58 lines
2 KiB
Text
58 lines
2 KiB
Text
$NetBSD: patch-XSA-208-2,v 1.1 2017/03/20 18:09:21 bouyer Exp $
|
|
|
|
From 8f63265efeb6f92e63f7e749cb26131b68b20df7 Mon Sep 17 00:00:00 2001
|
|
From: Li Qiang <liqiang6-s@360.cn>
|
|
Date: Mon, 13 Feb 2017 15:22:15 +0000
|
|
Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
|
|
|
|
When doing bitblt copy in backward mode, we should minus the
|
|
blt width first just like the adding in the forward mode. This
|
|
can avoid the oob access of the front of vga's vram.
|
|
|
|
This is XSA-208.
|
|
|
|
upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
|
|
|
|
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
|
|
|
|
{ kraxel: with backward blits (negative pitch) addr is the topmost
|
|
address, so check it as-is against vram size ]
|
|
|
|
[ This is CVE-2017-2615 / XSA-208 - Ian Jackson ]
|
|
|
|
Cc: qemu-stable@nongnu.org
|
|
Cc: P J P <ppandit@redhat.com>
|
|
Cc: Laszlo Ersek <lersek@redhat.com>
|
|
Cc: Paolo Bonzini <pbonzini@redhat.com>
|
|
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
|
|
Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
|
|
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
|
|
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
|
|
---
|
|
hw/cirrus_vga.c | 7 +++----
|
|
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
|
|
index e6c3893..364e22d 100644
|
|
--- qemu-xen-traditional/hw/cirrus_vga.c.orig
|
|
+++ qemu-xen-traditional/hw/cirrus_vga.c
|
|
@@ -308,10 +308,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s,
|
|
{
|
|
if (pitch < 0) {
|
|
int64_t min = addr
|
|
- + ((int64_t)s->cirrus_blt_height-1) * pitch;
|
|
- int32_t max = addr
|
|
- + s->cirrus_blt_width;
|
|
- if (min < 0 || max >= s->vram_size) {
|
|
+ + ((int64_t)s->cirrus_blt_height - 1) * pitch
|
|
+ - s->cirrus_blt_width;
|
|
+ if (min < -1 || addr >= s->vram_size) {
|
|
return true;
|
|
}
|
|
} else {
|
|
--
|
|
2.1.4
|
|
|