cirrus: keep vga vram pointer within bounds

Commit Message

Prasad Pandit Oct. 10, 2017, 9:36 p.m. UTC

From: Prasad J Pandit <[e-mail]>

'dst' pointer could exceed vga vram size when writing to the
cirrus memory area; it'd lead to an OOB access issue. Add check
to avoid it.

Reported-by: Niu Guoxiang <[e-mail]>
Signed-off-by: Prasad J Pandit <[e-mail]>
---
 hw/display/cirrus_vga.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

[e-mail] Oct. 11, 2017, 12:23 a.m. UTC | #1

Hi,

This series seems to have some coding style problems. See output below for
more information:

Type: series
Message-id: [e-mail]
Subject: [Qemu-devel] [PATCH] cirrus: keep vga vram pointer within bounds

=== TEST SCRIPT BEGIN ===
#!/bin/bash

BASE=base
n=1
total=$(git log --oneline $BASE.. | wc -l)
failed=0

git config --local diff.renamelimit 0
git config --local diff.renames True

commits="$(git log --format=%H --reverse $BASE..)"
for c in $commits; do
    echo "Checking PATCH $n/$total: $(git log -n 1 --format=%s $c)..."
    if ! git show $c --format=email | ./scripts/checkpatch.pl --mailback -; then
        failed=1
        echo
    fi
    n=$((n+1))
done

exit $failed
=== TEST SCRIPT END ===

Updating 3c8cf5a9c21ff8782164d1def7f44bd888713384
Switched to a new branch 'test'
62900c4b66 cirrus: keep vga vram pointer within bounds

=== OUTPUT BEGIN ===
Checking PATCH 1/1: cirrus: keep vga vram pointer within bounds...
ERROR: spaces required around that '<<' (ctx:VxV)
#40: FILE: hw/display/cirrus_vga.c:2081:
+    memory_region_set_dirty(&s->vga.vram, offset, x<<1);
                                                    ^

total: 1 errors, 0 warnings, 24 lines checked

Your patch has style problems, please review.  If any of these errors
are false positives report them to the maintainer, see
CHECKPATCH in MAINTAINERS.

=== OUTPUT END ===

Test command exited with code: 1


---
Email generated automatically by Patchew [http://patchew.org/].
Please send your feedback to [e-mail]

Patch

diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index afc290ab91..451a736262 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -2047,8 +2047,11 @@  static void cirrus_mem_writeb_mode4and5_8bpp(CirrusVGAState * s,
 	}
 	val <<= 1;
 	dst++;
+        if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+            break;
+        }
     }
-    memory_region_set_dirty(&s->vga.vram, offset, 8);
+    memory_region_set_dirty(&s->vga.vram, offset, x);
 }
 
 static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
@@ -2071,8 +2074,11 @@  static void cirrus_mem_writeb_mode4and5_16bpp(CirrusVGAState * s,
 	}
 	val <<= 1;
 	dst += 2;
+        if (dst >= s->vga.vram_ptr + s->vga.vram_size) {
+            break;
+        }
     }
-    memory_region_set_dirty(&s->vga.vram, offset, 16);
+    memory_region_set_dirty(&s->vga.vram, offset, x<<1);
 }
 
 /***************************************