$OpenBSD: patch-hw_timer_i8254_c,v 1.1 2015/08/11 21:28:53 sthen Exp $

i8254: fix out-of-bounds memory access in pit_ioport_read()

Due converting PIO to the new memory read/write api we no longer provide
separate I/O region lenghts for read and write operations. As a result,
reading from PIT Mode/Command register will end with accessing
pit->channels with invalid index.

Fix this by ignoring read from the Mode/Command register.

This is CVE-2015-3214.

--- hw/timer/i8254.c.orig	Wed Aug  5 03:32:10 2015
+++ hw/timer/i8254.c	Wed Aug  5 03:34:42 2015
@@ -196,6 +196,12 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr a
     PITChannelState *s;
 
     addr &= 3;
+
+    if (addr == 3) {
+        /* Mode/Command register is write only, read is ignored */
+        return 0;
+    }
+
     s = &pit->channels[addr];
     if (s->status_latched) {
         s->status_latched = 0;
