Google Git
Sign in
qemu / qemu / ac2071c3791b67fc7af78b8ceb320c01ca1b5df7
commitac2071c3791b67fc7af78b8ceb320c01ca1b5df7[log] [tgz]
authorBALATON Zoltan <balaton@eik.bme.hu>Mon Apr 06 22:34:26 2020 +0200
committerGerd Hoffmann <kraxel@redhat.com>Tue Apr 07 09:25:23 2020 +0200
tree0e951ae17812aac4ca3ca98d695e6b676480a4e2
parent8d1439b692c5dc8edc4d4a1d334afd7070458029 [diff]
ati-vga: Fix checks in ati_2d_blt() to avoid crash

In some corner cases (that never happen during normal operation but a
malicious guest could program wrong values) pixman functions were
called with parameters that result in a crash. Fix this and add more
checks to disallow such cases.

Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-id: 20200406204029.19559747D5D@zero.eik.bme.hu
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
1 file changed
tree: 0e951ae17812aac4ca3ca98d695e6b676480a4e2
  1. .gitlab-ci.d/
  2. accel/
  3. audio/
  4. authz/
  5. backends/
  6. block/
  7. bsd-user/
  8. chardev/
  9. contrib/
  10. crypto/
  11. default-configs/
  12. disas/
  13. docs/
  14. dump/
  15. fpu/
  16. fsdev/
  17. gdb-xml/
  18. hw/
  19. include/
  20. io/
  21. libdecnumber/
  22. linux-headers/
  23. linux-user/
  24. migration/
  25. monitor/
  26. nbd/
  27. net/
  28. pc-bios/
  29. plugins/
  30. po/
  31. python/
  32. qapi/
  33. qga/
  34. qobject/
  35. qom/
  36. replay/
  37. roms/
  38. scripts/
  39. scsi/
  40. softmmu/
  41. storage-daemon/
  42. stubs/
  43. target/
  44. tcg/
  45. tests/
  46. tools/
  47. trace/
  48. ui/
  49. util/
  50. capstone
  51. dtc
  52. slirp
  53. .cirrus.yml
  54. .dir-locals.el
  55. .editorconfig
  56. .exrc
  57. .gdbinit
  58. .gitignore
  59. .gitlab-ci-edk2.yml
  60. .gitlab-ci-opensbi.yml
  61. .gitlab-ci.yml
  62. .gitmodules
  63. .gitpublish
  64. .mailmap
  65. .patchew.yml
  66. .readthedocs.yml
  67. .shippable.yml
  68. .travis.yml
  69. arch_init.c
  70. balloon.c
  71. block.c
  72. blockdev-nbd.c
  73. blockdev.c
  74. blockjob.c
  75. bootdevice.c
  76. Changelog
  77. CODING_STYLE.rst
  78. configure
  79. COPYING
  80. COPYING.LIB
  81. cpus-common.c
  82. cpus.c
  83. device_tree.c
  84. disas.c
  85. dma-helpers.c
  86. exec-vary.c
  87. exec.c
  88. gdbstub.c
  89. gitdm.config
  90. hmp-commands-info.hx
  91. hmp-commands.hx
  92. ioport.c
  93. iothread.c
  94. job-qmp.c
  95. job.c
  96. Kconfig.host
  97. LICENSE
  98. MAINTAINERS
  99. Makefile
  100. Makefile.objs
  101. Makefile.target
  102. memory.c
  103. memory_ldst.inc.c
  104. memory_mapping.c
  105. module-common.c
  106. os-posix.c
  107. os-win32.c
  108. qdev-monitor.c
  109. qemu-bridge-helper.c
  110. qemu-edid.c
  111. qemu-img-cmds.hx
  112. qemu-img.c
  113. qemu-io-cmds.c
  114. qemu-io.c
  115. qemu-keymap.c
  116. qemu-nbd.c
  117. qemu-options-wrapper.h
  118. qemu-options.h
  119. qemu-options.hx
  120. qemu-seccomp.c
  121. qemu-storage-daemon.c
  122. qemu.nsi
  123. qemu.sasl
  124. qtest.c
  125. README.rst
  126. replication.c
  127. replication.h
  128. rules.mak
  129. thunk.c
  130. tpm.c
  131. trace-events
  132. VERSION
  133. version.rc