, new_diff, pkt->duration, st->cur_dts, pkt->size); } } /* presentation is not delayed : PTS and DTS are the same */ if(pkt->pts == AV_NOPTS_VALUE) pkt->pts = pkt->dts; update_initial_timestamps(s, pkt->stream_index, pkt->pts, pkt->pts); if(pkt->pts == AV_NOPTS_VALUE) pkt->pts = st->cur_dts; pkt->dts = pkt->pts; if(pkt->pts != AV_NOPTS_VALUE) st->cur_dts = pkt->pts + pkt->duration; } } if(pkt->pts != AV_NOPTS_VALUE && delay <= MAX_REORDER_DELAY){ st->pts_buffer[0]= pkt->pts; for(i=0; i<delay && st->pts_buffer[i] > st->pts_buffer[i+1]; i++) FFSWAP(int64_t, st->pts_buffer[i], st->pts_buffer[i+1]); if(pkt->dts == AV_NOPTS_VALUE) pkt->dts= st->pts_buffer[0]; if(st->codec->codec_id == CODEC_ID_H264){ //we skiped it above so we try here update_initial_timestamps(s, pkt->stream_index, pkt->dts, pkt->pts); // this should happen on the first packet } if(pkt->dts > st->cur_dts) st->cur_dts = pkt->dts; } // av_log(NULL, AV_LOG_ERROR, ""OUTdelayed:%d/%d pts:%""PRId64"", dts:%""PRId64"" cur_dts:%""PRId64""\n"", presentation_delayed, delay, pkt->pts, pkt->dts, st->cur_dts); /* update flags */ if(is_intra_only(st->codec)) pkt->flags |= AV_PKT_FLAG_KEY; else if (pc) { pkt->flags = 0; /* keyframe computation */ if (pc->key_frame == 1) pkt->flags |= AV_PKT_FLAG_KEY; else if (pc->key_frame == -1 && pc->pict_type == FF_I_TYPE) pkt->flags |= AV_PKT_FLAG_KEY; } if (pc) pkt->convergence_duration = pc->convergence_duration; }","No, it is non-vulnerable."11801178,"static void avc_biwgt_8width_msa(uint8_t *src, int32_t src_stride, uint8_t *dst, int32_t dst_stride, int32_t height, int32_t log2_denom, int32_t src_weight, int32_t dst_weight, int32_t offset_in) { uint8_t cnt; v16i8 src_wgt, dst_wgt, wgt; v16i8 src0, src1, src2, src3; v16i8 dst0, dst1, dst2, dst3; v8i16 temp0, temp1, temp2, temp3; v8i16 denom, offset, add_val; int32_t val = 128 * (src_weight + dst_weight); offset_in = ((offset_in + 1) | 1) << log2_denom; src_wgt = __msa_fill_b(src_weight); dst_wgt = __msa_fill_b(dst_weight); offset = __msa_fill_h(offset_in); denom = __msa_fill_h(log2_denom + 1); add_val = __msa_fill_h(val); offset += add_val; wgt = __msa_ilvev_b(dst_wgt, src_wgt); for (cnt = height / 4; cnt--;) { LOAD_4VECS_SB(src, src_stride, src0, src1, src2, src3); src += (4 * src_stride); LOAD_4VECS_SB(dst, dst_stride, dst0, dst1, dst2, dst3); XORI_B_4VECS_SB(src0, src1, src2, src3, src0, src1, src2, src3, 128); XORI_B_4VECS_SB(dst0, dst1, dst2, dst3, dst0, dst1, dst2, dst3, 128); ILVR_B_4VECS_SH(src0, src1, src2, src3, dst0, dst1, dst2, dst3, temp0, temp1, temp2, temp3); temp0 = __msa_dpadd_s_h(offset, wgt, (v16i8) temp0); temp1 = __msa_dpadd_s_h(offset, wgt, (v16i8) temp1); temp2 = __msa_dpadd_s_h(offset, wgt, (v16i8) temp2); temp3 = __msa_dpadd_s_h(offset, wgt, (v16i8) temp3); SRA_4VECS(temp0, temp1, temp2, temp3, temp0, temp1, temp2, temp3, denom); temp0 = CLIP_UNSIGNED_CHAR_H(temp0); temp1 = CLIP_UNSIGNED_CHAR_H(temp1); temp2 = CLIP_UNSIGNED_CHAR_H(temp2); temp3 = CLIP_UNSIGNED_CHAR_H(temp3); PCKEV_B_STORE_8_BYTES_4(temp0, temp1, temp2, temp3, dst, dst_stride); dst += 4 * dst_stride; } }","No, it is non-vulnerable."11811179,"static void add_input_streams(OptionsContext *o, AVFormatContext *ic) { int i; char *next, *codec_tag = NULL; for (i = 0; i < ic->nb_streams; i++) { AVStream *st = ic->streams[i]; AVCodecContext *dec = st->codec; InputStream *ist = av_mallocz(sizeof(*ist)); char *framerate = NULL; if (!ist) exit(1); GROW_ARRAY(input_streams, nb_input_streams); input_streams[nb_input_streams - 1] = ist; ist->st = st; ist->file_index = nb_input_files; ist->discard = 1; st->discard = AVDISCARD_ALL; ist->ts_scale = 1.0; MATCH_PER_STREAM_OPT(ts_scale, dbl, ist->ts_scale, ic, st); MATCH_PER_STREAM_OPT(codec_tags, str, codec_tag, ic, st); if (codec_tag) { uint32_t tag = strtol(codec_tag, &next, 0); if (*next) tag = AV_RL32(codec_tag); st->codec->codec_tag = tag; } ist->dec = choose_decoder(o, ic, st); ist->opts = filter_codec_opts(o->g->codec_opts, ist->st->codec->codec_id, ic, st, ist->dec); ist->reinit_filters = -1; MATCH_PER_STREAM_OPT(reinit_filters, i, ist->reinit_filters, ic, st); ist->filter_in_rescale_delta_last = AV_NOPTS_VALUE; switch (dec->codec_type) { case AVMEDIA_TYPE_VIDEO: if(!ist->dec) ist->dec = avcodec_find_decoder(dec->codec_id); if (dec->lowres) { dec->flags |= CODEC_FLAG_EMU_EDGE; } ist->resample_height = dec->height; ist->resample_width = dec->width; ist->resample_pix_fmt = dec->pix_fmt; MATCH_PER_STREAM_OPT(frame_rates, str, framerate, ic, st); if (framerate && av_parse_video_rate(&ist->framerate, framerate) < 0) { av_log(NULL, AV_LOG_ERROR, ""Error parsing framerate %s.\n"", framerate); exit(1); } ist->top_field_first = -1; MATCH_PER_STREAM_OPT(top_field_first, i, ist->top_field_first, ic, st); break; case AVMEDIA_TYPE_AUDIO: ist->guess_layout_max = INT_MAX; MATCH_PER_STREAM_OPT(guess_layout_max, i, ist->guess_layout_max, ic, st); guess_input_channel_layout(ist); ist->resample_sample_fmt = dec->sample_fmt; ist->resample_sample_rate = dec->sample_rate; ist->resample_channels = dec->channels; ist->resample_channel_layout = dec->channel_layout; break; case AVMEDIA_TYPE_DATA: case AVMEDIA_TYPE_SUBTITLE: if(!ist->dec) ist->dec = avcodec_find_decoder(dec->codec_id); MATCH_PER_STREAM_OPT(fix_sub_duration, i, ist->fix_sub_duration, ic, st); break; case AVMEDIA_TYPE_ATTACHMENT: case AVMEDIA_TYPE_UNKNOWN: break; default: abort(); } } }","No, it is non-vulnerable."11821180,"static av_cold int asink_init(AVFilterContext *ctx, void *opaque) { BufferSinkContext *buf = ctx->priv; AVABufferSinkParams *params = opaque; if (params && params->sample_fmts) { buf->sample_fmts = ff_copy_int_list(params->sample_fmts); if (!buf->sample_fmts) return AVERROR(ENOMEM); } if (params && params->sample_rates) { buf->sample_rates = ff_copy_int_list(params->sample_rates); if (!buf->sample_rates) return AVERROR(ENOMEM); } if (params && (params->channel_layouts || params->channel_counts)) { if (params->all_channel_counts) { av_log(ctx, AV_LOG_ERROR, ""Conflicting all_channel_counts and list in parameters\n""); return AVERROR(EINVAL); } buf->channel_layouts = concat_channels_lists(params->channel_layouts, params->channel_counts); if (!buf->channel_layouts) return AVERROR(ENOMEM); } if (params) buf->all_channel_counts = params->all_channel_counts; return common_init(ctx); }","No, it is non-vulnerable."11831181,"FWCfgState *pc_memory_init(PCMachineState *pcms, MemoryRegion *system_memory, MemoryRegion *rom_memory, MemoryRegion **ram_memory, PcGuestInfo *guest_info) { int linux_boot, i; MemoryRegion *ram, *option_rom_mr; MemoryRegion *ram_below_4g, *ram_above_4g; FWCfgState *fw_cfg; MachineState *machine = MACHINE(pcms); assert(machine->ram_size == pcms->below_4g_mem_size + pcms->above_4g_mem_size); linux_boot = (machine->kernel_filename != NULL); /* Allocate RAM. We allocate it as a single memory region and use * aliases to address portions of it, mostly for backwards compatibility * with older qemus that used qemu_ram_alloc(). */ ram = g_malloc(sizeof(*ram)); memory_region_allocate_system_memory(ram, NULL, ""pc.ram"", machine->ram_size); *ram_memory = ram; ram_below_4g = g_malloc(sizeof(*ram_below_4g)); memory_region_init_alias(ram_below_4g, NULL, ""ram-below-4g"", ram, 0, pcms->below_4g_mem_size); memory_region_add_subregion(system_memory, 0, ram_below_4g); e820_add_entry(0, pcms->below_4g_mem_size, E820_RAM); if (pcms->above_4g_mem_size > 0) { ram_above_4g = g_malloc(sizeof(*ram_above_4g)); memory_region_init_alias(ram_above_4g, NULL, ""ram-above-4g"", ram, pcms->below_4g_mem_size, pcms->above_4g_mem_size); memory_region_add_subregion(system_memory, 0x100000000ULL, ram_above_4g); e820_add_entry(0x100000000ULL, pcms->above_4g_mem_size, E820_RAM); } if (!guest_info->has_reserved_memory && (machine->ram_slots || (machine->maxram_size > machine->ram_size))) { MachineClass *mc = MACHINE_GET_CLASS(machine); error_report(""\""-memory 'slots|maxmem'\"" is not supported by: %s"", mc->name); exit(EXIT_FAILURE); } /* initialize hotplug memory address space */ if (guest_info->has_reserved_memory && (machine->ram_size < machine->maxram_size)) { ram_addr_t hotplug_mem_size = machine->maxram_size - machine->ram_size; if (machine->ram_slots > ACPI_MAX_RAM_SLOTS) { error_report(""unsupported amount of memory slots: %""PRIu64, machine->ram_slots); exit(EXIT_FAILURE); } if (QEMU_ALIGN_UP(machine->maxram_size, TARGET_PAGE_SIZE) != machine->maxram_size) { error_report(""maximum memory size must by aligned to multiple of "" ""%d bytes"", TARGET_PAGE_SIZE); exit(EXIT_FAILURE); } pcms->hotplug_memory.base = ROUND_UP(0x100000000ULL + pcms->above_4g_mem_size, 1ULL << 30); if (pcms->enforce_aligned_dimm) { /* size hotplug region assuming 1G page max alignment per slot */ hotplug_mem_size += (1ULL << 30) * machine->ram_slots; } if ((pcms->hotplug_memory.base + hotplug_mem_size) < hotplug_mem_size) { error_report(""unsupported amount of maximum memory: "" RAM_ADDR_FMT, machine->maxram_size); exit(EXIT_FAILURE); } memory_region_init(&pcms->hotplug_memory.mr, OBJECT(pcms), ""hotplug-memory"", hotplug_mem_size); memory_region_add_subregion(system_memory, pcms->hotplug_memory.base, &pcms->hotplug_memory.mr); } /* Initialize PC system firmware */ pc_system_firmware_init(rom_memory, guest_info->isapc_ram_fw); option_rom_mr = g_malloc(sizeof(*option_rom_mr)); memory_region_init_ram(option_rom_mr, NULL, ""pc.rom"", PC_ROM_SIZE, &error_abort); vmstate_register_ram_global(option_rom_mr); memory_region_add_subregion_overlap(rom_memory, PC_ROM_MIN_VGA, option_rom_mr, 1); fw_cfg = bochs_bios_init(); rom_set_fw(fw_cfg); if (guest_info->has_reserved_memory && pcms->hotplug_memory.base) { uint64_t *val = g_malloc(sizeof(*val)); uint64_t res_mem_end = pcms->hotplug_memory.base + memory_region_size(&pcms->hotplug_memory.mr); *val = cpu_to_le64(ROUND_UP(res_mem_end, 0x1ULL << 30)); fw_cfg_add_file(fw_cfg, ""etc/reserved-memory-end"", val, sizeof(*val)); } if (linux_boot) { load_linux(pcms, fw_cfg); } for (i = 0; i < nb_option_roms; i++) { rom_add_option(option_rom[i].name, option_rom[i].bootindex); } guest_info->fw_cfg = fw_cfg; return fw_cfg; }","No, it is non-vulnerable."11841182,"static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs, int64_t sector_num, QEMUIOVector *iov, int nb_sectors, BlockDriverCompletionFunc *cb, void *opaque, int is_write) { VectorTranslationState *s = qemu_mallocz(sizeof(*s)); BlockDriverAIOCB *aiocb = qemu_aio_get(bs, cb, opaque); s->this_aiocb = aiocb; s->iov = iov; s->bounce = qemu_memalign(512, nb_sectors * 512); s->is_write = is_write; if (is_write) { qemu_iovec_to_buffer(s->iov, s->bounce); s->aiocb = bdrv_aio_write(bs, sector_num, s->bounce, nb_sectors, bdrv_aio_rw_vector_cb, s); } else { s->aiocb = bdrv_aio_read(bs, sector_num, s->bounce, nb_sectors, bdrv_aio_rw_vector_cb, s); } return aiocb; }","No, it is non-vulnerable."11851183,"static void pc_machine_set_max_ram_below_4g(Object *obj, Visitor *v, const char *name, void *opaque, Error **errp) { PCMachineState *pcms = PC_MACHINE(obj); Error *error = NULL; uint64_t value; visit_type_size(v, name, &value, &error); if (error) { error_propagate(errp, error); return; } if (value > (1ULL << 32)) { error_setg(&error, ""Machine option 'max-ram-below-4g=%""PRIu64 ""' expects size less than or equal to 4G"", value); error_propagate(errp, error); return; } if (value < (1ULL << 20)) { error_report(""Warning: small max_ram_below_4g(%""PRIu64 "") less than 1M. BIOS may not work.."", value); } pcms->max_ram_below_4g = value; }","No, it is non-vulnerable."11861184,"static int rv30_decode_intra_types(RV34DecContext *r, GetBitContext *gb, int8_t *dst) { int i, j, k; for(i = 0; i < 4; i++, dst += r->intra_types_stride - 4){ for(j = 0; j < 4; j+= 2){ int code = svq3_get_ue_golomb(gb) << 1; if(code >= 81*2){ av_log(r->s.avctx, AV_LOG_ERROR, ""Incorrect intra prediction code\n""); return -1; } for(k = 0; k < 2; k++){ int A = dst[-r->intra_types_stride] + 1; int B = dst[-1] + 1; *dst++ = rv30_itype_from_context[A * 90 + B * 9 + rv30_itype_code[code + k]]; if(dst[-1] == 9){ av_log(r->s.avctx, AV_LOG_ERROR, ""Incorrect intra prediction mode\n""); return -1; } } } } return 0; }","Yes, it is vulnerable."11871185,"static int stdio_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size) { QEMUFileStdio *s = opaque; FILE *fp = s->stdio_file; int bytes; do { clearerr(fp); bytes = fread(buf, 1, size, fp); } while ((bytes == 0) && ferror(fp) && (errno == EINTR)); return bytes; }","Yes, it is vulnerable."11881186,"static av_cold int set_channel_info(AC3EncodeContext *s, int channels, int64_t *channel_layout) { int ch_layout; if (channels < 1 || channels > AC3_MAX_CHANNELS) return AVERROR(EINVAL); if ((uint64_t)*channel_layout > 0x7FF) return AVERROR(EINVAL); ch_layout = *channel_layout; if (!ch_layout) ch_layout = avcodec_guess_channel_layout(channels, CODEC_ID_AC3, NULL); if (av_get_channel_layout_nb_channels(ch_layout) != channels) return AVERROR(EINVAL); s->lfe_on = !!(ch_layout & AV_CH_LOW_FREQUENCY); s->channels = channels; s->fbw_channels = channels - s->lfe_on; s->lfe_channel = s->lfe_on ? s->fbw_channels : -1; if (s->lfe_on) ch_layout -= AV_CH_LOW_FREQUENCY; switch (ch_layout) { case AV_CH_LAYOUT_MONO: s->channel_mode = AC3_CHMODE_MONO; break; case AV_CH_LAYOUT_STEREO: s->channel_mode = AC3_CHMODE_STEREO; break; case AV_CH_LAYOUT_SURROUND: s->channel_mode = AC3_CHMODE_3F; break; case AV_CH_LAYOUT_2_1: s->channel_mode = AC3_CHMODE_2F1R; break; case AV_CH_LAYOUT_4POINT0: s->channel_mode = AC3_CHMODE_3F1R; break; case AV_CH_LAYOUT_QUAD: case AV_CH_LAYOUT_2_2: s->channel_mode = AC3_CHMODE_2F2R; break; case AV_CH_LAYOUT_5POINT0: case AV_CH_LAYOUT_5POINT0_BACK: s->channel_mode = AC3_CHMODE_3F2R; break; default: return AVERROR(EINVAL); } s->has_center = (s->channel_mode & 0x01) && s->channel_mode != AC3_CHMODE_MONO; s->has_surround = s->channel_mode & 0x04; s->channel_map = ff_ac3_enc_channel_map[s->channel_mode][s->lfe_on]; *channel_layout = ch_layout; if (s->lfe_on) *channel_layout |= AV_CH_LOW_FREQUENCY; return 0; }","No, it is non-vulnerable."11891187,"static MemoryRegionSection *phys_page_find(PhysPageEntry lp, hwaddr index, Node *nodes, MemoryRegionSection *sections) { PhysPageEntry *p; int i; for (i = P_L2_LEVELS - 1; i >= 0 && !lp.is_leaf; i--) { if (lp.ptr == PHYS_MAP_NODE_NIL) { return &sections[PHYS_SECTION_UNASSIGNED]; } p = nodes[lp.ptr]; lp = p[(index >> (i * L2_BITS)) & (L2_SIZE - 1)]; } return &sections[lp.ptr]; }","No, it is non-vulnerable."11901188,"static int ram_save_block(QEMUFile *f, bool last_stage) { RAMBlock *block = last_seen_block; ram_addr_t offset = last_offset; int bytes_sent = -1; MemoryRegion *mr; ram_addr_t current_addr; if (!block) block = QTAILQ_FIRST(&ram_list.blocks); do { mr = block->mr; if (migration_bitmap_test_and_reset_dirty(mr, offset)) { uint8_t *p; int cont = (block == last_sent_block) ? RAM_SAVE_FLAG_CONTINUE : 0; p = memory_region_get_ram_ptr(mr) + offset; if (is_dup_page(p)) { acct_info.dup_pages++; save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_COMPRESS); qemu_put_byte(f, *p); bytes_sent = 1; } else if (migrate_use_xbzrle()) { current_addr = block->offset + offset; bytes_sent = save_xbzrle_page(f, p, current_addr, block, offset, cont, last_stage); if (!last_stage) { p = get_cached_data(XBZRLE.cache, current_addr); } } /* either we didn't send yet (we may have had XBZRLE overflow) */ if (bytes_sent == -1) { save_block_hdr(f, block, offset, cont, RAM_SAVE_FLAG_PAGE); qemu_put_buffer(f, p, TARGET_PAGE_SIZE); bytes_sent = TARGET_PAGE_SIZE; acct_info.norm_pages++; } /* if page is unmodified, continue to the next */ if (bytes_sent != 0) { last_sent_block = block; break; } } offset += TARGET_PAGE_SIZE; if (offset >= block->length) { offset = 0; block = QTAILQ_NEXT(block, next); if (!block) block = QTAILQ_FIRST(&ram_list.blocks); } } while (block != last_seen_block || offset != last_offset); last_seen_block = block; last_offset = offset; return bytes_sent; }","No, it is non-vulnerable."11911189,"static int os_host_main_loop_wait(int64_t timeout) { int ret; static int spin_counter; glib_pollfds_fill(&timeout); /* If the I/O thread is very busy or we are incorrectly busy waiting in * the I/O thread, this can lead to starvation of the BQL such that the * VCPU threads never run. To make sure we can detect the later case, * print a message to the screen. If we run into this condition, create * a fake timeout in order to give the VCPU threads a chance to run. */ if (!timeout && (spin_counter > MAX_MAIN_LOOP_SPIN)) { static bool notified; if (!notified && !qtest_driver()) { fprintf(stderr, ""main-loop: WARNING: I/O thread spun for %d iterations\n"", MAX_MAIN_LOOP_SPIN); notified = true; } timeout = SCALE_MS; } if (timeout) { spin_counter = 0; qemu_mutex_unlock_iothread(); } else { spin_counter++; } ret = qemu_poll_ns((GPollFD *)gpollfds->data, gpollfds->len, timeout); if (timeout) { qemu_mutex_lock_iothread(); } glib_pollfds_poll(); return ret; }","No, it is non-vulnerable."11921190,"static void qemu_kill_report(void) { if (!qtest_driver() && shutdown_signal != -1) { fprintf(stderr, ""qemu: terminating on signal %d"", shutdown_signal); if (shutdown_pid == 0) { /* This happens for eg ^C at the terminal, so it's worth * avoiding printing an odd message in that case. */ fputc('\n', stderr); } else { fprintf(stderr, "" from pid "" FMT_pid ""\n"", shutdown_pid); } shutdown_signal = -1; } }","No, it is non-vulnerable."11931191,static void term_bol(void) { term_cmd_buf_index = 0; },"No, it is non-vulnerable."11941192,"static void imx_serial_write(void *opaque, target_phys_addr_t offset, uint64_t value, unsigned size) { IMXSerialState *s = (IMXSerialState *)opaque; unsigned char ch; DPRINTF(""write(offset=%x, value = %x) to %s\n"", offset >> 2, (unsigned int)value, s->chr ? s->chr->label : ""NODEV""); switch (offset >> 2) { case 0x10: /* UTXD */ ch = value; if (s->ucr2 & UCR2_TXEN) { if (s->chr) { qemu_chr_fe_write(s->chr, &ch, 1); } s->usr1 &= ~USR1_TRDY; imx_update(s); s->usr1 |= USR1_TRDY; imx_update(s); } break; case 0x20: /* UCR1 */ s->ucr1 = value & 0xffff; DPRINTF(""write(ucr1=%x)\n"", (unsigned int)value); imx_update(s); break; case 0x21: /* UCR2 */ /* * Only a few bits in control register 2 are implemented as yet. * If it's intended to use a real serial device as a back-end, this * register will have to be implemented more fully. */ if (!(value & UCR2_SRST)) { imx_serial_reset(s); imx_update(s); value |= UCR2_SRST; } if (value & UCR2_RXEN) { if (!(s->ucr2 & UCR2_RXEN)) { qemu_chr_accept_input(s->chr); } } s->ucr2 = value & 0xffff; break; case 0x25: /* USR1 */ value &= USR1_AWAKE | USR1_AIRINT | USR1_DTRD | USR1_AGTIM | USR1_FRAMERR | USR1_ESCF | USR1_RTSD | USR1_PARTYER; s->usr1 &= ~value; break; case 0x26: /* USR2 */ /* * Writing 1 to some bits clears them; all other * values are ignored */ value &= USR2_ADET | USR2_DTRF | USR2_IDLE | USR2_ACST | USR2_RIDELT | USR2_IRINT | USR2_WAKE | USR2_DCDDELT | USR2_RTSF | USR2_BRCD | USR2_ORE; s->usr2 &= ~value; break; /* * Linux expects to see what it writes to these registers * We don't currently alter the baud rate */ case 0x29: /* UBIR */ s->ubrc = value & 0xffff; break; case 0x2a: /* UBMR */ s->ubmr = value & 0xffff; break; case 0x2c: /* One ms reg */ s->onems = value & 0xffff; break; case 0x24: /* FIFO control register */ s->ufcr = value & 0xffff; break; case 0x22: /* UCR3 */ s->ucr3 = value & 0xffff; break; case 0x2d: /* UTS1 */ case 0x23: /* UCR4 */ IPRINTF(""Unimplemented Register %x written to\n"", offset >> 2); /* TODO */ break; default: IPRINTF(""imx_serial_write: Bad offset 0x%x\n"", (int)offset); } }","No, it is non-vulnerable."11951193,"static int cinepak_decode (CinepakContext *s) { uint8_t *eod = (s->data + s->size); int i, result, strip_size, frame_flags, num_strips; int y0 = 0; int encoded_buf_size; /* if true, Cinepak data is from a Sega FILM/CPK file */ int sega_film_data = 0; if (s->size < 10) return -1; frame_flags = s->data[0]; num_strips = BE_16 (&s->data[8]); encoded_buf_size = ((s->data[1] << 16) | BE_16 (&s->data[2])); if (encoded_buf_size != s->size) sega_film_data = 1; if (sega_film_data) s->data += 12; else s->data += 10; if (num_strips > MAX_STRIPS) num_strips = MAX_STRIPS; for (i=0; i < num_strips; i++) { if ((s->data + 12) > eod) return -1; s->strips[i].id = BE_16 (s->data); s->strips[i].y1 = y0; s->strips[i].x1 = 0; s->strips[i].y2 = y0 + BE_16 (&s->data[8]); s->strips[i].x2 = s->avctx->width; strip_size = BE_16 (&s->data[2]) - 12; s->data += 12; strip_size = ((s->data + strip_size) > eod) ? (eod - s->data) : strip_size; if ((i > 0) && !(frame_flags & 0x01)) { memcpy (s->strips[i].v4_codebook, s->strips[i-1].v4_codebook, sizeof(s->strips[i].v4_codebook)); memcpy (s->strips[i].v1_codebook, s->strips[i-1].v1_codebook, sizeof(s->strips[i].v1_codebook)); } result = cinepak_decode_strip (s, &s->strips[i], s->data, strip_size); if (result != 0) return result; s->data += strip_size; y0 = s->strips[i].y2; } return 0; }","No, it is non-vulnerable."11961194,"int qcow2_check_refcounts(BlockDriverState *bs, BdrvCheckResult *res) { BDRVQcowState *s = bs->opaque; int64_t size; int nb_clusters, refcount1, refcount2, i; QCowSnapshot *sn; uint16_t *refcount_table; int ret; size = bdrv_getlength(bs->file); nb_clusters = size_to_clusters(s, size); refcount_table = qemu_mallocz(nb_clusters * sizeof(uint16_t)); /* header */ inc_refcounts(bs, res, refcount_table, nb_clusters, 0, s->cluster_size); /* current L1 table */ ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters, s->l1_table_offset, s->l1_size, 1); if (ret < 0) { return ret; } /* snapshots */ for(i = 0; i < s->nb_snapshots; i++) { sn = s->snapshots + i; ret = check_refcounts_l1(bs, res, refcount_table, nb_clusters, sn->l1_table_offset, sn->l1_size, 0); if (ret < 0) { return ret; } } inc_refcounts(bs, res, refcount_table, nb_clusters, s->snapshots_offset, s->snapshots_size); /* refcount data */ inc_refcounts(bs, res, refcount_table, nb_clusters, s->refcount_table_offset, s->refcount_table_size * sizeof(uint64_t)); for(i = 0; i < s->refcount_table_size; i++) { uint64_t offset, cluster; offset = s->refcount_table[i]; cluster = offset >> s->cluster_bits; /* Refcount blocks are cluster aligned */ if (offset & (s->cluster_size - 1)) { fprintf(stderr, ""ERROR refcount block %d is not "" ""cluster aligned; refcount table entry corrupted\n"", i); res->corruptions++; continue; } if (cluster >= nb_clusters) { fprintf(stderr, ""ERROR refcount block %d is outside image\n"", i); res->corruptions++; continue; } if (offset != 0) { inc_refcounts(bs, res, refcount_table, nb_clusters, offset, s->cluster_size); if (refcount_table[cluster] != 1) { fprintf(stderr, ""ERROR refcount block %d refcount=%d\n"", i, refcount_table[cluster]); res->corruptions++; } } } /* compare ref counts */ for(i = 0; i < nb_clusters; i++) { refcount1 = get_refcount(bs, i); if (refcount1 < 0) { fprintf(stderr, ""Can't get refcount for cluster %d: %s\n"", i, strerror(-refcount1)); res->check_errors++; continue; } refcount2 = refcount_table[i]; if (refcount1 != refcount2) { fprintf(stderr, ""%s cluster %d refcount=%d reference=%d\n"", refcount1 < refcount2 ? ""ERROR"" : ""Leaked"", i, refcount1, refcount2); if (refcount1 < refcount2) { res->corruptions++; } else { res->leaks++; } } } qemu_free(refcount_table); return 0; }","Yes, it is vulnerable."11971195,"static int gen_set_psr_im(DisasContext *s, uint32_t mask, int spsr, uint32_t val) { TCGv tmp; tmp = new_tmp(); tcg_gen_movi_i32(tmp, val); return gen_set_psr(s, mask, spsr, tmp); }","Yes, it is vulnerable."11981196,"int configure_filtergraph(FilterGraph *fg) { AVFilterInOut *inputs, *outputs, *cur; int ret, i, simple = !fg->graph_desc; const char *graph_desc = simple ? fg->outputs[0]->ost->avfilter : fg->graph_desc; avfilter_graph_free(&fg->graph); if (!(fg->graph = avfilter_graph_alloc())) return AVERROR(ENOMEM); if (simple) { OutputStream *ost = fg->outputs[0]->ost; char args[512]; AVDictionaryEntry *e = NULL; args[0] = 0; while ((e = av_dict_get(ost->sws_dict, """", e, AV_DICT_IGNORE_SUFFIX))) { av_strlcatf(args, sizeof(args), ""%s=%s:"", e->key, e->value); } if (strlen(args)) args[strlen(args)-1] = 0; fg->graph->scale_sws_opts = av_strdup(args); args[0] = 0; while ((e = av_dict_get(ost->swr_opts, """", e, AV_DICT_IGNORE_SUFFIX))) { av_strlcatf(args, sizeof(args), ""%s=%s:"", e->key, e->value); } if (strlen(args)) args[strlen(args)-1] = 0; av_opt_set(fg->graph, ""aresample_swr_opts"", args, 0); args[0] = '\0'; while ((e = av_dict_get(fg->outputs[0]->ost->resample_opts, """", e, AV_DICT_IGNORE_SUFFIX))) { av_strlcatf(args, sizeof(args), ""%s=%s:"", e->key, e->value); } if (strlen(args)) args[strlen(args) - 1] = '\0'; fg->graph->resample_lavr_opts = av_strdup(args); e = av_dict_get(ost->encoder_opts, ""threads"", NULL, 0); if (e) av_opt_set(fg->graph, ""threads"", e->value, 0); } if ((ret = avfilter_graph_parse2(fg->graph, graph_desc, &inputs, &outputs)) < 0) return ret; if (simple && (!inputs || inputs->next || !outputs || outputs->next)) { const char *num_inputs; const char *num_outputs; if (!outputs) { num_outputs = ""0""; } else if (outputs->next) { num_outputs = "">1""; } else { num_outputs = ""1""; } if (!inputs) { num_inputs = ""0""; } else if (inputs->next) { num_inputs = "">1""; } else { num_inputs = ""1""; } av_log(NULL, AV_LOG_ERROR, ""Simple filtergraph '%s' was expected "" ""to have exactly 1 input and 1 output."" "" However, it had %s input(s) and %s output(s)."" "" Please adjust, or use a complex filtergraph (-filter_complex) instead.\n"", graph_desc, num_inputs, num_outputs); return AVERROR(EINVAL); } for (cur = inputs, i = 0; cur; cur = cur->next, i++) if ((ret = configure_input_filter(fg, fg->inputs[i], cur)) < 0) { avfilter_inout_free(&inputs); avfilter_inout_free(&outputs); return ret; } avfilter_inout_free(&inputs); for (cur = outputs, i = 0; cur; cur = cur->next, i++) configure_output_filter(fg, fg->outputs[i], cur); avfilter_inout_free(&outputs); if ((ret = avfilter_graph_config(fg->graph, NULL)) < 0) return ret; fg->reconfiguration = 1; for (i = 0; i < fg->nb_outputs; i++) { OutputStream *ost = fg->outputs[i]->ost; if (!ost->enc) { /* identical to the same check in ffmpeg.c, needed because complex filter graphs are initialized earlier */ av_log(NULL, AV_LOG_ERROR, ""Encoder (codec %s) not found for output stream #%d:%d\n"", avcodec_get_name(ost->st->codec->codec_id), ost->file_index, ost->index); return AVERROR(EINVAL); } if (ost && ost->enc->type == AVMEDIA_TYPE_AUDIO && !(ost->enc->capabilities & AV_CODEC_CAP_VARIABLE_FRAME_SIZE)) av_buffersink_set_frame_size(ost->filter->filter, ost->enc_ctx->frame_size); } return 0; }","No, it is non-vulnerable."11991197,"static void vhost_ccw_scsi_realize(VirtioCcwDevice *ccw_dev, Error **errp) { VHostSCSICcw *dev = VHOST_SCSI_CCW(ccw_dev); DeviceState *vdev = DEVICE(&dev->vdev); Error *err = NULL; qdev_set_parent_bus(vdev, BUS(&ccw_dev->bus)); object_property_set_bool(OBJECT(vdev), true, ""realized"", &err); if (err) { error_propagate(errp, err); } }","No, it is non-vulnerable."12001198,"ssize_t nbd_send_request(int csock, struct nbd_request *request) { uint8_t buf[4 + 4 + 8 + 8 + 4]; cpu_to_be32w((uint32_t*)buf, NBD_REQUEST_MAGIC); cpu_to_be32w((uint32_t*)(buf + 4), request->type); cpu_to_be64w((uint64_t*)(buf + 8), request->handle); cpu_to_be64w((uint64_t*)(buf + 16), request->from); cpu_to_be32w((uint32_t*)(buf + 24), request->len); TRACE(""Sending request to client: "" ""{ .from = %"" PRIu64"", .len = %u, .handle = %"" PRIu64"", .type=%i}"", request->from, request->len, request->handle, request->type); if (write_sync(csock, buf, sizeof(buf)) != sizeof(buf)) { LOG(""writing to socket failed""); errno = EINVAL; return -1; } return 0; }","No, it is non-vulnerable."

Showing the first 1,200 of 2734 lines. Download the file for the rest.