54 lines
2.0 KiB
Diff
54 lines
2.0 KiB
Diff
|
From 9557ba506470517668ffecb4d5ef4804eca4fd88 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Prasad J Pandit <pjp@fedoraproject.org>
|
||
|
|
Date: Wed, 18 Nov 2020 10:22:32 +0800
|
||
|
|
Subject: [PATCH] ati: check x y display parameter values
|
||
|
|
|
||
|
|
fix CVE-2020-24352
|
||
|
|
|
||
|
|
The source and destination x,y display parameters in ati_2d_blt()
|
||
|
|
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
|
||
|
|
zero. Check the parameter values to avoid potential crash.
|
||
|
|
|
||
|
|
Reported-by: Gaoning Pan <pgn@zju.edu.cn>
|
||
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
||
|
|
Message-id: 20201021103818.1704030-1-ppandit@redhat.com
|
||
|
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||
|
|
|
||
|
|
cherry-pick from commit ca1f9cbfdce4d63b10d57de80fef89a89d92a540
|
||
|
|
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
|
||
|
|
---
|
||
|
|
hw/display/ati_2d.c | 10 ++++++----
|
||
|
|
1 file changed, 6 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c
|
||
|
|
index 23a8ae0cd8..4dc10ea795 100644
|
||
|
|
--- a/hw/display/ati_2d.c
|
||
|
|
+++ b/hw/display/ati_2d.c
|
||
|
|
@@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s)
|
||
|
|
dst_stride *= bpp;
|
||
|
|
}
|
||
|
|
uint8_t *end = s->vga.vram_ptr + s->vga.vram_size;
|
||
|
|
- if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) *
|
||
|
|
- dst_stride >= end) {
|
||
|
|
+ if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end
|
||
|
|
+ || dst_bits + dst_x
|
||
|
|
+ + (dst_y + s->regs.dst_height) * dst_stride >= end) {
|
||
|
|
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
@@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s)
|
||
|
|
src_bits += s->regs.crtc_offset & 0x07ffffff;
|
||
|
|
src_stride *= bpp;
|
||
|
|
}
|
||
|
|
- if (src_bits >= end || src_bits + src_x +
|
||
|
|
- (src_y + s->regs.dst_height) * src_stride >= end) {
|
||
|
|
+ if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end
|
||
|
|
+ || src_bits + src_x
|
||
|
|
+ + (src_y + s->regs.dst_height) * src_stride >= end) {
|
||
|
|
qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n");
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|