OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

Browse Source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABAgAGBQJYsDhPAAoJEEy22O7T6HE4DYsP/22ebOloBZ6AhbJyx/msnBsg
 EO3vUMytNuC0eIJAjTwVENHxg0CFZ7O2iKIIqb0bmORcjVlD/2zTjc9ooLKhBS9y
 sZ+XpoMOTp4wF47eEKZ+HI1P4DZfyzkwM4XT+22f89knZN2FElaa26Tn4IWDDyjh
 INpA0gesa4gG0tb0jZ34xCEaeP3sbZtXnOugD4TaFUM1+b9YiMXz/yo8ZnyK6M06
 wfmLsZx+qLGA3YVFroKYKzm7dEXoQ/FdD3xZS8ZrfkBaiwZyKzE2TLZHlJvcGi5w
 pksFlnGxPq9E/QS9+USXb07HrSxbyVhjkU4AlFdjGCwpPMPBUbT2FinhdZEf3IiQ
 ++9e32A60k1QYUjrM6mRsuQD4/fID6n2YZhF7YrSCzrcIry5OIPYl0mcj0QWyN3y
 k9Cl/LRUwZ5Xo8qAUs9VtUzshkODGO0OPRKif8qbMCU3OkR5Bd7t6ZjNvCQhU1tp
 XTlIwOJpsvkJZoiLg5rIRQBnyzELsxxuO5BoH/prn+q+loavp69Q27CSXh1xj0f9
 +P6YcYve0EKCBlsYBKZEUISIoR1Iwkq4ZgFAI9PKC75KjIXZBD1BqHSO6wYnqKfz
 ignWjOnigwB+RwTu9ZVnnIyT0G8EUcr4EYLFLXKCxndYjmx7ADIYa7Lk9RQbDfXS
 P7SJ+1c5UnFnZTqwX7Es
 =FIXP
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/pull-cve-2017-2620-20170224-1' into staging

cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

# gpg: Signature made Fri 24 Feb 2017 13:42:39 GMT
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/pull-cve-2017-2620-20170224-1:
  cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2017-02-24 13:55:26 +00:00
commit 63f495beb4
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
hw/display/cirrus_vga.c
View File

@ -900,6 +900,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
{
int w;
if (blit_is_unsafe(s, true)) {
return 0;
}
s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC;
s->cirrus_srcptr = &s->cirrus_bltbuf[0];
s->cirrus_srcptr_end = &s->cirrus_bltbuf[0];
@ -925,6 +929,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s)
}
s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height;
}
/* the blit_is_unsafe call above should catch this */
assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE);
s->cirrus_srcptr = s->cirrus_bltbuf;
s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch;
cirrus_update_memory_access(s);