Google Git
Sign in
qemu / qemu / 3d90c6254863693a6b13d918d2b8682e08bbc681
commit3d90c6254863693a6b13d918d2b8682e08bbc681[log] [tgz]
authorGerd Hoffmann <kraxel@redhat.com>Mon Aug 28 14:29:06 2017 +0200
committerGerd Hoffmann <kraxel@redhat.com>Fri Sep 01 13:52:43 2017 +0200
tree41f305d2ad30ffad4ea463ca2c89f83e53eb2067
parente65294157d4b69393b3f819c99f4f647452b48e3 [diff]
vga: stop passing pointers to vga_draw_line* functions

Instead pass around the address (aka offset into vga memory).
Add vga_read_* helper functions which apply vbe_size_mask to
the address, to make sure the address stays within the valid
range, similar to the cirrus blitter fixes (commits ffaf857778
and 026aeffcb4).

Impact:  DoS for privileged guest users.  qemu crashes with
a segfault, when hitting the guard page after vga memory
allocation, while reading vga memory for display updates.

Fixes: CVE-2017-13672
Cc: P J P <ppandit@redhat.com>
Reported-by: David Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20170828122906.18993-1-kraxel@redhat.com
3 files changed
tree: 41f305d2ad30ffad4ea463ca2c89f83e53eb2067
  1. accel/
  2. audio/
  3. backends/
  4. block/
  5. bsd-user/
  6. chardev/
  7. contrib/
  8. crypto/
  9. default-configs/
  10. disas/
  11. docs/
  12. fpu/
  13. fsdev/
  14. gdb-xml/
  15. hw/
  16. include/
  17. io/
  18. libdecnumber/
  19. linux-headers/
  20. linux-user/
  21. migration/
  22. nbd/
  23. net/
  24. pc-bios/
  25. po/
  26. qapi/
  27. qga/
  28. qobject/
  29. qom/
  30. replay/
  31. roms/
  32. scripts/
  33. slirp/
  34. stubs/
  35. target/
  36. tcg/
  37. tests/
  38. trace/
  39. ui/
  40. util/
  41. dtc
  42. pixman
  43. .dir-locals.el
  44. .editorconfig
  45. .exrc
  46. .gdbinit
  47. .gitignore
  48. .gitmodules
  49. .mailmap
  50. .shippable.yml
  51. .travis.yml
  52. arch_init.c
  53. atomic_template.h
  54. balloon.c
  55. block.c
  56. blockdev-nbd.c
  57. blockdev.c
  58. blockjob.c
  59. bootdevice.c
  60. bt-host.c
  61. bt-vhci.c
  62. Changelog
  63. CODING_STYLE
  64. configure
  65. COPYING
  66. COPYING.LIB
  67. COPYING.PYTHON
  68. cpus-common.c
  69. cpus.c
  70. device-hotplug.c
  71. device_tree.c
  72. disas.c
  73. dma-helpers.c
  74. dump.c
  75. exec.c
  76. gdbstub.c
  77. HACKING
  78. hax-stub.c
  79. hmp-commands-info.hx
  80. hmp-commands.hx
  81. hmp.c
  82. hmp.h
  83. ioport.c
  84. iothread.c
  85. LICENSE
  86. MAINTAINERS
  87. Makefile
  88. Makefile.objs
  89. Makefile.target
  90. memory.c
  91. memory_ldst.inc.c
  92. memory_mapping.c
  93. module-common.c
  94. monitor.c
  95. numa.c
  96. os-posix.c
  97. os-win32.c
  98. qapi-schema.json
  99. qdev-monitor.c
  100. qdict-test-data.txt
  101. qemu-bridge-helper.c
  102. qemu-doc.texi
  103. qemu-ga.texi
  104. qemu-img-cmds.hx
  105. qemu-img.c
  106. qemu-img.texi
  107. qemu-io-cmds.c
  108. qemu-io.c
  109. qemu-nbd.c
  110. qemu-nbd.texi
  111. qemu-option-trace.texi
  112. qemu-options-wrapper.h
  113. qemu-options.h
  114. qemu-options.hx
  115. qemu-seccomp.c
  116. qemu-tech.texi
  117. qemu.nsi
  118. qemu.sasl
  119. qmp.c
  120. qtest.c
  121. README
  122. replication.c
  123. replication.h
  124. rules.mak
  125. softmmu_template.h
  126. thunk.c
  127. tpm.c
  128. trace-events
  129. user-exec-stub.c
  130. user-exec.c
  131. VERSION
  132. version.rc
  133. vl.c