From ca0fe6dc4ff9fd12bca751d73b20b309f0444ae2 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 30 Sep 2013 14:32:39 +0200 Subject: x86: properly set up fbld emulation operand address This is CVE-2013-4361 / XSA-66. Signed-off-by: Jan Beulich Acked-by: Ian Jackson master commit: 28b706efb6abb637fabfd74cde70a50935a5640b master date: 2013-09-30 14:18:58 +0200 --- xen/arch/x86/x86_emulate/x86_emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index f4686c467e..d1c2c239ad 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2975,11 +2975,11 @@ x86_emulate( break; case 4: /* fbld m80dec */ ea.bytes = 10; - dst = ea; + src = ea; if ( (rc = ops->read(src.mem.seg, src.mem.off, &src.val, src.bytes, ctxt)) != 0 ) goto done; - emulate_fpu_insn_memdst("fbld", src.val); + emulate_fpu_insn_memsrc("fbld", src.val); break; case 5: /* fild m64i */ ea.bytes = 8; -- cgit v1.2.3