haraldwolff/qemu-patch-raspberry4
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

vga: ati security fix, cirrus cleanup.

Browse source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.22 (GNU/Linux)
 
 iQIcBAABCgAGBQJe2iwRAAoJEEy22O7T6HE4BXYP/jT6RaTnw0NhgyNtD3Eq/943
 0391Ihv019M3bnNlYu5rF9N1B8fRYfgODCsvOxkWTCjJl1evsHe9T0xuZKLFIcvB
 clJznEQ02FuPbt3jFC+JltqRg8pv/GleLeF45El8xgkckaIXgAhqQ4g6ApXkXIzi
 3s9ENKyKYogNxpl7/XPUVzGol8Fhrch2wnIS4pQ+SeH9ieYv8f47YWYVljG189ZX
 9o0vzKZmMTmW9sqCOO5DI50x4A1RrFzLjCIdnroLl2NKnAopxi5no2oSGhmMe55a
 5z9AHaLdlVrh2aHSfYrucs78/NiN6LtMrCt3yJ7eHkHBHL/RNN6rMrpI9A0UyI41
 P/xqUUerd9+dxzZkTbyqAvwhAitJffBq6eeFkt7sRESA9GyHudxomTj+nMtkGgRV
 9pvsjnr7+IOav+TT4MLmwyKBeKxad7mhNSoNPCCmt4Ek/FwP+EzeH5Ix4b3hQFa9
 NjsicruiBDwkZmHpY/6qSuEpWabITMcquN/iiAnkOTXnRMXnh62zcFQQUU/3riiB
 iCuaBXMRFLDtbpb6ILGZeY27PeY5Il8vJ+3brFzMuaMp8TtkWy3mnWysRjEfvo6c
 TJDvVbWJRx5BGq6Ja3RLwTFGaxbpM2oVmbW6/dSTCVeu4Jijhf9aQ5vyeJvJp4cS
 0zXW+1Zd7778bBFyei4P
 =NNSV
 -----END PGP SIGNATURE-----

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' into staging

vga: ati security fix, cirrus cleanup.

# gpg: Signature made Fri 05 Jun 2020 12:27:13 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20200605-pull-request:
  hw/display/cirrus_vga: Fix code mis-indentation
  ati-vga: check mm_index before recursive call (CVE-2020-13800)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell 2020-06-05 13:53:05 +01:00
parent b489f015fb ae3887e6f0
commit 5d2f557b47
2 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
hw/display/ati.c
View file

@ -285,8 +285,11 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
if (idx <= s->vga.vram_size - size) {
val = ldn_le_p(s->vga.vram_ptr + idx, size);
}
} else {
} else if (s->regs.mm_index > MM_DATA + 3) {
val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
} else {
qemu_log_mask(LOG_GUEST_ERROR,
"ati_mm_read: mm_index too small: %u\n", s->regs.mm_index);
}
break;
case BIOS_0_SCRATCH ... BUS_CNTL - 1:
@ -520,8 +523,11 @@ static void ati_mm_write(void *opaque, hwaddr addr,
if (idx <= s->vga.vram_size - size) {
stn_le_p(s->vga.vram_ptr + idx, size, data);
}
} else {
} else if (s->regs.mm_index > MM_DATA + 3) {
ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);
} else {
qemu_log_mask(LOG_GUEST_ERROR,
"ati_mm_write: mm_index too small: %u\n", s->regs.mm_index);
}
break;
case BIOS_0_SCRATCH ... BUS_CNTL - 1:

6
hw/display/cirrus_vga.c
View file

@ -1032,9 +1032,9 @@ static void cirrus_bitblt_start(CirrusVGAState * s)
} else {
if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
if (s->cirrus_blt_pixelwidth > 2) {
qemu_log_mask(LOG_GUEST_ERROR,
"cirrus: src transparent without colorexpand "
"must be 8bpp or 16bpp\n");
qemu_log_mask(LOG_GUEST_ERROR,
"cirrus: src transparent without colorexpand "
"must be 8bpp or 16bpp\n");
goto bitblt_ignore;
}
if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {