| From d52680fc932efb8a2f334cc6993e705ed1e31e99 Mon Sep 17 00:00:00 2001 |
| From: Prasad J Pandit <pjp@fedoraproject.org> |
| Date: Thu, 25 Apr 2019 12:05:34 +0530 |
| Subject: [PATCH] qxl: check release info object |
| |
| When releasing spice resources in release_resource() routine, |
| if release info object 'ext.info' is null, it leads to null |
| pointer dereference. Add check to avoid it. |
| |
| Reported-by: Bugs SysSec <bugs-syssec@rub.de> |
| Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> |
| Message-id: 20190425063534.32747-1-ppandit@redhat.com |
| Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
| |
| Upstream-Status: Backport |
| CVE: CVE-2019-12155 |
| Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> |
| --- |
| hw/display/qxl.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/hw/display/qxl.c b/hw/display/qxl.c |
| index c8ce5781e03..632923add23 100644 |
| --- a/hw/display/qxl.c |
| +++ b/hw/display/qxl.c |
| @@ -777,6 +777,9 @@ static void interface_release_resource(QXLInstance *sin, |
| QXLReleaseRing *ring; |
| uint64_t *item, id; |
| |
| + if (!ext.info) { |
| + return; |
| + } |
| if (ext.group_id == MEMSLOT_GROUP_HOST) { |
| /* host group -> vga mode update request */ |
| QXLCommandExt *cmdext = (void *)(intptr_t)(ext.info->id); |