izzy/xemu
0
0
Fork 0
mirror of https://github.com/izzy2lost/xemu.git synced 2026-07-06 00:20:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'remotes/kraxel/tags/vga-20200605-pull-request' into staging

Browse Source 
vga: ati security fix, cirrus cleanup.

# gpg: Signature made Fri 05 Jun 2020 12:27:13 BST
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20200605-pull-request:
  hw/display/cirrus_vga: Fix code mis-indentation
  ati-vga: check mm_index before recursive call (CVE-2020-13800)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell
2020-06-05 13:53:05 +01:00
parent b489f015fb ae3887e6f0
commit 5d2f557b47
2 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hw/display/ati.c
+8 -2
View File
@@ -285,8 +285,11 @@ static uint64_t ati_mm_read(void *opaque, hwaddr addr, unsigned int size)
if (idx <= s->vga.vram_size - size) {
val = ldn_le_p(s->vga.vram_ptr + idx, size);
}
} else {
} else if (s->regs.mm_index > MM_DATA + 3) {
val = ati_mm_read(s, s->regs.mm_index + addr - MM_DATA, size);
} else {
qemu_log_mask(LOG_GUEST_ERROR,
"ati_mm_read: mm_index too small: %u\n", s->regs.mm_index);
}
break;
case BIOS_0_SCRATCH ... BUS_CNTL - 1:
@@ -520,8 +523,11 @@ static void ati_mm_write(void *opaque, hwaddr addr,
if (idx <= s->vga.vram_size - size) {
stn_le_p(s->vga.vram_ptr + idx, size, data);
}
} else {
} else if (s->regs.mm_index > MM_DATA + 3) {
ati_mm_write(s, s->regs.mm_index + addr - MM_DATA, data, size);
} else {
qemu_log_mask(LOG_GUEST_ERROR,
"ati_mm_write: mm_index too small: %u\n", s->regs.mm_index);
}
break;
case BIOS_0_SCRATCH ... BUS_CNTL - 1:
hw/display/cirrus_vga.c
+3 -3
View File
@@ -1032,9 +1032,9 @@ static void cirrus_bitblt_start(CirrusVGAState * s)
} else {
if (s->cirrus_blt_mode & CIRRUS_BLTMODE_TRANSPARENTCOMP) {
if (s->cirrus_blt_pixelwidth > 2) {
qemu_log_mask(LOG_GUEST_ERROR,
"cirrus: src transparent without colorexpand "
"must be 8bpp or 16bpp\n");
qemu_log_mask(LOG_GUEST_ERROR,
"cirrus: src transparent without colorexpand "
"must be 8bpp or 16bpp\n");
goto bitblt_ignore;
}
if (s->cirrus_blt_mode & CIRRUS_BLTMODE_BACKWARDS) {