Andrew Geissler | 6ce62a2 | 2020-11-30 19:58:47 -0600 | [diff] [blame] | 1 | From ca1f9cbfdce4d63b10d57de80fef89a89d92a540 Mon Sep 17 00:00:00 2001 |
| 2 | From: Prasad J Pandit <pjp@fedoraproject.org> |
| 3 | Date: Wed, 21 Oct 2020 16:08:18 +0530 |
| 4 | Subject: [PATCH 1/1] ati: check x y display parameter values |
| 5 | |
| 6 | The source and destination x,y display parameters in ati_2d_blt() |
| 7 | may run off the vga limits if either of s->regs.[src|dst]_[xy] is |
| 8 | zero. Check the parameter values to avoid potential crash. |
| 9 | |
| 10 | Reported-by: Gaoning Pan <pgn@zju.edu.cn> |
| 11 | Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> |
| 12 | Message-id: 20201021103818.1704030-1-ppandit@redhat.com |
| 13 | Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> |
| 14 | |
| 15 | Upstream-Status: Backport [ https://git.qemu.org/?p=qemu.git;a=commitdiff;h=ca1f9cbfdce4d63b10d57de80fef89a89d92a540;hp=2ddafce7f797082ad216657c830afd4546f16e37 ] |
| 16 | CVE: CVE-2020-24352 |
| 17 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> |
| 18 | --- |
| 19 | hw/display/ati_2d.c | 10 ++++++---- |
| 20 | 1 file changed, 6 insertions(+), 4 deletions(-) |
| 21 | |
| 22 | diff --git a/hw/display/ati_2d.c b/hw/display/ati_2d.c |
| 23 | index 23a8ae0..4dc10ea 100644 |
| 24 | --- a/hw/display/ati_2d.c |
| 25 | +++ b/hw/display/ati_2d.c |
| 26 | @@ -75,8 +75,9 @@ void ati_2d_blt(ATIVGAState *s) |
| 27 | dst_stride *= bpp; |
| 28 | } |
| 29 | uint8_t *end = s->vga.vram_ptr + s->vga.vram_size; |
| 30 | - if (dst_bits >= end || dst_bits + dst_x + (dst_y + s->regs.dst_height) * |
| 31 | - dst_stride >= end) { |
| 32 | + if (dst_x > 0x3fff || dst_y > 0x3fff || dst_bits >= end |
| 33 | + || dst_bits + dst_x |
| 34 | + + (dst_y + s->regs.dst_height) * dst_stride >= end) { |
| 35 | qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); |
| 36 | return; |
| 37 | } |
| 38 | @@ -107,8 +108,9 @@ void ati_2d_blt(ATIVGAState *s) |
| 39 | src_bits += s->regs.crtc_offset & 0x07ffffff; |
| 40 | src_stride *= bpp; |
| 41 | } |
| 42 | - if (src_bits >= end || src_bits + src_x + |
| 43 | - (src_y + s->regs.dst_height) * src_stride >= end) { |
| 44 | + if (src_x > 0x3fff || src_y > 0x3fff || src_bits >= end |
| 45 | + || src_bits + src_x |
| 46 | + + (src_y + s->regs.dst_height) * src_stride >= end) { |
| 47 | qemu_log_mask(LOG_UNIMP, "blt outside vram not implemented\n"); |
| 48 | return; |
| 49 | } |
| 50 | -- |
| 51 | 1.8.3.1 |
| 52 | |