参考文章:872K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2K6k6h3y4H3N6h3I4K6k6g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5j5$3S2A6N6X3g2K6i4K6u0r3y4U0j5H3x3W2)9J5k6h3S2@1L8h3H3`.QEMU版本:1.5.3FDC（Floppy Disk Controller）是模拟 Intel 82078 软盘控制器的硬件设备，用于：当 offset 为 5则会调用 fdctrl_write_dataFIFO是FDC的核心缓冲区，用于：我们可以看见 fdctrl->fifo 被分配了较为固定的512字节大小的存储。一共这里我们可以看见分为两个板块,一个板块是接收数据一个板块是判断数据接收完毕调用函数,然后设置标识位那么根据映射表我们可以知道 fdctrl_handle_drive_specification_command 函数会被调用当我们调用0x3f5,并且传入0x8e这种情况的时候，会去调用**fdctrl_handle_drive_specification_command函数,**然后在参数传递完毕后该函数并没有很好的处理fifo的状态，并且 后续的参数传递依赖的 data_pos,而data_pos是无限增加的。QEMU启动
---
来源: 看雪论坛
原文链接: https://bbs.kanxue.com/thread-289262.htm
[原创]CVE-2015-3456 Qemu逃逸复现
489 浏览
1 回复
师傅，请问你的qemu1.5.3是怎么编译的？我的编译总是会出错：
/usr/include/libfdt.h: In function ‘fdt_appendprop_u64’:
/usr/include/libfdt.h:1720:2: error: unknown type name ‘fdt64_t’; did you mean ‘int64_t’?
fdt64_t tmp = cpu_to_fdt64(val);
^~~~~~~
int64_t
/home/c0ld1nk/qemu/qemu-1.5.3/rules.mak:21: recipe for target 'device_tree.o' failed
make[1]: *** [device_tree.o] Error 1
make[1]: *** Waiting for unfinished jobs....
Makefile:137: recipe for target 'subdir-cris-softmmu' failed
make: *** [subdir-cris-softmmu] Error 2
Makefile:137: recipe for target 'subdir-i386-softmmu' failed
make: *** [subdir-i386-softmmu] Error 2
Makefile:137: recipe for target 'subdir-lm32-softmmu' failed
make: *** [subdir-lm32-softmmu] Error 2
/usr/include/libfdt.h: In function ‘fdt_appendprop_u64’:
/usr/include/libfdt.h:1720:2: error: unknown type name ‘fdt64_t’; did you mean ‘int64_t’?
fdt64_t tmp = cpu_to_fdt64(val);
^~~~~~~
int64_t
/home/c0ld1nk/qemu/qemu-1.5.3/rules.mak:21: recipe for target 'device_tree.o' failed
make[1]: *** [device_tree.o] Error 1
make[1]: *** Waiting for unfinished jobs....
Makefile:137: recipe for target 'subdir-cris-softmmu' failed
make: *** [subdir-cris-softmmu] Error 2
Makefile:137: recipe for target 'subdir-i386-softmmu' failed
make: *** [subdir-i386-softmmu] Error 2
Makefile:137: recipe for target 'subdir-lm32-softmmu' failed
make: *** [subdir-lm32-softmmu] Error 2