|
 |
9ae3a8 |
From 2ff46c139a37bbe66732b9024daa771eff3e6c36 Mon Sep 17 00:00:00 2001
|
|
|
9ae3a8 |
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9ae3a8 |
Date: Tue, 7 Feb 2017 10:07:52 +0100
|
|
|
9ae3a8 |
Subject: [PATCH 09/11] cirrus: fix oob access issue (CVE-2017-2615)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9ae3a8 |
Message-id: <1486462072-32174-8-git-send-email-kraxel@redhat.com>
|
|
|
9ae3a8 |
Patchwork-id: 73565
|
|
|
9ae3a8 |
O-Subject: [RHEL-7.4 qemu-kvm PATCH 7/7] cirrus: fix oob access issue (CVE-2017-2615)
|
|
|
9ae3a8 |
Bugzilla: 1418233
|
|
|
9ae3a8 |
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9ae3a8 |
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
From: Li Qiang <liqiang6-s@360.cn>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
When doing bitblt copy in backward mode, we should minus the
|
|
|
9ae3a8 |
blt width first just like the adding in the forward mode. This
|
|
|
9ae3a8 |
can avoid the oob access of the front of vga's vram.
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
{ kraxel: with backward blits (negative pitch) addr is the topmost
|
|
|
9ae3a8 |
address, so check it as-is against vram size ]
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
Cc: qemu-stable@nongnu.org
|
|
|
9ae3a8 |
Cc: P J P <ppandit@redhat.com>
|
|
|
9ae3a8 |
Cc: Laszlo Ersek <lersek@redhat.com>
|
|
|
9ae3a8 |
Cc: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
9ae3a8 |
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
|
|
|
9ae3a8 |
Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
|
|
|
9ae3a8 |
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
|
9ae3a8 |
Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
|
|
|
9ae3a8 |
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
|
9ae3a8 |
(cherry picked from commit 62d4c6bd5263bb8413a06c80144fc678df6dfb64)
|
|
|
9ae3a8 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
9ae3a8 |
---
|
|
|
9ae3a8 |
hw/display/cirrus_vga.c | 7 +++----
|
|
|
9ae3a8 |
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
9ae3a8 |
|
|
|
9ae3a8 |
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
|
|
|
9ae3a8 |
index 6aa29a3..e0e39ef 100644
|
|
|
9ae3a8 |
--- a/hw/display/cirrus_vga.c
|
|
|
9ae3a8 |
+++ b/hw/display/cirrus_vga.c
|
|
|
9ae3a8 |
@@ -269,10 +269,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
|
|
|
9ae3a8 |
{
|
|
|
9ae3a8 |
if (pitch < 0) {
|
|
|
9ae3a8 |
int64_t min = addr
|
|
|
9ae3a8 |
- + ((int64_t)s->cirrus_blt_height-1) * pitch;
|
|
|
9ae3a8 |
- int32_t max = addr
|
|
|
9ae3a8 |
- + s->cirrus_blt_width;
|
|
|
9ae3a8 |
- if (min < 0 || max > s->vga.vram_size) {
|
|
|
9ae3a8 |
+ + ((int64_t)s->cirrus_blt_height - 1) * pitch
|
|
|
9ae3a8 |
+ - s->cirrus_blt_width;
|
|
|
9ae3a8 |
+ if (min < -1 || addr >= s->vga.vram_size) {
|
|
|
9ae3a8 |
return true;
|
|
|
9ae3a8 |
}
|
|
|
9ae3a8 |
} else {
|
|
|
9ae3a8 |
--
|
|
|
9ae3a8 |
1.8.3.1
|
|
|
9ae3a8 |
|