Google Git
Sign in
qemu / qemu / 92f2b88cea48c6aeba8de568a45f2ed958f3c298
commit92f2b88cea48c6aeba8de568a45f2ed958f3c298[log] [tgz]
authorGerd Hoffmann <kraxel@redhat.com>Wed Feb 08 11:18:36 2017 +0100
committerGerd Hoffmann <kraxel@redhat.com>Fri Feb 24 14:35:50 2017 +0100
tree6ed759495bfcf73c74481e0d8cc01c7d33cc8d21
parent10f25e4844cb9b3f02fb032f88051dd5b65b4206 [diff]
cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)

CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
and blit width, at all.  Oops.  Fix it.

Security impact: high.

The missing blit destination check allows to write to host memory.
Basically same as CVE-2014-8106 for the other blit variants.

Cc: qemu-stable@nongnu.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: 6ed759495bfcf73c74481e0d8cc01c7d33cc8d21
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. chardev/
  6. contrib/
  7. crypto/
  8. default-configs/
  9. disas/
  10. docs/
  11. fpu/
  12. fsdev/
  13. gdb-xml/
  14. hw/
  15. include/
  16. io/
  17. libdecnumber/
  18. linux-headers/
  19. linux-user/
  20. migration/
  21. nbd/
  22. net/
  23. pc-bios/
  24. po/
  25. qapi/
  26. qga/
  27. qobject/
  28. qom/
  29. replay/
  30. roms/
  31. scripts/
  32. slirp/
  33. stubs/
  34. target/
  35. tcg/
  36. tests/
  37. trace/
  38. ui/
  39. util/
  40. dtc
  41. pixman
  42. .dir-locals.el
  43. .exrc
  44. .gitignore
  45. .gitmodules
  46. .mailmap
  47. .travis.yml
  48. accel.c
  49. arch_init.c
  50. atomic_template.h
  51. balloon.c
  52. block.c
  53. blockdev-nbd.c
  54. blockdev.c
  55. blockjob.c
  56. bootdevice.c
  57. bt-host.c
  58. bt-vhci.c
  59. Changelog
  60. CODING_STYLE
  61. configure
  62. COPYING
  63. COPYING.LIB
  64. cpu-exec-common.c
  65. cpu-exec.c
  66. cpus-common.c
  67. cpus.c
  68. cputlb.c
  69. device-hotplug.c
  70. device_tree.c
  71. disas.c
  72. dma-helpers.c
  73. dump.c
  74. exec.c
  75. gdbstub.c
  76. HACKING
  77. hax-stub.c
  78. hmp-commands-info.hx
  79. hmp-commands.hx
  80. hmp.c
  81. hmp.h
  82. ioport.c
  83. iothread.c
  84. kvm-all.c
  85. kvm-stub.c
  86. LICENSE
  87. MAINTAINERS
  88. Makefile
  89. Makefile.objs
  90. Makefile.target
  91. memory.c
  92. memory_ldst.inc.c
  93. memory_mapping.c
  94. module-common.c
  95. monitor.c
  96. numa.c
  97. os-posix.c
  98. os-win32.c
  99. page_cache.c
  100. qapi-schema.json
  101. qdev-monitor.c
  102. qdict-test-data.txt
  103. qemu-bridge-helper.c
  104. qemu-doc.texi
  105. qemu-ga.texi
  106. qemu-img-cmds.hx
  107. qemu-img.c
  108. qemu-img.texi
  109. qemu-io-cmds.c
  110. qemu-io.c
  111. qemu-nbd.c
  112. qemu-nbd.texi
  113. qemu-option-trace.texi
  114. qemu-options-wrapper.h
  115. qemu-options.h
  116. qemu-options.hx
  117. qemu-seccomp.c
  118. qemu-tech.texi
  119. qemu.nsi
  120. qemu.sasl
  121. qmp.c
  122. qtest.c
  123. README
  124. replication.c
  125. replication.h
  126. rules.mak
  127. softmmu_template.h
  128. spice-qemu-char.c
  129. tcg-runtime.c
  130. tci.c
  131. thunk.c
  132. tpm.c
  133. trace-events
  134. translate-all.c
  135. translate-all.h
  136. translate-common.c
  137. user-exec-stub.c
  138. user-exec.c
  139. VERSION
  140. version.rc
  141. vl.c
  142. xen-common-stub.c
  143. xen-common.c
  144. xen-hvm-stub.c
  145. xen-hvm.c
  146. xen-mapcache.c