Google Git
Sign in
qemu / qemu / 62d4c6bd5263bb8413a06c80144fc678df6dfb64
commit62d4c6bd5263bb8413a06c80144fc678df6dfb64[log] [tgz]
authorLi Qiang <liqiang6-s@360.cn>Wed Feb 01 09:35:01 2017 +0100
committerGerd Hoffmann <kraxel@redhat.com>Thu Feb 02 15:58:23 2017 +0100
treeaa25a3b95608e0f825c312751b11bf7039080b2d
parent60cd23e85151525ab26591394c4e7e06fa07d216 [diff]
cirrus: fix oob access issue (CVE-2017-2615)

When doing bitblt copy in backward mode, we should minus the
blt width first just like the adding in the forward mode. This
can avoid the oob access of the front of vga's vram.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>

{ kraxel: with backward blits (negative pitch) addr is the topmost
          address, so check it as-is against vram size ]

Cc: qemu-stable@nongnu.org
Cc: P J P <ppandit@redhat.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
1 file changed
tree: aa25a3b95608e0f825c312751b11bf7039080b2d
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. contrib/
  6. crypto/
  7. default-configs/
  8. disas/
  9. docs/
  10. fpu/
  11. fsdev/
  12. gdb-xml/
  13. hw/
  14. include/
  15. io/
  16. libdecnumber/
  17. linux-headers/
  18. linux-user/
  19. migration/
  20. nbd/
  21. net/
  22. pc-bios/
  23. po/
  24. qapi/
  25. qga/
  26. qobject/
  27. qom/
  28. replay/
  29. roms/
  30. scripts/
  31. slirp/
  32. stubs/
  33. target/
  34. tcg/
  35. tests/
  36. trace/
  37. ui/
  38. util/
  39. dtc
  40. pixman
  41. .dir-locals.el
  42. .exrc
  43. .gitignore
  44. .gitmodules
  45. .mailmap
  46. .travis.yml
  47. accel.c
  48. aio-posix.c
  49. aio-win32.c
  50. arch_init.c
  51. async.c
  52. atomic_template.h
  53. balloon.c
  54. block.c
  55. blockdev-nbd.c
  56. blockdev.c
  57. blockjob.c
  58. bootdevice.c
  59. bt-host.c
  60. bt-vhci.c
  61. Changelog
  62. CODING_STYLE
  63. configure
  64. COPYING
  65. COPYING.LIB
  66. cpu-exec-common.c
  67. cpu-exec.c
  68. cpus-common.c
  69. cpus.c
  70. cputlb.c
  71. device-hotplug.c
  72. device_tree.c
  73. disas.c
  74. dma-helpers.c
  75. dump.c
  76. exec.c
  77. gdbstub.c
  78. HACKING
  79. hax-stub.c
  80. hmp-commands-info.hx
  81. hmp-commands.hx
  82. hmp.c
  83. hmp.h
  84. iohandler.c
  85. ioport.c
  86. iothread.c
  87. kvm-all.c
  88. kvm-stub.c
  89. LICENSE
  90. main-loop.c
  91. MAINTAINERS
  92. Makefile
  93. Makefile.objs
  94. Makefile.target
  95. memory.c
  96. memory_ldst.inc.c
  97. memory_mapping.c
  98. module-common.c
  99. monitor.c
  100. numa.c
  101. os-posix.c
  102. os-win32.c
  103. page_cache.c
  104. qapi-schema.json
  105. qdev-monitor.c
  106. qdict-test-data.txt
  107. qemu-bridge-helper.c
  108. qemu-char.c
  109. qemu-doc.texi
  110. qemu-ga.texi
  111. qemu-img-cmds.hx
  112. qemu-img.c
  113. qemu-img.texi
  114. qemu-io-cmds.c
  115. qemu-io.c
  116. qemu-nbd.c
  117. qemu-nbd.texi
  118. qemu-option-trace.texi
  119. qemu-options-wrapper.h
  120. qemu-options.h
  121. qemu-options.hx
  122. qemu-seccomp.c
  123. qemu-tech.texi
  124. qemu-timer.c
  125. qemu.nsi
  126. qemu.sasl
  127. qmp.c
  128. qtest.c
  129. README
  130. replication.c
  131. replication.h
  132. rules.mak
  133. softmmu_template.h
  134. spice-qemu-char.c
  135. tcg-runtime.c
  136. tci.c
  137. thread-pool.c
  138. thunk.c
  139. tpm.c
  140. trace-events
  141. translate-all.c
  142. translate-all.h
  143. translate-common.c
  144. user-exec-stub.c
  145. user-exec.c
  146. VERSION
  147. version.rc
  148. vl.c
  149. xen-common-stub.c
  150. xen-common.c
  151. xen-hvm-stub.c
  152. xen-hvm.c
  153. xen-mapcache.c