From patchwork Thu Feb 2 15:05:07 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Gerd Hoffmann X-Patchwork-Id: 9552301 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7B691602F0 for ; Thu, 2 Feb 2017 15:40:09 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 74E93283E8 for ; Thu, 2 Feb 2017 15:40:09 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 69C8728479; Thu, 2 Feb 2017 15:40:09 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id E5F3E283E8 for ; Thu, 2 Feb 2017 15:40:07 +0000 (UTC) Received: from localhost ([::1]:57331 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cZJUU-0007XL-Gj for patchwork-qemu-devel@patchwork.kernel.org; Thu, 02 Feb 2017 10:40:06 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43465) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cZIwn-00009b-Np for qemu-devel@nongnu.org; Thu, 02 Feb 2017 10:05:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cZIwh-0002rI-KZ for qemu-devel@nongnu.org; Thu, 02 Feb 2017 10:05:17 -0500 Received: from mx1.redhat.com ([209.132.183.28]:36714) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cZIwh-0002qk-G0; Thu, 02 Feb 2017 10:05:11 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A455285540; Thu, 2 Feb 2017 15:05:11 +0000 (UTC) Received: from nilsson.home.kraxel.org (ovpn-116-68.ams2.redhat.com [10.36.116.68]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v12F5AtE021438; Thu, 2 Feb 2017 10:05:10 -0500 Received: by nilsson.home.kraxel.org (Postfix, from userid 500) id 1328380756; Thu, 2 Feb 2017 16:05:09 +0100 (CET) From: Gerd Hoffmann To: qemu-devel@nongnu.org Date: Thu, 2 Feb 2017 16:05:07 +0100 Message-Id: <1486047907-26685-5-git-send-email-kraxel@redhat.com> In-Reply-To: <1486047907-26685-1-git-send-email-kraxel@redhat.com> References: <1486047907-26685-1-git-send-email-kraxel@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Thu, 02 Feb 2017 15:05:11 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PULL 4/4] cirrus: fix oob access issue (CVE-2017-2615) X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Wolfgang Bumiller , Li Qiang , qemu-stable@nongnu.org, P J P , Gerd Hoffmann , Paolo Bonzini , Laszlo Ersek Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Li Qiang When doing bitblt copy in backward mode, we should minus the blt width first just like the adding in the forward mode. This can avoid the oob access of the front of vga's vram. Signed-off-by: Li Qiang { kraxel: with backward blits (negative pitch) addr is the topmost address, so check it as-is against vram size ] Cc: qemu-stable@nongnu.org Cc: P J P Cc: Laszlo Ersek Cc: Paolo Bonzini Cc: Wolfgang Bumiller Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106) Signed-off-by: Gerd Hoffmann Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com Reviewed-by: Laszlo Ersek --- hw/display/cirrus_vga.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c index 7db6409..16f27e8 100644 --- a/hw/display/cirrus_vga.c +++ b/hw/display/cirrus_vga.c @@ -274,10 +274,9 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, { if (pitch < 0) { int64_t min = addr - + ((int64_t)s->cirrus_blt_height-1) * pitch; - int32_t max = addr - + s->cirrus_blt_width; - if (min < 0 || max > s->vga.vram_size) { + + ((int64_t)s->cirrus_blt_height - 1) * pitch + - s->cirrus_blt_width; + if (min < -1 || addr >= s->vga.vram_size) { return true; } } else {