[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 105/113] vga: fix region calculation
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 105/113] vga: fix region calculation |
Date: |
Mon, 18 Jun 2018 20:43:11 -0500 |
From: Gerd Hoffmann <address@hidden>
Typically the scanline length and the line offset are identical. But
in case they are not our calculation for region_end is incorrect. Using
line_offset is fine for all scanlines, except the last one where we have
to use the actual scanline length.
Fixes: CVE-2018-7550
Reported-by: Ross Lagerwall <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Prasad J Pandit <address@hidden>
Tested-by: Ross Lagerwall <address@hidden>
Message-id: address@hidden
(cherry picked from commit 7cdc61becd095b64a786b2625f321624e7111f3d)
Signed-off-by: Michael Roth <address@hidden>
---
hw/display/vga.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/display/vga.c b/hw/display/vga.c
index d150a3a3eb..1fa66d597d 100644
--- a/hw/display/vga.c
+++ b/hw/display/vga.c
@@ -1489,6 +1489,8 @@ static void vga_draw_graphic(VGACommonState *s, int
full_update)
region_start = (s->start_addr * 4);
region_end = region_start + (ram_addr_t)s->line_offset * height;
+ region_end += width * s->get_bpp(s) / 8; /* scanline length */
+ region_end -= s->line_offset;
if (region_end > s->vbe_size) {
/* wraps around (can happen with cirrus vbe modes) */
region_start = 0;
--
2.11.0
- [Qemu-devel] [PATCH 00/113] Patch Round-up for stable 2.11.2, freeze on 2018-06-22, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 099/113] ahci: fix PxCI register race, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 100/113] arm_gicv3_kvm: kvm_dist_get/put: skip the registers banked by GICR, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 009/113] spapr: use spapr->vsmt to compute VCPU ids, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 101/113] block: Make bdrv_is_writable() public, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 102/113] qcow2: Do not mark inactive images corrupt, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 103/113] iotests: Add case for a corrupted inactive image, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 104/113] throttle: Fix crash on reopen, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 105/113] vga: fix region calculation,
Michael Roth <=
- [Qemu-devel] [PATCH 106/113] i386: define the 'ssbd' CPUID feature bit (CVE-2018-3639), Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 107/113] i386: Define the Virt SSBD MSR and handling of it (CVE-2018-3639), Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 108/113] i386: define the AMD 'virt-ssbd' CPUID feature bit (CVE-2018-3639), Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 109/113] tap: set vhostfd passed from qemu cli to non-blocking, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 110/113] vhost-user: delete net client if necessary, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 010/113] spapr: move VCPU calculation to core machine code, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 111/113] qemu-img: Fix assert when mapping unaligned raw file, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 112/113] iotests: Add test 221 to catch qemu-img map regression, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 113/113] arm_gicv3_kvm: kvm_dist_get/put_priority: skip the registers banked by GICR_IPRIORITYR, Michael Roth, 2018/06/18
- [Qemu-devel] [PATCH 011/113] target/ppc: Clarify compat mode max_threads value, Michael Roth, 2018/06/18