[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits |
Date: |
Fri, 11 Jul 2014 12:24:38 +0200 |
From: Benjamin Herrenschmidt <address@hidden>
Commit b2eb849d4b1fdb6f35d5c46958c7f703cf64cfef
"CVE-2007-1320 - Cirrus LGD-54XX "bitblt" heap overflow" broke
cpu to video blits.
When the ROP function is called from cirrus_bitblt_cputovideo_next(),
we pass 0 for the pitch but only operate on one line at a time. The
added test was tripping because after the initial substraction, the
pitch becomes negative. Make the test only trip when the height is
larger than one (ie. the pitch is actually used).
This fixes HW cursor support in Windows NT4.0 (which otherwise was
a white rectangle) and general display of icons in that OS when using
8bpp mode.
Signed-off-by: Benjamin Herrenschmidt <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/display/cirrus_vga_rop.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/hw/display/cirrus_vga_rop.h b/hw/display/cirrus_vga_rop.h
index 9c7bb09..0925a00 100644
--- a/hw/display/cirrus_vga_rop.h
+++ b/hw/display/cirrus_vga_rop.h
@@ -52,8 +52,7 @@ glue(cirrus_bitblt_rop_fwd_, ROP_NAME)(CirrusVGAState *s,
dstpitch -= bltwidth;
srcpitch -= bltwidth;
- if (dstpitch < 0 || srcpitch < 0) {
- /* is 0 valid? srcpitch == 0 could be useful */
+ if (bltheight > 1 && (dstpitch < 0 || srcpitch < 0)) {
return;
}
--
1.8.3.1
- [Qemu-devel] [PULL 0/3] vga: some cirrus fixes., Gerd Hoffmann, 2014/07/11
- [Qemu-devel] [PULL 1/3] cirrus_vga: adding sanity check for vram size, Gerd Hoffmann, 2014/07/11
- [Qemu-devel] [PULL 2/3] cirrus: Fix build of debug code, Gerd Hoffmann, 2014/07/11
- [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits,
Gerd Hoffmann <=
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Peter Lieven, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Benjamin Herrenschmidt, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Benjamin Herrenschmidt, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Peter Lieven, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Gerd Hoffmann, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Peter Lieven, 2014/07/14
- Re: [Qemu-devel] [PULL 3/3] cirrus: Fix host CPU blits, Gerd Hoffmann, 2014/07/14
Re: [Qemu-devel] [PULL 0/3] vga: some cirrus fixes., Peter Maydell, 2014/07/11