vga: fix display update region calculation (split screen)
vga display update mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used. This can trigger an assert in cpu_physical_memory_snapshot_get_dirty(). Impact: DoS for privileged guest users. Fixes: CVE-2017-13673 Fixes:stable-2.10fec5e8c92b
Cc: P J P <ppandit@redhat.com> Reported-by: David Buchanan <d@vidbuchanan.co.uk> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Message-id: 20170828123307.15392-1-kraxel@redhat.com (cherry picked from commite65294157d
) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
parent
2a2eab6660
commit
d6f7f3b0cf
|
@ -1628,9 +1628,15 @@ static void vga_draw_graphic(VGACommonState *s, int full_update)
|
|||
y1 = 0;
|
||||
|
||||
if (!full_update) {
|
||||
ram_addr_t region_start = addr1;
|
||||
ram_addr_t region_end = addr1 + line_offset * height;
|
||||
vga_sync_dirty_bitmap(s);
|
||||
snap = memory_region_snapshot_and_clear_dirty(&s->vram, addr1,
|
||||
line_offset * height,
|
||||
if (s->line_compare < height) {
|
||||
/* split screen mode */
|
||||
region_start = 0;
|
||||
}
|
||||
snap = memory_region_snapshot_and_clear_dirty(&s->vram, region_start,
|
||||
region_end - region_start,
|
||||
DIRTY_MEMORY_VGA);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue