OpenE2K
/
qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

cirrus: fix blit region check 

-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJUgEuRAAoJEEy22O7T6HE4fP4QALz1eAyKFFmM3qLmQMjiVsjc
 hzBfw+DLTLHfxL6LPO2+k6iRbMe72w1I5KJwZg3p3njt5QkvXdw7xJ616UD+3aAl
 iwChsc7cnN+Kivjp9PEN5v0mfNzKrGrOXJaGClHW5+jRullDLcxaTY94SYtkKyMZ
 xPi/4JEY8kmR38mSzGT13WOjjQvE5FyXLrfPGWty5yoUV7iI6PGr8CFrvWpiKnHV
 7QOvZ2lAdSE2Ls45xfcITEoMzXHQjyhB9mVOGb7NE11+TAB2H4oM4VFxbzXwSidK
 XgYVBGnvtpY+cJwhDm0zNzIHWVsv3rS3kgtRplfq1aZAcCwgkSAmVP6Pot6iTPro
 1Cv6QdTN65RaOqS9soN7KeeHtRxjJeUf99ByND7QLfmNy713dob+TdJ3XLzo2QtD
 wXcsXYq1QIlk0nlxPprVQRtx0F4q7p876RIeb5tuDFhf4U5GrAD6wyFju6FZybPI
 k4MYeSb0x8lBwRCpxxvEIBMnvgE6rOtaKwCzppB1Jlx/BibOHRy3Ew9lrdDNQnwC
 UiLQyNCeQOc0AMNUvpvpomB292DOabzJEnUKPuPIcenMtDIMbvzLb7aDkXtWYo1M
 sPKNImymGUvlxykOC7pwEDJEZKOeZCeupuTvSpibg6q6HhfyhBDhnpjzXid9OXnD
 dFvGaEp7VPcYWovwTegI
 =DSEh
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2014-8106-20141204-1' into staging

cirrus: fix blit region check

# gpg: Signature made Thu 04 Dec 2014 11:54:57 GMT using RSA key ID D3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"

* remotes/kraxel/tags/pull-cve-2014-8106-20141204-1:
  cirrus: don't overflow CirrusVGAState->cirrus_bltbuf
  cirrus: fix blit region check

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2014-12-04 12:22:46 +00:00
parent 0d7954c288 bf25983345
commit 54f3a180a3
1 changed files with 48 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
hw/display/cirrus_vga.c
View File

@ -173,20 +173,6 @@
#define CIRRUS_PNPMMIO_SIZE 0x1000
#define BLTUNSAFE(s) \
( \
( /* check dst is within bounds */ \
(s)->cirrus_blt_height * ABS((s)->cirrus_blt_dstpitch) \
+ ((s)->cirrus_blt_dstaddr & (s)->cirrus_addr_mask) > \
(s)->vga.vram_size \
) || \
( /* check src is within bounds */ \
(s)->cirrus_blt_height * ABS((s)->cirrus_blt_srcpitch) \
+ ((s)->cirrus_blt_srcaddr & (s)->cirrus_addr_mask) > \
(s)->vga.vram_size \
) \
)
struct CirrusVGAState;
typedef void (*cirrus_bitblt_rop_t) (struct CirrusVGAState *s,
uint8_t * dst, const uint8_t * src,
@ -279,6 +265,50 @@ static void cirrus_update_memory_access(CirrusVGAState *s);
*
***************************************/
static bool blit_region_is_unsafe(struct CirrusVGAState *s,
int32_t pitch, int32_t addr)
{
if (pitch < 0) {
int64_t min = addr
+ ((int64_t)s->cirrus_blt_height-1) * pitch;
int32_t max = addr
+ s->cirrus_blt_width;
if (min < 0 || max >= s->vga.vram_size) {
return true;
}
} else {
int64_t max = addr
+ ((int64_t)s->cirrus_blt_height-1) * pitch
+ s->cirrus_blt_width;
if (max >= s->vga.vram_size) {
return true;
}
}
return false;
}
static bool blit_is_unsafe(struct CirrusVGAState *s)
{
/* should be the case, see cirrus_bitblt_start */
assert(s->cirrus_blt_width > 0);
assert(s->cirrus_blt_height > 0);
if (s->cirrus_blt_width > CIRRUS_BLTBUFSIZE) {
return true;
}
if (blit_region_is_unsafe(s, s->cirrus_blt_dstpitch,
s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) {
return true;
}
if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch,
s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) {
return true;
}
return false;
}
static void cirrus_bitblt_rop_nop(CirrusVGAState *s,
uint8_t *dst,const uint8_t *src,
int dstpitch,int srcpitch,
@ -636,7 +666,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s,
dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask);
if (BLTUNSAFE(s))
if (blit_is_unsafe(s))
return 0;
(*s->cirrus_rop) (s, dst, src,
@ -654,8 +684,9 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop)
{
cirrus_fill_t rop_func;
if (BLTUNSAFE(s))
if (blit_is_unsafe(s)) {
return 0;
}
rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1];
rop_func(s, s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask),
s->cirrus_blt_dstpitch,
@ -752,7 +783,7 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h)
static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s)
{
if (BLTUNSAFE(s))
if (blit_is_unsafe(s))
return 0;
cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr,